xff, 0x2df0a14c2c296676, 'team0\x00', 'team_slave_0\x00', {}, {0x1fe}, 0x33, 0x3, 0x4b}, 0x0, 0x98, 0xf8}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x3, [0x1, 0x80000000, 0x9, 0x5, 0x7fff, 0x5], 0x81, 0x80}, {0x44, [0x4, 0xfffffffb, 0x1, 0xa6, 0xfff, 0xe3], 0x7f, 0x7}}}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x578) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, 0x0, 0x0) connect$inet6(r3, &(0x7f0000d83fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, 0x0, &(0x7f0000000180)) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f0000000180)=0x8) r6 = socket$pptp(0x18, 0x1, 0x2) close(r6) 21:13:44 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r2 = dup2(r1, r0) r3 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x503882) fdatasync(r3) write$sndseq(r2, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:44 executing program 5: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x12, &(0x7f0000000040)=0xfffffffc, 0x4) 21:13:44 executing program 4: r0 = timerfd_create(0x7, 0x0) timerfd_settime(0xffffffffffffffff, 0x3, &(0x7f0000000040)={{0x77359400}, {0x0, 0x989680}}, 0x0) timerfd_settime(r0, 0x0, &(0x7f0000000000)={{0x0, 0x989680}}, 0x0) 21:13:44 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) fcntl$dupfd(r2, 0x0, r2) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) connect$inet(r3, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r3, 0x0, 0x10005, 0x0) 21:13:44 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x0) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:13:44 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r2 = dup2(r1, r0) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x503882) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r2, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:44 executing program 5: setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000040)=0xfffffffc, 0x4) 21:13:44 executing program 4: r0 = timerfd_create(0x7, 0x0) timerfd_settime(0xffffffffffffffff, 0x3, &(0x7f0000000040)={{0x77359400}, {0x0, 0x989680}}, 0x0) timerfd_settime(r0, 0x0, &(0x7f0000000000)={{0x0, 0x989680}}, 0x0) 21:13:44 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r2, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:44 executing program 5: setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000040)=0xfffffffc, 0x4) 21:13:44 executing program 4: r0 = timerfd_create(0x7, 0x0) timerfd_settime(0xffffffffffffffff, 0x3, &(0x7f0000000040)={{0x77359400}, {0x0, 0x989680}}, 0x0) timerfd_settime(r0, 0x0, &(0x7f0000000000)={{0x0, 0x989680}}, 0x0) 21:13:45 executing program 1: r0 = memfd_create(&(0x7f00000000c0)='GPL#wlan0posix_acl_accessppp1bdev\x00', 0xd) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) dup2(r1, r0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r2, 0x0, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) bind$inet(r4, &(0x7f0000000480)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r4, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x24e23, @local}, 0x10) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r4, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) write$binfmt_elf64(r4, &(0x7f00000000c0)=ANY=[@ANYRES64], 0xc63b9e35) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000001740)=@mangle={'mangle\x00', 0x1f, 0x6, 0x518, 0x290, 0xc0, 0x388, 0x290, 0x0, 0x480, 0x480, 0x480, 0x480, 0x480, 0x6, &(0x7f0000000400), {[{{@ip={@remote, @multicast1, 0xffffffff, 0xff000000, 'syz_tun\x00', 'veth1_to_bridge\x00', {}, {}, 0x4, 0x2, 0x1}, 0x0, 0x98, 0xc0}, @ECN={0x28, 'ECN\x00', 0x0, {0x8, 0x5, 0x2}}}, {{@uncond, 0x0, 0xc0, 0xe8, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00'}]}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x24, 0x1}}}, {{@uncond, 0x0, 0xc0, 0xe8, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00'}]}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x5f, 0x40}}}, {{@uncond, 0x0, 0x98, 0xf8}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @dev={[], 0x1d}, 0x5, 0x0, [0x16, 0x6, 0x2, 0x39, 0x1d, 0x2, 0x2b, 0xa, 0x20, 0x35, 0x3f, 0x23, 0x25, 0x19, 0xf, 0x27], 0x0, 0x1000}}}, {{@ip={@empty, @local, 0xff, 0x2df0a14c2c296676, 'team0\x00', 'team_slave_0\x00', {}, {0x1fe}, 0x33, 0x3, 0x4b}, 0x0, 0x98, 0xf8}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x3, [0x1, 0x80000000, 0x9, 0x5, 0x7fff, 0x5], 0x81, 0x80}, {0x44, [0x4, 0xfffffffb, 0x1, 0xa6, 0xfff, 0xe3], 0x7f, 0x7}}}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x578) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, 0x0, 0x0) connect$inet6(r3, &(0x7f0000d83fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, 0x0, &(0x7f0000000180)) socket$inet6_sctp(0xa, 0x5, 0x84) r5 = socket$pptp(0x18, 0x1, 0x2) close(r5) 21:13:45 executing program 5: setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000040)=0xfffffffc, 0x4) 21:13:45 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r2, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:45 executing program 4: r0 = timerfd_create(0x7, 0x0) timerfd_settime(r0, 0x0, &(0x7f0000000040)={{0x77359400}, {0x0, 0x989680}}, 0x0) timerfd_settime(r0, 0x0, &(0x7f0000000000)={{0x0, 0x989680}}, 0x0) 21:13:45 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) fcntl$dupfd(r2, 0x0, r2) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) connect$inet(r3, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r3, 0x0, 0x10005, 0x0) 21:13:45 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x0) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:13:45 executing program 4: r0 = timerfd_create(0x7, 0x0) timerfd_settime(r0, 0x0, &(0x7f0000000040)={{0x77359400}, {0x0, 0x989680}}, 0x0) timerfd_settime(r0, 0x0, &(0x7f0000000000)={{0x0, 0x989680}}, 0x0) 21:13:45 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r2, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:45 executing program 5: r0 = socket$packet(0x11, 0x0, 0x300) setsockopt$packet_int(r0, 0x107, 0x12, &(0x7f0000000040)=0xfffffffc, 0x4) 21:13:45 executing program 0: memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x503882) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(0xffffffffffffffff, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:45 executing program 5: r0 = socket$packet(0x11, 0x0, 0x300) setsockopt$packet_int(r0, 0x107, 0x12, &(0x7f0000000040)=0xfffffffc, 0x4) 21:13:45 executing program 4: r0 = timerfd_create(0x7, 0x0) timerfd_settime(r0, 0x0, &(0x7f0000000040)={{0x77359400}, {0x0, 0x989680}}, 0x0) timerfd_settime(r0, 0x0, &(0x7f0000000000)={{0x0, 0x989680}}, 0x0) 21:13:46 executing program 1: r0 = memfd_create(&(0x7f00000000c0)='GPL#wlan0posix_acl_accessppp1bdev\x00', 0xd) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) dup2(r1, r0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r2, 0x0, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) bind$inet(r4, &(0x7f0000000480)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r4, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x24e23, @local}, 0x10) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r4, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) write$binfmt_elf64(r4, &(0x7f00000000c0)=ANY=[@ANYRES64], 0xc63b9e35) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000001740)=@mangle={'mangle\x00', 0x1f, 0x6, 0x518, 0x290, 0xc0, 0x388, 0x290, 0x0, 0x480, 0x480, 0x480, 0x480, 0x480, 0x6, &(0x7f0000000400), {[{{@ip={@remote, @multicast1, 0xffffffff, 0xff000000, 'syz_tun\x00', 'veth1_to_bridge\x00', {}, {}, 0x4, 0x2, 0x1}, 0x0, 0x98, 0xc0}, @ECN={0x28, 'ECN\x00', 0x0, {0x8, 0x5, 0x2}}}, {{@uncond, 0x0, 0xc0, 0xe8, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00'}]}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x24, 0x1}}}, {{@uncond, 0x0, 0xc0, 0xe8, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00'}]}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x5f, 0x40}}}, {{@uncond, 0x0, 0x98, 0xf8}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @dev={[], 0x1d}, 0x5, 0x0, [0x16, 0x6, 0x2, 0x39, 0x1d, 0x2, 0x2b, 0xa, 0x20, 0x35, 0x3f, 0x23, 0x25, 0x19, 0xf, 0x27], 0x0, 0x1000}}}, {{@ip={@empty, @local, 0xff, 0x2df0a14c2c296676, 'team0\x00', 'team_slave_0\x00', {}, {0x1fe}, 0x33, 0x3, 0x4b}, 0x0, 0x98, 0xf8}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x3, [0x1, 0x80000000, 0x9, 0x5, 0x7fff, 0x5], 0x81, 0x80}, {0x44, [0x4, 0xfffffffb, 0x1, 0xa6, 0xfff, 0xe3], 0x7f, 0x7}}}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x578) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, 0x0, 0x0) connect$inet6(r3, &(0x7f0000d83fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, 0x0, &(0x7f0000000180)) r5 = socket$pptp(0x18, 0x1, 0x2) close(r5) 21:13:46 executing program 4: r0 = timerfd_create(0x7, 0x0) timerfd_settime(r0, 0x3, 0x0, 0x0) timerfd_settime(r0, 0x0, &(0x7f0000000000)={{0x0, 0x989680}}, 0x0) 21:13:46 executing program 0: memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x503882) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(0xffffffffffffffff, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:46 executing program 5: r0 = socket$packet(0x11, 0x0, 0x300) setsockopt$packet_int(r0, 0x107, 0x12, &(0x7f0000000040)=0xfffffffc, 0x4) 21:13:46 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) fcntl$dupfd(r2, 0x0, r2) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) bind$inet(r3, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r3, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r3, 0x0, 0x10005, 0x0) 21:13:46 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x0) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:13:46 executing program 0: memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x503882) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(0xffffffffffffffff, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:46 executing program 5: socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000040)=0xfffffffc, 0x4) 21:13:46 executing program 4: r0 = timerfd_create(0x7, 0x0) timerfd_settime(r0, 0x3, 0x0, 0x0) timerfd_settime(r0, 0x0, &(0x7f0000000000)={{0x0, 0x989680}}, 0x0) 21:13:46 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = dup2(0xffffffffffffffff, r0) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x503882) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:46 executing program 4: r0 = timerfd_create(0x7, 0x0) timerfd_settime(r0, 0x3, 0x0, 0x0) timerfd_settime(r0, 0x0, &(0x7f0000000000)={{0x0, 0x989680}}, 0x0) 21:13:46 executing program 5: socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000040)=0xfffffffc, 0x4) 21:13:47 executing program 1: r0 = memfd_create(&(0x7f00000000c0)='GPL#wlan0posix_acl_accessppp1bdev\x00', 0xd) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) dup2(r1, r0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r2, 0x0, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) bind$inet(r4, &(0x7f0000000480)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r4, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x24e23, @local}, 0x10) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r4, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) write$binfmt_elf64(r4, &(0x7f00000000c0)=ANY=[@ANYRES64], 0xc63b9e35) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000001740)=@mangle={'mangle\x00', 0x1f, 0x6, 0x518, 0x290, 0xc0, 0x388, 0x290, 0x0, 0x480, 0x480, 0x480, 0x480, 0x480, 0x6, &(0x7f0000000400), {[{{@ip={@remote, @multicast1, 0xffffffff, 0xff000000, 'syz_tun\x00', 'veth1_to_bridge\x00', {}, {}, 0x4, 0x2, 0x1}, 0x0, 0x98, 0xc0}, @ECN={0x28, 'ECN\x00', 0x0, {0x8, 0x5, 0x2}}}, {{@uncond, 0x0, 0xc0, 0xe8, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00'}]}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x24, 0x1}}}, {{@uncond, 0x0, 0xc0, 0xe8, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00'}]}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x5f, 0x40}}}, {{@uncond, 0x0, 0x98, 0xf8}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @dev={[], 0x1d}, 0x5, 0x0, [0x16, 0x6, 0x2, 0x39, 0x1d, 0x2, 0x2b, 0xa, 0x20, 0x35, 0x3f, 0x23, 0x25, 0x19, 0xf, 0x27], 0x0, 0x1000}}}, {{@ip={@empty, @local, 0xff, 0x2df0a14c2c296676, 'team0\x00', 'team_slave_0\x00', {}, {0x1fe}, 0x33, 0x3, 0x4b}, 0x0, 0x98, 0xf8}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x3, [0x1, 0x80000000, 0x9, 0x5, 0x7fff, 0x5], 0x81, 0x80}, {0x44, [0x4, 0xfffffffb, 0x1, 0xa6, 0xfff, 0xe3], 0x7f, 0x7}}}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x578) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, 0x0, 0x0) connect$inet6(r3, &(0x7f0000d83fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r5 = socket$pptp(0x18, 0x1, 0x2) close(r5) 21:13:47 executing program 4: r0 = timerfd_create(0x7, 0x0) timerfd_settime(r0, 0x3, &(0x7f0000000040)={{0x77359400}, {0x0, 0x989680}}, 0x0) timerfd_settime(0xffffffffffffffff, 0x0, &(0x7f0000000000)={{0x0, 0x989680}}, 0x0) 21:13:47 executing program 5: socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000040)=0xfffffffc, 0x4) 21:13:47 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = dup2(0xffffffffffffffff, r0) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x503882) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:47 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) fcntl$dupfd(r2, 0x0, r2) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) bind$inet(r3, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r3, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r3, 0x0, 0x10005, 0x0) 21:13:47 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:13:47 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = dup2(0xffffffffffffffff, r0) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x503882) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:47 executing program 4: r0 = timerfd_create(0x7, 0x0) timerfd_settime(r0, 0x3, &(0x7f0000000040)={{0x77359400}, {0x0, 0x989680}}, 0x0) timerfd_settime(0xffffffffffffffff, 0x0, &(0x7f0000000000)={{0x0, 0x989680}}, 0x0) 21:13:47 executing program 5: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x0, &(0x7f0000000040)=0xfffffffc, 0x4) 21:13:47 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r1 = dup2(r0, 0xffffffffffffffff) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x503882) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:47 executing program 4: r0 = timerfd_create(0x7, 0x0) timerfd_settime(r0, 0x3, &(0x7f0000000040)={{0x77359400}, {0x0, 0x989680}}, 0x0) timerfd_settime(0xffffffffffffffff, 0x0, &(0x7f0000000000)={{0x0, 0x989680}}, 0x0) 21:13:47 executing program 5: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x0, &(0x7f0000000040)=0xfffffffc, 0x4) 21:13:48 executing program 1: r0 = memfd_create(&(0x7f00000000c0)='GPL#wlan0posix_acl_accessppp1bdev\x00', 0xd) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) dup2(r1, r0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r2, 0x0, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) bind$inet(r4, &(0x7f0000000480)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r4, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x24e23, @local}, 0x10) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r4, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) write$binfmt_elf64(r4, &(0x7f00000000c0)=ANY=[@ANYRES64], 0xc63b9e35) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000001740)=@mangle={'mangle\x00', 0x1f, 0x6, 0x518, 0x290, 0xc0, 0x388, 0x290, 0x0, 0x480, 0x480, 0x480, 0x480, 0x480, 0x6, &(0x7f0000000400), {[{{@ip={@remote, @multicast1, 0xffffffff, 0xff000000, 'syz_tun\x00', 'veth1_to_bridge\x00', {}, {}, 0x4, 0x2, 0x1}, 0x0, 0x98, 0xc0}, @ECN={0x28, 'ECN\x00', 0x0, {0x8, 0x5, 0x2}}}, {{@uncond, 0x0, 0xc0, 0xe8, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00'}]}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x24, 0x1}}}, {{@uncond, 0x0, 0xc0, 0xe8, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00'}]}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x5f, 0x40}}}, {{@uncond, 0x0, 0x98, 0xf8}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @dev={[], 0x1d}, 0x5, 0x0, [0x16, 0x6, 0x2, 0x39, 0x1d, 0x2, 0x2b, 0xa, 0x20, 0x35, 0x3f, 0x23, 0x25, 0x19, 0xf, 0x27], 0x0, 0x1000}}}, {{@ip={@empty, @local, 0xff, 0x2df0a14c2c296676, 'team0\x00', 'team_slave_0\x00', {}, {0x1fe}, 0x33, 0x3, 0x4b}, 0x0, 0x98, 0xf8}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x3, [0x1, 0x80000000, 0x9, 0x5, 0x7fff, 0x5], 0x81, 0x80}, {0x44, [0x4, 0xfffffffb, 0x1, 0xa6, 0xfff, 0xe3], 0x7f, 0x7}}}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x578) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, 0x0, 0x0) r5 = socket$pptp(0x18, 0x1, 0x2) close(r5) 21:13:48 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r1 = dup2(r0, 0xffffffffffffffff) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x503882) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:48 executing program 4: r0 = timerfd_create(0x7, 0x0) timerfd_settime(r0, 0x3, &(0x7f0000000040)={{0x77359400}, {0x0, 0x989680}}, 0x0) timerfd_settime(r0, 0x0, 0x0, 0x0) 21:13:48 executing program 5: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x0, &(0x7f0000000040)=0xfffffffc, 0x4) 21:13:48 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) fcntl$dupfd(r2, 0x0, r2) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) bind$inet(r3, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r3, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r3, 0x0, 0x10005, 0x0) 21:13:48 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:13:48 executing program 4: r0 = timerfd_create(0x7, 0x0) timerfd_settime(r0, 0x3, &(0x7f0000000040)={{0x77359400}, {0x0, 0x989680}}, 0x0) timerfd_settime(r0, 0x0, 0x0, 0x0) 21:13:48 executing program 5: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x12, 0x0, 0x0) 21:13:48 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r1 = dup2(r0, 0xffffffffffffffff) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x503882) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:48 executing program 4: r0 = timerfd_create(0x7, 0x0) timerfd_settime(r0, 0x3, &(0x7f0000000040)={{0x77359400}, {0x0, 0x989680}}, 0x0) timerfd_settime(r0, 0x0, 0x0, 0x0) 21:13:48 executing program 0: r0 = memfd_create(0x0, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r2 = dup2(r1, r0) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x503882) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r2, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:48 executing program 5: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x12, 0x0, 0x0) 21:13:49 executing program 1: r0 = memfd_create(&(0x7f00000000c0)='GPL#wlan0posix_acl_accessppp1bdev\x00', 0xd) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) dup2(r1, r0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r2, 0x0, 0x0, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) bind$inet(r3, &(0x7f0000000480)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x24e23, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) write$binfmt_elf64(r3, &(0x7f00000000c0)=ANY=[@ANYRES64], 0xc63b9e35) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000001740)=@mangle={'mangle\x00', 0x1f, 0x6, 0x518, 0x290, 0xc0, 0x388, 0x290, 0x0, 0x480, 0x480, 0x480, 0x480, 0x480, 0x6, &(0x7f0000000400), {[{{@ip={@remote, @multicast1, 0xffffffff, 0xff000000, 'syz_tun\x00', 'veth1_to_bridge\x00', {}, {}, 0x4, 0x2, 0x1}, 0x0, 0x98, 0xc0}, @ECN={0x28, 'ECN\x00', 0x0, {0x8, 0x5, 0x2}}}, {{@uncond, 0x0, 0xc0, 0xe8, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00'}]}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x24, 0x1}}}, {{@uncond, 0x0, 0xc0, 0xe8, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00'}]}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x5f, 0x40}}}, {{@uncond, 0x0, 0x98, 0xf8}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @dev={[], 0x1d}, 0x5, 0x0, [0x16, 0x6, 0x2, 0x39, 0x1d, 0x2, 0x2b, 0xa, 0x20, 0x35, 0x3f, 0x23, 0x25, 0x19, 0xf, 0x27], 0x0, 0x1000}}}, {{@ip={@empty, @local, 0xff, 0x2df0a14c2c296676, 'team0\x00', 'team_slave_0\x00', {}, {0x1fe}, 0x33, 0x3, 0x4b}, 0x0, 0x98, 0xf8}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x3, [0x1, 0x80000000, 0x9, 0x5, 0x7fff, 0x5], 0x81, 0x80}, {0x44, [0x4, 0xfffffffb, 0x1, 0xa6, 0xfff, 0xe3], 0x7f, 0x7}}}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x578) r4 = socket$pptp(0x18, 0x1, 0x2) close(r4) 21:13:49 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0x5421, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$kcm(0x29, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f081700d1", 0x2e}], 0x1}, 0x0) 21:13:49 executing program 5: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x12, 0x0, 0x0) 21:13:49 executing program 0: r0 = memfd_create(0x0, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r2 = dup2(r1, r0) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x503882) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r2, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:49 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) fcntl$dupfd(r1, 0x0, r1) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 279.135088][T14243] __nla_validate_parse: 18 callbacks suppressed [ 279.135107][T14243] netlink: 22 bytes leftover after parsing attributes in process `syz-executor.4'. 21:13:49 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:13:49 executing program 0: r0 = memfd_create(0x0, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r2 = dup2(r1, r0) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x503882) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r2, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:49 executing program 5: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x12, &(0x7f0000000040), 0x4) 21:13:49 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(0x0, 0x0, 0x41) r2 = dup2(r1, r0) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x503882) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r2, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:49 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0x5421, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$kcm(0x29, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f081700d1", 0x2e}], 0x1}, 0x0) 21:13:49 executing program 5: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x12, &(0x7f0000000040), 0x4) 21:13:49 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(0x0, 0x0, 0x41) r2 = dup2(r1, r0) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x503882) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r2, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) [ 279.440491][T14271] netlink: 22 bytes leftover after parsing attributes in process `syz-executor.4'. 21:13:50 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0x5421, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$kcm(0x29, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f081700d1", 0x2e}], 0x1}, 0x0) 21:13:50 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(0x0, 0x0, 0x41) r2 = dup2(r1, r0) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x503882) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r2, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:50 executing program 5: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x12, &(0x7f0000000040), 0x4) 21:13:50 executing program 1: r0 = memfd_create(&(0x7f00000000c0)='GPL#wlan0posix_acl_accessppp1bdev\x00', 0xd) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) dup2(r1, r0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r2, 0x0, 0x0, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) bind$inet(r3, &(0x7f0000000480)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x24e23, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) write$binfmt_elf64(r3, &(0x7f00000000c0)=ANY=[@ANYRES64], 0xc63b9e35) r4 = socket$pptp(0x18, 0x1, 0x2) close(r4) 21:13:50 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) fcntl$dupfd(r1, 0x0, r1) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 280.050379][T14285] netlink: 22 bytes leftover after parsing attributes in process `syz-executor.4'. 21:13:50 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, 0x0, 0x0) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:13:50 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x0) r2 = dup2(r1, r0) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x503882) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r2, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:50 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0x5421, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$kcm(0x29, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f081700d1", 0x2e}], 0x1}, 0x0) 21:13:50 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0x5421, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$kcm(0x29, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f081700d1", 0x2e}], 0x1}, 0x0) 21:13:50 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x0) r2 = dup2(r1, r0) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x503882) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r2, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) [ 280.221250][T14296] netlink: 22 bytes leftover after parsing attributes in process `syz-executor.5'. [ 280.246374][T14300] netlink: 22 bytes leftover after parsing attributes in process `syz-executor.4'. 21:13:50 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0x5421, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$kcm(0x29, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f081700d1", 0x2e}], 0x1}, 0x0) 21:13:50 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x0) r2 = dup2(r1, r0) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x503882) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r2, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:50 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0x5421, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f081700d1", 0x2e}], 0x1}, 0x0) 21:13:50 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r1 = dup2(0xffffffffffffffff, r0) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x503882) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) [ 280.439921][T14312] netlink: 22 bytes leftover after parsing attributes in process `syz-executor.5'. 21:13:50 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r1 = dup2(0xffffffffffffffff, r0) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x503882) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) [ 280.564265][T14318] netlink: 22 bytes leftover after parsing attributes in process `syz-executor.4'. 21:13:51 executing program 1: r0 = memfd_create(&(0x7f00000000c0)='GPL#wlan0posix_acl_accessppp1bdev\x00', 0xd) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) dup2(r1, r0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r2, 0x0, 0x0, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) bind$inet(r3, &(0x7f0000000480)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x24e23, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) write$binfmt_elf64(r3, &(0x7f00000000c0)=ANY=[@ANYRES64], 0xc63b9e35) r4 = socket$pptp(0x18, 0x1, 0x2) close(r4) 21:13:51 executing program 5: r0 = socket$unix(0x1, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = creat(&(0x7f0000000240)='./file0\x00', 0x0) fsetxattr(r2, &(0x7f0000000040)=@known='user.syz\x00', &(0x7f0000000100)='user.syz\x00', 0x462, 0x0) 21:13:51 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, 0x0, 0x0) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:13:51 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r1 = dup2(0xffffffffffffffff, r0) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x503882) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:51 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0x5421, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f081700d1", 0x2e}], 0x1}, 0x0) 21:13:51 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) fcntl$dupfd(r1, 0x0, r1) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 21:13:51 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) msgctl$MSG_INFO(0x0, 0xc, &(0x7f00000000c0)=""/239) 21:13:51 executing program 5: shmat(0x0, &(0x7f0000fed000/0x1000)=nil, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = shmget(0xffffffffffffffff, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil) shmat(r0, &(0x7f0000ffc000/0x4000)=nil, 0x1000004001) shmctl$IPC_RMID(r0, 0x0) r1 = shmat(r0, &(0x7f0000ffc000/0x3000)=nil, 0x4000) shmdt(r1) write$P9_RMKDIR(0xffffffffffffffff, &(0x7f0000000180)={0x14, 0x49, 0x1, {0x0, 0x0, 0x6}}, 0x14) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0) fchdir(r2) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x80, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, 0x0) umount2(&(0x7f0000000540)='./file0\x00', 0x4) [ 281.160025][T14342] netlink: 22 bytes leftover after parsing attributes in process `syz-executor.4'. 21:13:51 executing program 0: memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r1 = dup2(r0, 0xffffffffffffffff) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x503882) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:51 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f081700d1", 0x2e}], 0x1}, 0x0) 21:13:51 executing program 0: memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r1 = dup2(r0, 0xffffffffffffffff) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x503882) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) [ 281.374882][T14355] netlink: 22 bytes leftover after parsing attributes in process `syz-executor.4'. 21:13:51 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f081700d1", 0x2e}], 0x1}, 0x0) [ 281.552559][T14366] netlink: 22 bytes leftover after parsing attributes in process `syz-executor.4'. 21:13:51 executing program 1: r0 = memfd_create(&(0x7f00000000c0)='GPL#wlan0posix_acl_accessppp1bdev\x00', 0xd) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) dup2(r1, r0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r2, 0x0, 0x0, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) bind$inet(r3, &(0x7f0000000480)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x24e23, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r4 = socket$pptp(0x18, 0x1, 0x2) close(r4) 21:13:51 executing program 0: memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r1 = dup2(r0, 0xffffffffffffffff) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x503882) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:52 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, 0x0, 0x0) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:13:52 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f081700d1", 0x2e}], 0x1}, 0x0) 21:13:52 executing program 5: shmat(0x0, &(0x7f0000fed000/0x1000)=nil, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = shmget(0xffffffffffffffff, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil) shmat(r0, &(0x7f0000ffc000/0x4000)=nil, 0x1000004001) shmctl$IPC_RMID(r0, 0x0) r1 = shmat(r0, &(0x7f0000ffc000/0x3000)=nil, 0x4000) shmdt(r1) write$P9_RMKDIR(0xffffffffffffffff, &(0x7f0000000180)={0x14, 0x49, 0x1, {0x0, 0x0, 0x6}}, 0x14) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0) fchdir(r2) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x80, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, 0x0) umount2(&(0x7f0000000540)='./file0\x00', 0x4) 21:13:52 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r2 = dup2(r1, r0) syz_open_dev$sndtimer(0x0, 0x0, 0x503882) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r2, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:52 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) fcntl$dupfd(r2, 0x0, r2) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r3, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r3, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r3, 0x0, 0x10005, 0x0) 21:13:52 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r2 = dup2(r1, r0) syz_open_dev$sndtimer(0x0, 0x0, 0x503882) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r2, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:52 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f081700d1", 0x2e}], 0x1}, 0x0) 21:13:52 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r2 = dup2(r1, r0) syz_open_dev$sndtimer(0x0, 0x0, 0x503882) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r2, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:52 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f081700d1", 0x2e}], 0x1}, 0x0) 21:13:52 executing program 5: r0 = syz_open_dev$evdev(&(0x7f00000009c0)='/dev/input/event#\x00', 0x0, 0x0) ppoll(&(0x7f0000000100)=[{r0, 0x975f90ffbdc65eae}], 0x1, 0x0, &(0x7f00000001c0), 0x8) 21:13:52 executing program 1: r0 = memfd_create(&(0x7f00000000c0)='GPL#wlan0posix_acl_accessppp1bdev\x00', 0xd) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) dup2(r1, r0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r2, 0x0, 0x0, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) bind$inet(r3, &(0x7f0000000480)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x24e23, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) r4 = socket$pptp(0x18, 0x1, 0x2) close(r4) 21:13:52 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r2 = dup2(r1, r0) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r2, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:53 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:13:53 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f081700d1", 0x2e}], 0x1}, 0x0) 21:13:53 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) waitid$P_PIDFD(0x3, 0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000080)) 21:13:53 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r2 = dup2(r1, r0) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r2, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:53 executing program 1: r0 = memfd_create(&(0x7f00000000c0)='GPL#wlan0posix_acl_accessppp1bdev\x00', 0xd) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) dup2(r1, r0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r2, 0x0, 0x0, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) bind$inet(r3, &(0x7f0000000480)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x24e23, @local}, 0x10) r4 = socket$pptp(0x18, 0x1, 0x2) close(r4) 21:13:53 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) fcntl$dupfd(r2, 0x0, r2) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r3, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r3, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r3, 0x0, 0x10005, 0x0) 21:13:53 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r2 = dup2(r1, r0) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r2, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:53 executing program 5: mkdir(&(0x7f0000000200)='./file1\x00', 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) creat(&(0x7f0000000180)='./file1/file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000300)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) lchown(&(0x7f0000000280)='./file0/file1/file0\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r3) lsetxattr$security_ima(&(0x7f0000000040)='./file0/file1/file0\x00', 0x0, 0x0, 0x0, 0x0) 21:13:53 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f081700d1", 0x2e}], 0x1}, 0x0) 21:13:53 executing program 1: r0 = memfd_create(&(0x7f00000000c0)='GPL#wlan0posix_acl_accessppp1bdev\x00', 0xd) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) dup2(r1, r0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r2, 0x0, 0x0, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) bind$inet(r3, &(0x7f0000000480)={0x2, 0x4e23, @broadcast}, 0x10) r4 = socket$pptp(0x18, 0x1, 0x2) close(r4) 21:13:53 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r2 = dup2(r1, r0) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r2, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) [ 283.156675][T14440] overlayfs: conflicting lowerdir path 21:13:53 executing program 4: r0 = socket$kcm(0x10, 0x0, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f081700d1", 0x2e}], 0x1}, 0x0) 21:13:53 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:13:53 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000008c0)=[@text16={0x10, &(0x7f0000000080)="2e0f38f126098866dfa8a1c00f07baf80c66b851f8608666efbafc0cb00dee6467660f3810cf6766c7442400440000006766c74424022ad16bc46766c744240600000000670f011c24f30fc7752266b80000c0fe0f23d0b89b008ee866353000000f0f23f8b83b008ed866b9800000c00f326635010000000f30", 0x234}], 0x32, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 21:13:53 executing program 1: r0 = memfd_create(&(0x7f00000000c0)='GPL#wlan0posix_acl_accessppp1bdev\x00', 0xd) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) dup2(r1, r0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r2, 0x0, 0x0, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) r4 = socket$pptp(0x18, 0x1, 0x2) close(r4) 21:13:53 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r2 = dup2(r1, r0) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, 0x0) write$sndseq(r2, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:53 executing program 4: r0 = socket$kcm(0x10, 0x0, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f081700d1", 0x2e}], 0x1}, 0x0) 21:13:53 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) fcntl$dupfd(r2, 0x0, r2) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r3, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r3, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r3, 0x0, 0x10005, 0x0) 21:13:54 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r2 = dup2(r1, r0) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, 0x0) write$sndseq(r2, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:54 executing program 1: r0 = memfd_create(&(0x7f00000000c0)='GPL#wlan0posix_acl_accessppp1bdev\x00', 0xd) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) dup2(r1, r0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r2, 0x0, 0x0, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) r4 = socket$pptp(0x18, 0x1, 0x2) close(r4) 21:13:54 executing program 4: r0 = socket$kcm(0x10, 0x0, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f081700d1", 0x2e}], 0x1}, 0x0) 21:13:54 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r2 = dup2(r1, r0) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, 0x0) write$sndseq(r2, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:54 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:13:54 executing program 1: r0 = memfd_create(&(0x7f00000000c0)='GPL#wlan0posix_acl_accessppp1bdev\x00', 0xd) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) dup2(r1, r0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r2, 0x0, 0x0, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) r4 = socket$pptp(0x18, 0x1, 0x2) close(r4) [ 284.266046][T14494] input: syz1 as /devices/virtual/input/input6 21:13:54 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:13:54 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f081700d1", 0x2e}], 0x1}, 0x0) 21:13:54 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r2 = dup2(r1, r0) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(0xffffffffffffffff, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:54 executing program 1: r0 = memfd_create(&(0x7f00000000c0)='GPL#wlan0posix_acl_accessppp1bdev\x00', 0xd) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) dup2(r1, r0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r2, 0x0, 0x0, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet(0x2, 0x4000000000000001, 0x0) r3 = socket$pptp(0x18, 0x1, 0x2) close(r3) 21:13:54 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:13:54 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) fcntl$dupfd(r2, 0x0, r2) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) close(0xffffffffffffffff) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x10005, 0x0) [ 284.741080][T14505] __nla_validate_parse: 2 callbacks suppressed [ 284.741091][T14505] netlink: 22 bytes leftover after parsing attributes in process `syz-executor.4'. [ 284.781250][T14512] input: syz1 as /devices/virtual/input/input8 21:13:54 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r2 = dup2(r1, r0) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(0xffffffffffffffff, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:54 executing program 1: r0 = memfd_create(&(0x7f00000000c0)='GPL#wlan0posix_acl_accessppp1bdev\x00', 0xd) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) dup2(r1, r0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r2, 0x0, 0x0, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket$pptp(0x18, 0x1, 0x2) close(r3) 21:13:55 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f081700d1", 0x2e}], 0x1}, 0x0) 21:13:55 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r2 = dup2(r1, r0) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(0xffffffffffffffff, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) 21:13:55 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:13:55 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f081700d1", 0x2e}], 0x1}, 0x0) [ 284.985573][T14526] netlink: 22 bytes leftover after parsing attributes in process `syz-executor.4'. [ 285.133630][T14535] netlink: 22 bytes leftover after parsing attributes in process `syz-executor.4'. [ 285.164740][T14536] input: syz1 as /devices/virtual/input/input9 21:13:55 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:13:55 executing program 1: r0 = memfd_create(&(0x7f00000000c0)='GPL#wlan0posix_acl_accessppp1bdev\x00', 0xd) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) dup2(r1, r0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r2, 0x0, 0x0, 0x0) r3 = socket$pptp(0x18, 0x1, 0x2) close(r3) 21:13:55 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r2 = dup2(r1, r0) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r2, 0x0, 0x0) 21:13:55 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f081700d1", 0x2e}], 0x1}, 0x0) 21:13:55 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:13:55 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) fcntl$dupfd(r2, 0x0, r2) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) close(0xffffffffffffffff) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x10005, 0x0) 21:13:55 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r2 = dup2(r1, r0) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r2, 0x0, 0x0) [ 285.645709][T14550] netlink: 22 bytes leftover after parsing attributes in process `syz-executor.4'. [ 285.672830][T14553] input: syz1 as /devices/virtual/input/input10 21:13:55 executing program 1: r0 = memfd_create(&(0x7f00000000c0)='GPL#wlan0posix_acl_accessppp1bdev\x00', 0xd) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) dup2(r1, r0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') r2 = socket$pptp(0x18, 0x1, 0x2) close(r2) 21:13:55 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f081700d1", 0x2e}], 0x1}, 0x0) 21:13:55 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup2(r0, r1) 21:13:55 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r2 = dup2(r1, r0) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r2, 0x0, 0x0) 21:13:56 executing program 1: r0 = memfd_create(&(0x7f00000000c0)='GPL#wlan0posix_acl_accessppp1bdev\x00', 0xd) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) dup2(r1, r0) r2 = socket$pptp(0x18, 0x1, 0x2) close(r2) [ 285.890390][T14568] netlink: 22 bytes leftover after parsing attributes in process `syz-executor.4'. [ 285.995992][T14574] input: syz1 as /devices/virtual/input/input11 21:13:56 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:13:56 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f081700d1", 0x2e}], 0x1}, 0x0) 21:13:56 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r2 = dup2(r1, r0) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r2, &(0x7f0000000000), 0x0) 21:13:56 executing program 1: memfd_create(&(0x7f00000000c0)='GPL#wlan0posix_acl_accessppp1bdev\x00', 0xd) syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r0 = socket$pptp(0x18, 0x1, 0x2) close(r0) 21:13:56 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup2(r0, r1) 21:13:56 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) fcntl$dupfd(r2, 0x0, r2) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) close(0xffffffffffffffff) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x10005, 0x0) [ 286.549190][T14595] netlink: 22 bytes leftover after parsing attributes in process `syz-executor.4'. 21:13:56 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f081700d1", 0x2e}], 0x1}, 0x0) 21:13:56 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r2 = dup2(r1, r0) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r2, &(0x7f0000000000), 0x0) 21:13:56 executing program 1: memfd_create(&(0x7f00000000c0)='GPL#wlan0posix_acl_accessppp1bdev\x00', 0xd) r0 = socket$pptp(0x18, 0x1, 0x2) close(r0) [ 286.591310][T14590] input: syz1 as /devices/virtual/input/input12 21:13:56 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup2(r0, r1) [ 286.735145][T14610] netlink: 22 bytes leftover after parsing attributes in process `syz-executor.4'. 21:13:56 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r2 = dup2(r1, r0) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r2, &(0x7f0000000000), 0x0) 21:13:56 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f081700d1", 0x2e}], 0x1}, 0x0) [ 286.893640][T14616] input: syz1 as /devices/virtual/input/input13 [ 286.919243][T14622] netlink: 22 bytes leftover after parsing attributes in process `syz-executor.4'. 21:13:57 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:13:57 executing program 1: r0 = socket$pptp(0x18, 0x1, 0x2) close(r0) 21:13:57 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r2 = dup2(r1, r0) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r2, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control}], 0xff97) 21:13:57 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f081700d1", 0x2e}], 0x1}, 0x0) 21:13:57 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:13:57 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) fcntl$dupfd(r2, 0x0, r2) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r3, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r3, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r3, 0x0, 0x10005, 0x0) [ 287.455862][T14635] netlink: 22 bytes leftover after parsing attributes in process `syz-executor.4'. [ 287.467826][T14633] input: syz1 as /devices/virtual/input/input14 21:13:57 executing program 1: socket$pptp(0x18, 0x1, 0x2) close(0xffffffffffffffff) 21:13:57 executing program 4: socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f081700d1", 0x2e}], 0x1}, 0x0) 21:13:57 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:13:57 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:13:57 executing program 1: socket$pptp(0x18, 0x1, 0x2) close(0xffffffffffffffff) [ 287.731823][T14655] input: syz1 as /devices/virtual/input/input16 [ 287.756168][T14656] input: syz1 as /devices/virtual/input/input15 21:13:57 executing program 4: socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f081700d1", 0x2e}], 0x1}, 0x0) 21:13:58 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, 0x0, 0x0) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:13:58 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:13:58 executing program 1: socket$pptp(0x18, 0x1, 0x2) close(0xffffffffffffffff) 21:13:58 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:13:58 executing program 4: socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f081700d1", 0x2e}], 0x1}, 0x0) 21:13:58 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) fcntl$dupfd(r2, 0x0, r2) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r3, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r3, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r3, 0x0, 0x10005, 0x0) [ 288.363569][T14680] input: syz1 as /devices/virtual/input/input17 21:13:58 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) socket(0x10, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r1, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r0, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) add_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'sqz', 0x3}, &(0x7f0000000080)='@', 0x1, 0xfffffffffffffffb) add_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'sqz', 0x3}, &(0x7f0000000080)='@', 0x1, 0xfffffffffffffffb) getdents64(0xffffffffffffffff, &(0x7f0000000380)=""/4096, 0x1000) sendmmsg(0xffffffffffffffff, &(0x7f00000092c0), 0x800010b, 0x18) socket$alg(0x26, 0x5, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x84003ff) [ 288.431539][T14676] input: syz1 as /devices/virtual/input/input18 21:13:58 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, 0x0, 0x0) 21:13:58 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:13:58 executing program 1: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9d}}, 0x0) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:13:58 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9d}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) [ 288.694697][T14701] input: syz1 as /devices/virtual/input/input19 21:13:58 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, 0x0, 0x0) [ 288.832483][T14705] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 288.871567][T14705] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 288.890367][T14705] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 288.932975][T14707] EXT4-fs: Warning: mounting with data=journal disables delayed allocation and O_DIRECT support! [ 288.948985][T14707] EXT4-fs (loop1): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 288.960390][T14705] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue [ 289.000454][T14707] EXT4-fs (loop1): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 289.037317][T14707] EXT4-fs (loop1): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 289.086222][T14707] EXT4-fs (loop1): mounting with "discard" option, but the device does not support discard [ 289.104168][T14707] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue 21:13:59 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, 0x0, 0x0) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:13:59 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:13:59 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, 0x0, 0x0) 21:13:59 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9d}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:13:59 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) fcntl$dupfd(r2, 0x0, r2) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r3, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r3, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r3, 0x0, 0x10005, 0x0) 21:13:59 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000480)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f00000004c0)) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af60, 0x0) 21:13:59 executing program 1: [ 289.415209][T14738] input: syz1 as /devices/virtual/input/input20 [ 289.478716][T14730] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 289.512363][T14730] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock 21:13:59 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) [ 289.534263][T14730] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock 21:13:59 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:13:59 executing program 1: msgrcv(0x0, &(0x7f0000000040), 0xffffff05, 0x0, 0x683d770bcd9d4a8a) [ 289.588448][T14730] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue [ 289.670538][T14754] input: syz1 as /devices/virtual/input/input21 21:13:59 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) getpid() rt_tgsigqueueinfo(0x0, 0x0, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$int_in(r1, 0x5452, &(0x7f0000000140)=0x6) 21:13:59 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, 0xffffffffffffffff) [ 289.888258][T14767] input: syz1 as /devices/virtual/input/input22 21:14:00 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, 0x0, 0x0) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:14:00 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9d}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:00 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) 21:14:00 executing program 1: r0 = openat$random(0xffffffffffffff9c, &(0x7f0000000000)='/dev/urandom\x00', 0x82400, 0x0) fcntl$setstatus(r0, 0x4, 0x0) 21:14:00 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, 0xffffffffffffffff) 21:14:00 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 290.292142][T14784] input: syz1 as /devices/virtual/input/input23 21:14:00 executing program 1: r0 = socket$packet(0x11, 0x2, 0x300) getsockopt$sock_buf(r0, 0x1, 0x24, 0x0, &(0x7f00000000c0)) [ 290.377273][T14785] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 290.398052][T14785] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock 21:14:00 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, 0xffffffffffffffff) 21:14:00 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) [ 290.422956][T14785] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 290.470702][T14785] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue 21:14:00 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9d}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) [ 290.567528][T14804] input: syz1 as /devices/virtual/input/input24 21:14:00 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)}, 0x0) 21:14:00 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="0d00000000003639408fa3a3ba27660199783b0a82f79b32a7c8225086600a38e07d4db88a66596759e95307b680ab73e03c53555c97e8e37d01da4d44a994354a9fa3f355214eeabd24fd620b202257ff000000000000a6b608a5fece0eca95d71f2d3e60613a027fb50cbcc692d44076d3b97247e066165ccf1032f51d36ab231f6c20d87e91ee", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 290.863386][T14819] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 290.890267][T14819] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 290.900807][T14819] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 290.912424][T14819] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue 21:14:01 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r3, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r3, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(0xffffffffffffffff, 0x0, r3, 0x0, 0x10005, 0x0) 21:14:01 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:01 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)}, 0x0) 21:14:01 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9d}}, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:01 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 291.224498][T14834] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 291.248708][T14834] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock 21:14:01 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)}, 0x0) 21:14:01 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 291.297927][T14834] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 291.325139][T14834] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue 21:14:01 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:01 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9d}}, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:01 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{0x0}], 0x1}, 0x0) 21:14:01 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 291.682135][T14868] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 291.692234][T14868] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 291.702581][T14868] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 291.749945][T14868] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue 21:14:03 executing program 1: 21:14:03 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{0x0}], 0x1}, 0x0) 21:14:03 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9d}}, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:03 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:03 executing program 2: sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x10005, 0x0) 21:14:03 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r3, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r3, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(0xffffffffffffffff, 0x0, r3, 0x0, 0x10005, 0x0) 21:14:03 executing program 2: sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x10005, 0x0) 21:14:03 executing program 1: 21:14:04 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:04 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{0x0}], 0x1}, 0x0) [ 293.914797][T14888] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock 21:14:04 executing program 2: sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x10005, 0x0) [ 293.968303][T14888] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock 21:14:04 executing program 1: [ 294.037587][T14888] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 294.065250][T14888] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue 21:14:04 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)}], 0x1}, 0x0) 21:14:04 executing program 2: pipe(0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x10005, 0x0) 21:14:04 executing program 0: getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:04 executing program 1: 21:14:04 executing program 5: ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) dup2(0xffffffffffffffff, r0) [ 294.519128][T14936] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 294.558217][T14936] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock 21:14:04 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r3, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r3, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(0xffffffffffffffff, 0x0, r3, 0x0, 0x10005, 0x0) 21:14:04 executing program 2: pipe(0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x10005, 0x0) 21:14:04 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)}], 0x1}, 0x0) 21:14:04 executing program 1: 21:14:04 executing program 5: ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) dup2(0xffffffffffffffff, r0) [ 294.576423][T14936] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 294.599783][T14936] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated [ 294.653224][T14936] EXT4-fs (loop0): get root inode failed 21:14:04 executing program 1: [ 294.694194][T14936] EXT4-fs (loop0): mount failed 21:14:04 executing program 2: pipe(0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x10005, 0x0) 21:14:04 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)}], 0x1}, 0x0) 21:14:04 executing program 1: 21:14:04 executing program 0: getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:05 executing program 5: ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) dup2(0xffffffffffffffff, r0) 21:14:05 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc000400", 0x17}], 0x1}, 0x0) [ 295.145115][T14975] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 295.155414][T14975] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 295.183908][T14975] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 295.248137][T14975] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated [ 295.278031][T14975] EXT4-fs (loop0): get root inode failed [ 295.283877][T14975] EXT4-fs (loop0): mount failed 21:14:05 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x10005, 0x0) 21:14:05 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 21:14:05 executing program 1: 21:14:05 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:05 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc000400", 0x17}], 0x1}, 0x0) 21:14:05 executing program 0: getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:05 executing program 1: 21:14:05 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc000400", 0x17}], 0x1}, 0x0) 21:14:05 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 295.717132][T15003] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 295.754914][T15003] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock 21:14:05 executing program 1: [ 295.785623][T15003] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 295.843067][T15003] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated 21:14:06 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c13715", 0x23}], 0x1}, 0x0) 21:14:06 executing program 1: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, r2}, &(0x7f0000000380)=0x10) [ 295.921119][T15003] EXT4-fs (loop0): get root inode failed [ 295.964112][T15003] EXT4-fs (loop0): mount failed 21:14:06 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c13715", 0x23}], 0x1}, 0x0) 21:14:06 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:06 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, 0x0, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:06 executing program 1: perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='clear_refs\x00g\xff\xca\x02\x8a\xf0\xe1ZM\xfa@\xca\xe1z\xc0\xcb5a\xf1\xa5\xc3\xe7\x8aj\x17\x1bS0\x11\xbe\xdc\xdc\xdd\xc1\x17~\x18\xd6\xa5\x88Cd**\xde\xae\xaf\xcf\t\xec0\x04\xe7') r2 = syz_open_procfs(0x0, &(0x7f0000000100)='loginuid\x009\xda\xd3\xc4D\xdeJ5\xf0\xfd\"=\xb6\xaa\x1e/\xddc\xc9\xf3_8\x9eFi\xe0\xafe\"\xc2%\xbb\xb6E\xae\x9e\x0fF\xc8|\xd4M\xb4\x91\x9c\x1a4\xab\x1d\x00\xbbAW\xf7\x9b#\x91.\x9b\x96Vn\xbf#a\x8d\xfd\xd31\xfc\xac\xfe\xcc\xdb\x93\x89t\xf4\x8dB\fI\xe5\xb3\x7f\x94\xbd\xb6Q\xb9\xc1\x02e\x904\xf4\x19/') sendfile(r1, r2, 0x0, 0x1) 21:14:06 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x10005, 0x0) 21:14:06 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 21:14:06 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:06 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c13715", 0x23}], 0x1}, 0x0) [ 296.570623][T15047] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 296.603478][T15047] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock 21:14:06 executing program 1: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f0000000040)=[{0x20000000006, 0x0, 0x0, 0x50000}]}) faccessat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x100) [ 296.636464][T15047] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 296.708243][T15047] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated [ 296.749384][T15047] EXT4-fs (loop0): get root inode failed [ 296.756702][T15047] EXT4-fs (loop0): mount failed 21:14:06 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e3709000180", 0x29}], 0x1}, 0x0) 21:14:06 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:07 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, 0x0, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:07 executing program 1: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f0000000440)=[{0x6, 0x0, 0x0, 0x50000}]}) waitid(0x1, 0x0, &(0x7f0000000000), 0x0, 0x0) 21:14:07 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:07 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e3709000180", 0x29}], 0x1}, 0x0) [ 297.178959][T15085] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 297.240669][T15085] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 297.252138][T15085] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock 21:14:07 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 297.293503][T15085] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated [ 297.331799][T15085] EXT4-fs (loop0): get root inode failed 21:14:07 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x10005, 0x0) 21:14:07 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 21:14:07 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e3709000180", 0x29}], 0x1}, 0x0) 21:14:07 executing program 1: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x50000}]}) recvfrom$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000001c0)=@abs, 0x6e) [ 297.354193][T15085] EXT4-fs (loop0): mount failed 21:14:07 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, 0x0, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:07 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:07 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f0817", 0x2c}], 0x1}, 0x0) 21:14:07 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:07 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 297.800164][T15127] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 297.823653][T15127] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock 21:14:07 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f0817", 0x2c}], 0x1}, 0x0) [ 297.887795][T15127] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock 21:14:08 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 297.964629][T15127] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated [ 298.026099][T15127] EXT4-fs (loop0): get root inode failed [ 298.049836][T15127] EXT4-fs (loop0): mount failed 21:14:08 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 298.073300][T15156] input: syz1 as /devices/virtual/input/input38 21:14:08 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x0, 0x0) 21:14:08 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 21:14:08 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f0817", 0x2c}], 0x1}, 0x0) 21:14:08 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, 0x0}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:08 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:08 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:08 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f081700", 0x2d}], 0x1}, 0x0) [ 298.445673][T15174] input: syz1 as /devices/virtual/input/input41 21:14:08 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 298.560656][T15177] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 298.592218][T15177] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock 21:14:08 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 298.628948][T15177] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock 21:14:08 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f081700", 0x2d}], 0x1}, 0x0) [ 298.725892][T15177] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated [ 298.762263][T15177] EXT4-fs (loop0): get root inode failed 21:14:08 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(0x0, 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 298.783761][T15204] input: syz1 as /devices/virtual/input/input43 [ 298.794276][T15177] EXT4-fs (loop0): mount failed 21:14:09 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e00000036000502d25a80648c6394fb020424fc0004000b400c000eff09bb82c137153e37090001802f081700", 0x2d}], 0x1}, 0x0) [ 298.939218][T15213] input: syz1 as /devices/virtual/input/input44 21:14:09 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) 21:14:09 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 21:14:09 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, 0x0}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:09 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(0x0, 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:09 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x0, 0x0) 21:14:09 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 299.228011][T15223] input: syz1 as /devices/virtual/input/input45 21:14:09 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 299.363280][T15234] input: syz1 as /devices/virtual/input/input46 [ 299.381058][T15230] input: syz1 as /devices/virtual/input/input47 21:14:09 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(0x0, 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 299.512409][T15232] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 299.535014][T15247] input: syz1 as /devices/virtual/input/input48 [ 299.574261][T15232] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 299.601453][T15232] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 299.628579][T15232] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated [ 299.667330][T15232] EXT4-fs (loop0): get root inode failed [ 299.673724][T15232] EXT4-fs (loop0): mount failed 21:14:09 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 299.680037][T15253] input: syz1 as /devices/virtual/input/input49 21:14:09 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 21:14:09 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:09 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, 0x0}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) [ 299.837490][T15258] input: syz1 as /devices/virtual/input/input50 [ 299.911910][T15265] input: syz1 as /devices/virtual/input/input51 [ 299.943296][T15266] input: syz1 as /devices/virtual/input/input52 21:14:10 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 300.084677][T15269] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 300.111996][T15269] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 300.174069][T15269] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock 21:14:10 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 21:14:10 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:10 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x0, 0x0) 21:14:10 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 300.243614][T15269] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated [ 300.275484][T15269] EXT4-fs (loop0): get root inode failed [ 300.314201][T15269] EXT4-fs (loop0): mount failed [ 300.345900][T15287] input: syz1 as /devices/virtual/input/input54 [ 300.363233][T15281] input: syz1 as /devices/virtual/input/input53 [ 300.389819][T15288] input: syz1 as /devices/virtual/input/input55 21:14:10 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:10 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 21:14:10 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:10 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 300.694189][T15309] input: syz1 as /devices/virtual/input/input56 [ 300.734178][T15311] input: syz1 as /devices/virtual/input/input57 21:14:10 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 300.762332][T15314] input: syz1 as /devices/virtual/input/input58 [ 300.773300][T15304] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 300.836508][T15304] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock 21:14:11 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 300.899583][T15304] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 300.958879][T15304] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated [ 300.980373][T15304] EXT4-fs (loop0): get root inode failed [ 300.998862][T15304] EXT4-fs (loop0): mount failed 21:14:11 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)) dup2(r0, r1) [ 301.027369][T15331] input: syz1 as /devices/virtual/input/input60 21:14:11 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 301.217143][T15337] input: syz1 as /devices/virtual/input/input61 [ 301.285142][T15340] input: syz1 as /devices/virtual/input/input62 21:14:11 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 21:14:11 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 21:14:11 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:11 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:11 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)) dup2(r0, r1) [ 301.420565][T15352] input: syz1 as /devices/virtual/input/input64 21:14:11 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 21:14:11 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 21:14:11 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 301.626839][T15365] input: syz1 as /devices/virtual/input/input65 [ 301.707235][T15350] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 301.740280][T15350] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock 21:14:11 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)) dup2(r0, r1) [ 301.759648][T15350] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 301.792228][T15376] input: syz1 as /devices/virtual/input/input68 21:14:12 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 21:14:12 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 301.842517][T15350] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated [ 301.861770][T15350] EXT4-fs (loop0): get root inode failed [ 301.868348][T15350] EXT4-fs (loop0): mount failed [ 301.927767][T15383] input: syz1 as /devices/virtual/input/input69 21:14:12 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 302.134260][T15395] input: syz1 as /devices/virtual/input/input72 21:14:12 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 21:14:12 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:12 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:12 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 21:14:12 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 21:14:12 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 302.386703][T15410] input: syz1 as /devices/virtual/input/input73 [ 302.398947][T15412] input: syz1 as /devices/virtual/input/input74 21:14:12 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 21:14:12 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:12 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 21:14:12 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 302.555481][T15415] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 302.629994][T15415] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 302.684680][T15415] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock 21:14:12 executing program 1: ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) [ 302.743940][T15415] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated [ 302.766312][T15415] EXT4-fs (loop0): get root inode failed [ 302.772239][T15443] input: syz1 as /devices/virtual/input/input79 [ 302.780320][T15415] EXT4-fs (loop0): mount failed 21:14:13 executing program 3: r0 = memfd_create(&(0x7f00000000c0)='GPL#wlan0posix_acl_accessppp1bdev\x00', 0xd) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) dup2(r1, r0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r2, 0x0, 0x0, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) bind$inet(r3, &(0x7f0000000480)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x24e23, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) write$binfmt_elf64(r3, &(0x7f00000000c0)=ANY=[@ANYRES64], 0xc63b9e35) r4 = socket$pptp(0x18, 0x1, 0x2) close(r4) 21:14:13 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 21:14:13 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:13 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000"], 0x16}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:13 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, 0xffffffffffffffff) 21:14:13 executing program 1: ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) [ 303.309978][T15468] input: syz1 as /devices/virtual/input/input81 [ 303.340837][T15471] input: syz1 as /devices/virtual/input/input82 21:14:13 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, 0xffffffffffffffff) 21:14:13 executing program 1: ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) 21:14:13 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 303.547371][T15488] input: syz1 as /devices/virtual/input/input83 [ 303.564239][T15474] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 303.591304][T15474] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 303.634674][T15474] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock 21:14:13 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, 0xffffffffffffffff) 21:14:13 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 303.714629][T15474] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated [ 303.727194][T15499] input: syz1 as /devices/virtual/input/input84 [ 303.739397][T15474] EXT4-fs (loop0): get root inode failed [ 303.745742][T15474] EXT4-fs (loop0): mount failed 21:14:13 executing program 3: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x41) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r2, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x1000000}}], 0xff97) [ 303.811459][T15507] input: syz1 as /devices/virtual/input/input85 21:14:14 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000"], 0x16}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) [ 304.169949][T15524] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 304.183046][T15524] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 304.199298][T15524] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock 21:14:14 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{0x0}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 21:14:14 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:14 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:14 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 21:14:14 executing program 3 (fault-call:11 fault-nth:0): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) [ 304.210036][T15524] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated [ 304.222835][T15524] EXT4-fs (loop0): get root inode failed [ 304.228724][T15524] EXT4-fs (loop0): mount failed [ 304.292825][T15536] input: syz1 as /devices/virtual/input/input87 [ 304.338539][T15546] FAULT_INJECTION: forcing a failure. [ 304.338539][T15546] name failslab, interval 1, probability 0, space 0, times 0 [ 304.414566][T15546] CPU: 1 PID: 15546 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 304.422503][T15546] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 304.432598][T15546] Call Trace: [ 304.436421][T15546] dump_stack+0x172/0x1f0 [ 304.440777][T15546] should_fail.cold+0xa/0x15 [ 304.445373][T15546] ? lock_downgrade+0x920/0x920 [ 304.445409][T15546] ? fault_create_debugfs_attr+0x180/0x180 [ 304.456310][T15546] ? __kasan_check_read+0x11/0x20 [ 304.461355][T15546] __should_failslab+0x121/0x190 [ 304.466298][T15546] should_failslab+0x9/0x14 [ 304.466315][T15546] kmem_cache_alloc+0x47/0x710 [ 304.466334][T15546] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 304.466423][T15546] dst_alloc+0x10e/0x200 [ 304.466489][T15546] rt_dst_alloc+0x83/0x440 [ 304.490483][T15546] ip_route_output_key_hash_rcu+0x8d7/0x2d70 [ 304.496487][T15546] ? ip_route_input_noref+0x270/0x270 [ 304.501863][T15546] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 304.508096][T15546] ? __kasan_check_read+0x11/0x20 [ 304.508117][T15546] ip_route_output_key_hash+0x1ef/0x360 [ 304.508134][T15546] ? ip_route_output_key_hash_rcu+0x2d70/0x2d70 [ 304.524918][T15546] ? lock_downgrade+0x920/0x920 [ 304.529779][T15546] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 304.536028][T15546] ip_route_output_flow+0x28/0xc0 [ 304.541148][T15546] raw_sendmsg+0xa30/0x2f40 [ 304.545670][T15546] ? dst_output+0x170/0x170 [ 304.550188][T15546] ? lock_downgrade+0x920/0x920 [ 304.555072][T15546] ? __kasan_check_write+0x14/0x20 [ 304.560210][T15546] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 304.566470][T15546] ? aa_label_sk_perm+0x91/0xf0 [ 304.571329][T15546] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 304.576972][T15546] ? aa_sk_perm+0x288/0x880 [ 304.581568][T15546] ? __kasan_check_read+0x11/0x20 [ 304.586591][T15546] ? __lock_acquire+0x8a0/0x4a00 [ 304.591536][T15546] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 304.597096][T15546] inet_sendmsg+0x9e/0xe0 [ 304.601429][T15546] ? inet_sendmsg+0x9e/0xe0 [ 304.605940][T15546] ? inet_send_prepare+0x4f0/0x4f0 [ 304.611111][T15546] sock_sendmsg+0xd7/0x130 [ 304.615536][T15546] kernel_sendmsg+0x44/0x50 [ 304.620093][T15546] sock_no_sendpage+0x116/0x150 [ 304.624947][T15546] ? sock_kzfree_s+0x70/0x70 [ 304.629549][T15546] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 304.629571][T15546] inet_sendpage+0x10f/0x150 [ 304.629593][T15546] kernel_sendpage+0x92/0xf0 [ 304.629607][T15546] ? inet_sendmsg+0xe0/0xe0 [ 304.629625][T15546] sock_sendpage+0x8b/0xc0 [ 304.629644][T15546] pipe_to_sendpage+0x296/0x360 [ 304.640442][T15546] ? kernel_sendpage+0xf0/0xf0 [ 304.640466][T15546] ? direct_splice_actor+0x190/0x190 [ 304.640485][T15546] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 304.640502][T15546] ? splice_from_pipe_next.part.0+0x262/0x300 [ 304.640525][T15546] __splice_from_pipe+0x397/0x7d0 [ 304.640541][T15546] ? direct_splice_actor+0x190/0x190 [ 304.640564][T15546] ? direct_splice_actor+0x190/0x190 [ 304.696704][T15546] splice_from_pipe+0x108/0x170 [ 304.701555][T15546] ? splice_shrink_spd+0xd0/0xd0 [ 304.706479][T15546] ? apparmor_file_permission+0x25/0x30 [ 304.712009][T15546] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 304.718232][T15546] ? security_file_permission+0x8f/0x380 [ 304.723852][T15546] generic_splice_sendpage+0x3c/0x50 [ 304.729117][T15546] ? splice_from_pipe+0x170/0x170 [ 304.734124][T15546] do_splice+0x708/0x1410 [ 304.738442][T15546] ? opipe_prep.part.0+0x2e0/0x2e0 [ 304.743541][T15546] ? __fget_light+0x1a9/0x230 [ 304.748204][T15546] __x64_sys_splice+0x2c6/0x330 [ 304.753045][T15546] do_syscall_64+0xfa/0x760 [ 304.757561][T15546] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 304.763431][T15546] RIP: 0033:0x459a59 [ 304.767312][T15546] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 304.787431][T15546] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 304.795827][T15546] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 304.803779][T15546] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 21:14:14 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000"], 0x16}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:14 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 21:14:14 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:14 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 304.811739][T15546] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 304.819698][T15546] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 304.827651][T15546] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 [ 304.942610][T15553] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock 21:14:15 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 304.983011][T15553] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 305.001582][T15566] input: syz1 as /devices/virtual/input/input88 [ 305.029938][T15553] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock 21:14:15 executing program 3 (fault-call:11 fault-nth:1): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:14:15 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 305.089044][T15553] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated [ 305.102215][T15553] EXT4-fs (loop0): get root inode failed [ 305.128732][T15553] EXT4-fs (loop0): mount failed 21:14:15 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{0x0}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 21:14:15 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:15 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 21:14:15 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB], 0x16}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:15 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 305.317011][T15589] input: syz1 as /devices/virtual/input/input92 [ 305.381274][T15598] FAULT_INJECTION: forcing a failure. [ 305.381274][T15598] name failslab, interval 1, probability 0, space 0, times 0 [ 305.424086][T15598] CPU: 0 PID: 15598 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 305.432019][T15598] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 305.442068][T15598] Call Trace: [ 305.442111][T15598] dump_stack+0x172/0x1f0 [ 305.442132][T15598] should_fail.cold+0xa/0x15 [ 305.442149][T15598] ? fault_create_debugfs_attr+0x180/0x180 [ 305.442171][T15598] ? ___might_sleep+0x163/0x2c0 [ 305.442190][T15598] __should_failslab+0x121/0x190 [ 305.442206][T15598] should_failslab+0x9/0x14 [ 305.442222][T15598] kmem_cache_alloc_node+0x268/0x740 [ 305.442235][T15598] ? rt_add_uncached_list+0x147/0x1a0 [ 305.442253][T15598] ? __local_bh_enable_ip+0x15a/0x270 [ 305.442275][T15598] __alloc_skb+0xd5/0x5e0 [ 305.494833][T15598] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 305.500385][T15598] ? dst_init+0x38e/0x4d0 [ 305.500410][T15598] __ip_append_data.isra.0+0x2667/0x30d0 [ 305.500431][T15598] ? raw_destroy+0x30/0x30 [ 305.500448][T15598] ? __lock_acquire+0x16f2/0x4a00 [ 305.519894][T15598] ? __ip_flush_pending_frames.isra.0+0x2d0/0x2d0 [ 305.519915][T15598] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 305.519931][T15598] ? ip_setup_cork+0x59c/0x8e0 [ 305.532561][T15598] ? raw_destroy+0x30/0x30 [ 305.532580][T15598] ip_append_data.part.0+0xf2/0x170 [ 305.532598][T15598] ? raw_destroy+0x30/0x30 [ 305.532616][T15598] ip_append_data+0x6e/0x90 [ 305.555865][T15598] raw_sendmsg+0xba8/0x2f40 [ 305.560396][T15598] ? dst_output+0x170/0x170 [ 305.564917][T15598] ? lock_downgrade+0x920/0x920 [ 305.569784][T15598] ? __kasan_check_write+0x14/0x20 [ 305.574913][T15598] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 305.574932][T15598] ? aa_label_sk_perm+0x91/0xf0 [ 305.574951][T15598] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 305.574964][T15598] ? aa_sk_perm+0x288/0x880 [ 305.574976][T15598] ? __kasan_check_read+0x11/0x20 [ 305.574989][T15598] ? __lock_acquire+0x8a0/0x4a00 [ 305.575006][T15598] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 305.575027][T15598] inet_sendmsg+0x9e/0xe0 [ 305.575040][T15598] ? inet_sendmsg+0x9e/0xe0 [ 305.575053][T15598] ? inet_send_prepare+0x4f0/0x4f0 [ 305.575069][T15598] sock_sendmsg+0xd7/0x130 [ 305.575087][T15598] kernel_sendmsg+0x44/0x50 [ 305.575105][T15598] sock_no_sendpage+0x116/0x150 [ 305.575120][T15598] ? sock_kzfree_s+0x70/0x70 [ 305.575153][T15598] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 305.575170][T15598] inet_sendpage+0x10f/0x150 [ 305.575190][T15598] kernel_sendpage+0x92/0xf0 [ 305.575200][T15598] ? inet_sendmsg+0xe0/0xe0 [ 305.575220][T15598] sock_sendpage+0x8b/0xc0 [ 305.596405][T15598] pipe_to_sendpage+0x296/0x360 [ 305.596424][T15598] ? kernel_sendpage+0xf0/0xf0 [ 305.596441][T15598] ? direct_splice_actor+0x190/0x190 [ 305.596462][T15598] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 305.616332][T15598] ? splice_from_pipe_next.part.0+0x262/0x300 [ 305.616358][T15598] __splice_from_pipe+0x397/0x7d0 [ 305.616375][T15598] ? direct_splice_actor+0x190/0x190 [ 305.616399][T15598] ? direct_splice_actor+0x190/0x190 [ 305.616415][T15598] splice_from_pipe+0x108/0x170 [ 305.616434][T15598] ? splice_shrink_spd+0xd0/0xd0 21:14:15 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 305.616453][T15598] ? apparmor_file_permission+0x25/0x30 [ 305.616468][T15598] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 305.616488][T15598] ? security_file_permission+0x8f/0x380 [ 305.635142][T15598] generic_splice_sendpage+0x3c/0x50 [ 305.635158][T15598] ? splice_from_pipe+0x170/0x170 [ 305.635173][T15598] do_splice+0x708/0x1410 [ 305.635199][T15598] ? opipe_prep.part.0+0x2e0/0x2e0 [ 305.635218][T15598] ? __fget_light+0x1a9/0x230 [ 305.635235][T15598] __x64_sys_splice+0x2c6/0x330 [ 305.635261][T15598] do_syscall_64+0xfa/0x760 [ 305.664631][T15598] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 305.664645][T15598] RIP: 0033:0x459a59 [ 305.664661][T15598] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 305.664669][T15598] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 305.664685][T15598] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 305.664693][T15598] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 305.664702][T15598] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 305.664710][T15598] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 305.664718][T15598] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 21:14:16 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:16 executing program 4: ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) dup2(0xffffffffffffffff, r0) [ 305.869359][T15606] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 305.887928][T15606] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 305.973386][T15606] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 306.050095][T15625] input: syz1 as /devices/virtual/input/input96 [ 306.070701][T15606] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated 21:14:16 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 21:14:16 executing program 3 (fault-call:11 fault-nth:2): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) [ 306.115038][T15606] EXT4-fs (loop0): get root inode failed 21:14:16 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) dup2(r0, r1) [ 306.162909][T15606] EXT4-fs (loop0): mount failed 21:14:16 executing program 4: ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) dup2(0xffffffffffffffff, r0) 21:14:16 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{0x0}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 306.277922][T15637] FAULT_INJECTION: forcing a failure. [ 306.277922][T15637] name failslab, interval 1, probability 0, space 0, times 0 21:14:16 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB], 0x16}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) [ 306.361747][T15646] input: syz1 as /devices/virtual/input/input98 [ 306.394140][T15637] CPU: 0 PID: 15637 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 306.402076][T15637] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 306.412137][T15637] Call Trace: [ 306.415442][T15637] dump_stack+0x172/0x1f0 [ 306.419963][T15637] should_fail.cold+0xa/0x15 [ 306.424573][T15637] ? fault_create_debugfs_attr+0x180/0x180 [ 306.430395][T15637] ? ___might_sleep+0x163/0x2c0 [ 306.435251][T15637] __should_failslab+0x121/0x190 [ 306.435270][T15637] should_failslab+0x9/0x14 [ 306.435286][T15637] kmem_cache_alloc_node_trace+0x274/0x750 [ 306.435302][T15637] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 306.435318][T15637] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 306.462281][T15637] __kmalloc_node_track_caller+0x3d/0x70 [ 306.462305][T15637] __kmalloc_reserve.isra.0+0x40/0xf0 [ 306.462322][T15637] __alloc_skb+0x10b/0x5e0 [ 306.462340][T15637] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 306.483250][T15637] ? dst_init+0x38e/0x4d0 [ 306.487599][T15637] __ip_append_data.isra.0+0x2667/0x30d0 [ 306.493259][T15637] ? raw_destroy+0x30/0x30 [ 306.497680][T15637] ? __lock_acquire+0x16f2/0x4a00 [ 306.497710][T15637] ? __ip_flush_pending_frames.isra.0+0x2d0/0x2d0 [ 306.497729][T15637] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 306.497747][T15637] ? ip_setup_cork+0x59c/0x8e0 [ 306.520176][T15637] ? raw_destroy+0x30/0x30 [ 306.524601][T15637] ip_append_data.part.0+0xf2/0x170 [ 306.529810][T15637] ? raw_destroy+0x30/0x30 [ 306.534223][T15637] ip_append_data+0x6e/0x90 [ 306.534247][T15637] raw_sendmsg+0xba8/0x2f40 [ 306.534275][T15637] ? dst_output+0x170/0x170 [ 306.534296][T15637] ? lock_downgrade+0x920/0x920 [ 306.534315][T15637] ? __kasan_check_write+0x14/0x20 [ 306.534346][T15637] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 306.534361][T15637] ? aa_label_sk_perm+0x91/0xf0 [ 306.534383][T15637] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 306.547867][T15637] ? aa_sk_perm+0x288/0x880 [ 306.547883][T15637] ? __kasan_check_read+0x11/0x20 [ 306.547899][T15637] ? __lock_acquire+0x8a0/0x4a00 [ 306.547917][T15637] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 306.547938][T15637] inet_sendmsg+0x9e/0xe0 [ 306.584057][T15637] ? inet_sendmsg+0x9e/0xe0 [ 306.584079][T15637] ? inet_send_prepare+0x4f0/0x4f0 [ 306.584096][T15637] sock_sendmsg+0xd7/0x130 [ 306.584113][T15637] kernel_sendmsg+0x44/0x50 [ 306.584128][T15637] sock_no_sendpage+0x116/0x150 [ 306.584141][T15637] ? sock_kzfree_s+0x70/0x70 [ 306.584173][T15637] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 306.584190][T15637] inet_sendpage+0x10f/0x150 [ 306.584207][T15637] kernel_sendpage+0x92/0xf0 [ 306.584223][T15637] ? inet_sendmsg+0xe0/0xe0 [ 306.584239][T15637] sock_sendpage+0x8b/0xc0 [ 306.603586][T15637] pipe_to_sendpage+0x296/0x360 [ 306.603610][T15637] ? kernel_sendpage+0xf0/0xf0 [ 306.603628][T15637] ? direct_splice_actor+0x190/0x190 [ 306.666129][T15637] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 306.672383][T15637] ? splice_from_pipe_next.part.0+0x262/0x300 [ 306.678470][T15637] __splice_from_pipe+0x397/0x7d0 [ 306.683505][T15637] ? direct_splice_actor+0x190/0x190 [ 306.688805][T15637] ? direct_splice_actor+0x190/0x190 [ 306.694098][T15637] splice_from_pipe+0x108/0x170 [ 306.698961][T15637] ? splice_shrink_spd+0xd0/0xd0 [ 306.703909][T15637] ? apparmor_file_permission+0x25/0x30 [ 306.709454][T15637] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 306.709472][T15637] ? security_file_permission+0x8f/0x380 [ 306.709496][T15637] generic_splice_sendpage+0x3c/0x50 [ 306.709513][T15637] ? splice_from_pipe+0x170/0x170 [ 306.709530][T15637] do_splice+0x708/0x1410 [ 306.709554][T15637] ? opipe_prep.part.0+0x2e0/0x2e0 [ 306.721389][T15637] ? __fget_light+0x1a9/0x230 [ 306.721412][T15637] __x64_sys_splice+0x2c6/0x330 [ 306.721437][T15637] do_syscall_64+0xfa/0x760 [ 306.721458][T15637] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 306.761088][T15637] RIP: 0033:0x459a59 [ 306.764989][T15637] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 306.784597][T15637] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 306.793008][T15637] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 306.800961][T15637] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 21:14:16 executing program 4: ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) dup2(0xffffffffffffffff, r0) [ 306.809360][T15637] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 306.817315][T15637] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 306.825267][T15637] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 21:14:17 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 306.864792][T15657] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 306.900135][T15657] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock 21:14:17 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) dup2(r0, r1) [ 306.922731][T15657] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 306.945374][T15657] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated 21:14:17 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:17 executing program 3 (fault-call:11 fault-nth:3): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) [ 307.004262][T15657] EXT4-fs (loop0): get root inode failed [ 307.033306][T15657] EXT4-fs (loop0): mount failed 21:14:17 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB], 0x16}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:17 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 307.140164][T15679] input: syz1 as /devices/virtual/input/input100 [ 307.256298][T15691] FAULT_INJECTION: forcing a failure. [ 307.256298][T15691] name failslab, interval 1, probability 0, space 0, times 0 [ 307.316521][T15691] CPU: 1 PID: 15691 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 307.324461][T15691] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 307.334522][T15691] Call Trace: [ 307.337824][T15691] dump_stack+0x172/0x1f0 [ 307.342166][T15691] should_fail.cold+0xa/0x15 [ 307.342184][T15691] ? fault_create_debugfs_attr+0x180/0x180 [ 307.352576][T15691] ? ___might_sleep+0x163/0x2c0 [ 307.357438][T15691] __should_failslab+0x121/0x190 [ 307.362388][T15691] should_failslab+0x9/0x14 21:14:17 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:17 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) dup2(r0, r1) [ 307.366918][T15691] kmem_cache_alloc_node+0x268/0x740 [ 307.372224][T15691] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 307.378468][T15691] ? ip_generic_getfrag+0x120/0x230 [ 307.383673][T15691] __alloc_skb+0xd5/0x5e0 [ 307.388005][T15691] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 307.393552][T15691] ? raw_getfrag+0x164/0x230 [ 307.398146][T15691] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 307.403868][T15691] __ip_append_data.isra.0+0x2667/0x30d0 [ 307.403890][T15691] ? raw_destroy+0x30/0x30 [ 307.413903][T15691] ? __lock_acquire+0x16f2/0x4a00 [ 307.418944][T15691] ? __ip_flush_pending_frames.isra.0+0x2d0/0x2d0 [ 307.425372][T15691] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 307.425390][T15691] ? ip_setup_cork+0x59c/0x8e0 [ 307.425407][T15691] ? raw_destroy+0x30/0x30 [ 307.425422][T15691] ip_append_data.part.0+0xf2/0x170 [ 307.425442][T15691] ? raw_destroy+0x30/0x30 [ 307.425459][T15691] ip_append_data+0x6e/0x90 [ 307.425480][T15691] raw_sendmsg+0xba8/0x2f40 [ 307.436461][T15691] ? dst_output+0x170/0x170 [ 307.436486][T15691] ? lock_downgrade+0x920/0x920 [ 307.436507][T15691] ? __kasan_check_write+0x14/0x20 [ 307.436539][T15691] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 307.436563][T15691] ? aa_label_sk_perm+0x91/0xf0 [ 307.448568][T15691] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 307.448586][T15691] ? aa_sk_perm+0x288/0x880 [ 307.448599][T15691] ? __kasan_check_read+0x11/0x20 [ 307.448615][T15691] ? __lock_acquire+0x8a0/0x4a00 [ 307.448635][T15691] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 307.448658][T15691] inet_sendmsg+0x9e/0xe0 [ 307.448675][T15691] ? inet_sendmsg+0x9e/0xe0 [ 307.457545][T15691] ? inet_send_prepare+0x4f0/0x4f0 [ 307.457568][T15691] sock_sendmsg+0xd7/0x130 [ 307.457587][T15691] kernel_sendmsg+0x44/0x50 [ 307.457606][T15691] sock_no_sendpage+0x116/0x150 [ 307.457622][T15691] ? sock_kzfree_s+0x70/0x70 [ 307.457654][T15691] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 307.457671][T15691] inet_sendpage+0x10f/0x150 [ 307.462322][T15700] input: syz1 as /devices/virtual/input/input102 [ 307.466634][T15691] kernel_sendpage+0x92/0xf0 [ 307.466647][T15691] ? inet_sendmsg+0xe0/0xe0 [ 307.466667][T15691] sock_sendpage+0x8b/0xc0 [ 307.466688][T15691] pipe_to_sendpage+0x296/0x360 [ 307.466704][T15691] ? kernel_sendpage+0xf0/0xf0 [ 307.466721][T15691] ? direct_splice_actor+0x190/0x190 [ 307.466736][T15691] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 307.466755][T15691] ? splice_from_pipe_next.part.0+0x262/0x300 [ 307.476778][T15691] __splice_from_pipe+0x397/0x7d0 [ 307.476797][T15691] ? direct_splice_actor+0x190/0x190 [ 307.476821][T15691] ? direct_splice_actor+0x190/0x190 [ 307.476837][T15691] splice_from_pipe+0x108/0x170 [ 307.476858][T15691] ? splice_shrink_spd+0xd0/0xd0 [ 307.476877][T15691] ? apparmor_file_permission+0x25/0x30 [ 307.476897][T15691] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 307.488039][T15691] ? security_file_permission+0x8f/0x380 [ 307.498130][T15691] generic_splice_sendpage+0x3c/0x50 [ 307.498143][T15691] ? splice_from_pipe+0x170/0x170 [ 307.498159][T15691] do_splice+0x708/0x1410 [ 307.498184][T15691] ? opipe_prep.part.0+0x2e0/0x2e0 [ 307.527522][T15691] ? __fget_light+0x1a9/0x230 [ 307.527545][T15691] __x64_sys_splice+0x2c6/0x330 [ 307.527577][T15691] do_syscall_64+0xfa/0x760 [ 307.527599][T15691] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 307.527611][T15691] RIP: 0033:0x459a59 [ 307.527630][T15691] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 21:14:17 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 21:14:17 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 307.536515][T15691] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 307.646399][T15691] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 307.646408][T15691] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 307.646418][T15691] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 307.646427][T15691] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 307.646436][T15691] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 [ 307.803773][T15695] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock 21:14:17 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 307.855852][T15695] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 307.867263][T15695] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock 21:14:18 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(0xffffffffffffffff, r1) [ 307.940777][T15695] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated 21:14:18 executing program 3 (fault-call:11 fault-nth:4): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) [ 308.004876][T15695] EXT4-fs (loop0): get root inode failed [ 308.013055][T15695] EXT4-fs (loop0): mount failed 21:14:18 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 308.076699][T15731] input: syz1 as /devices/virtual/input/input104 21:14:18 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:18 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285b"], 0x5a}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) [ 308.226102][T15742] FAULT_INJECTION: forcing a failure. [ 308.226102][T15742] name failslab, interval 1, probability 0, space 0, times 0 21:14:18 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(0xffffffffffffffff, r1) 21:14:18 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 308.272276][T15742] CPU: 1 PID: 15742 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 308.280213][T15742] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 308.290277][T15742] Call Trace: [ 308.293578][T15742] dump_stack+0x172/0x1f0 [ 308.297929][T15742] should_fail.cold+0xa/0x15 [ 308.302549][T15742] ? fault_create_debugfs_attr+0x180/0x180 [ 308.308352][T15742] ? ___might_sleep+0x163/0x2c0 [ 308.308375][T15742] __should_failslab+0x121/0x190 [ 308.308393][T15742] should_failslab+0x9/0x14 [ 308.308412][T15742] kmem_cache_alloc_node_trace+0x274/0x750 [ 308.329459][T15742] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 308.335452][T15742] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 308.341276][T15742] __kmalloc_node_track_caller+0x3d/0x70 [ 308.347009][T15742] __kmalloc_reserve.isra.0+0x40/0xf0 [ 308.352917][T15742] __alloc_skb+0x10b/0x5e0 [ 308.357345][T15742] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 308.362910][T15742] ? raw_getfrag+0x164/0x230 [ 308.367503][T15742] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 308.373236][T15742] __ip_append_data.isra.0+0x2667/0x30d0 [ 308.378879][T15742] ? raw_destroy+0x30/0x30 [ 308.383305][T15742] ? __lock_acquire+0x16f2/0x4a00 [ 308.388345][T15742] ? __ip_flush_pending_frames.isra.0+0x2d0/0x2d0 [ 308.394777][T15742] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 308.394795][T15742] ? ip_setup_cork+0x59c/0x8e0 [ 308.394812][T15742] ? raw_destroy+0x30/0x30 [ 308.394826][T15742] ip_append_data.part.0+0xf2/0x170 [ 308.394844][T15742] ? raw_destroy+0x30/0x30 [ 308.394863][T15742] ip_append_data+0x6e/0x90 [ 308.419921][T15742] raw_sendmsg+0xba8/0x2f40 [ 308.419952][T15742] ? dst_output+0x170/0x170 [ 308.419977][T15742] ? lock_downgrade+0x920/0x920 [ 308.433448][T15742] ? __kasan_check_write+0x14/0x20 [ 308.433485][T15742] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 308.433502][T15742] ? aa_label_sk_perm+0x91/0xf0 [ 308.433522][T15742] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 308.433538][T15742] ? aa_sk_perm+0x288/0x880 [ 308.460143][T15742] ? __kasan_check_read+0x11/0x20 [ 308.460161][T15742] ? __lock_acquire+0x8a0/0x4a00 [ 308.460183][T15742] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 308.460217][T15742] inet_sendmsg+0x9e/0xe0 [ 308.469708][T15742] ? inet_sendmsg+0x9e/0xe0 [ 308.469723][T15742] ? inet_send_prepare+0x4f0/0x4f0 [ 308.469745][T15742] sock_sendmsg+0xd7/0x130 [ 308.484512][T15742] kernel_sendmsg+0x44/0x50 [ 308.484533][T15742] sock_no_sendpage+0x116/0x150 [ 308.484547][T15742] ? sock_kzfree_s+0x70/0x70 [ 308.484579][T15742] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 308.484600][T15742] inet_sendpage+0x10f/0x150 [ 308.499384][T15755] input: syz1 as /devices/virtual/input/input106 [ 308.503081][T15742] kernel_sendpage+0x92/0xf0 [ 308.503097][T15742] ? inet_sendmsg+0xe0/0xe0 [ 308.503114][T15742] sock_sendpage+0x8b/0xc0 [ 308.503134][T15742] pipe_to_sendpage+0x296/0x360 [ 308.512539][T15742] ? kernel_sendpage+0xf0/0xf0 [ 308.512560][T15742] ? direct_splice_actor+0x190/0x190 [ 308.512580][T15742] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 308.512594][T15742] ? splice_from_pipe_next.part.0+0x262/0x300 [ 308.512615][T15742] __splice_from_pipe+0x397/0x7d0 [ 308.529714][T15742] ? direct_splice_actor+0x190/0x190 [ 308.529740][T15742] ? direct_splice_actor+0x190/0x190 [ 308.529755][T15742] splice_from_pipe+0x108/0x170 [ 308.529774][T15742] ? splice_shrink_spd+0xd0/0xd0 [ 308.538835][T15742] ? apparmor_file_permission+0x25/0x30 [ 308.548062][T15742] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 308.548080][T15742] ? security_file_permission+0x8f/0x380 [ 308.548110][T15742] generic_splice_sendpage+0x3c/0x50 [ 308.548126][T15742] ? splice_from_pipe+0x170/0x170 [ 308.548143][T15742] do_splice+0x708/0x1410 [ 308.548167][T15742] ? opipe_prep.part.0+0x2e0/0x2e0 [ 308.632980][T15742] ? __fget_light+0x1a9/0x230 [ 308.637651][T15742] __x64_sys_splice+0x2c6/0x330 [ 308.642492][T15742] do_syscall_64+0xfa/0x760 [ 308.646993][T15742] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 308.652867][T15742] RIP: 0033:0x459a59 [ 308.656744][T15742] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 308.676852][T15742] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 308.685254][T15742] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 308.693228][T15742] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 308.701178][T15742] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 308.709130][T15742] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 308.717085][T15742] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 21:14:18 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 308.782427][T15754] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 308.792996][T15754] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 308.803110][T15754] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 308.847585][T15754] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated [ 308.869154][T15754] EXT4-fs (loop0): get root inode failed 21:14:19 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(0x0, 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 21:14:19 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(0xffffffffffffffff, r1) 21:14:19 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 308.927390][T15754] EXT4-fs (loop0): mount failed 21:14:19 executing program 3 (fault-call:11 fault-nth:5): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) [ 309.090913][T15786] input: syz1 as /devices/virtual/input/input108 [ 309.111542][T15779] input: syz1 as /devices/virtual/input/input109 21:14:19 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285b"], 0x5a}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) [ 309.139042][T15793] FAULT_INJECTION: forcing a failure. [ 309.139042][T15793] name failslab, interval 1, probability 0, space 0, times 0 [ 309.193564][T15793] CPU: 0 PID: 15793 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 309.201494][T15793] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 309.211553][T15793] Call Trace: [ 309.214856][T15793] dump_stack+0x172/0x1f0 [ 309.219342][T15793] should_fail.cold+0xa/0x15 [ 309.223946][T15793] ? fault_create_debugfs_attr+0x180/0x180 [ 309.229763][T15793] ? ___might_sleep+0x163/0x2c0 [ 309.234628][T15793] __should_failslab+0x121/0x190 [ 309.239578][T15793] should_failslab+0x9/0x14 [ 309.244099][T15793] kmem_cache_alloc_node+0x268/0x740 [ 309.249395][T15793] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 309.255643][T15793] ? ip_generic_getfrag+0x120/0x230 [ 309.260853][T15793] __alloc_skb+0xd5/0x5e0 [ 309.265198][T15793] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 309.270750][T15793] ? raw_getfrag+0x164/0x230 [ 309.275358][T15793] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 309.281087][T15793] __ip_append_data.isra.0+0x2667/0x30d0 [ 309.286730][T15793] ? raw_destroy+0x30/0x30 [ 309.291157][T15793] ? __lock_acquire+0x16f2/0x4a00 [ 309.296198][T15793] ? __ip_flush_pending_frames.isra.0+0x2d0/0x2d0 [ 309.302610][T15793] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 309.308849][T15793] ? ip_setup_cork+0x59c/0x8e0 [ 309.313620][T15793] ? raw_destroy+0x30/0x30 [ 309.318044][T15793] ip_append_data.part.0+0xf2/0x170 [ 309.323247][T15793] ? raw_destroy+0x30/0x30 [ 309.327664][T15793] ip_append_data+0x6e/0x90 [ 309.332178][T15793] raw_sendmsg+0xba8/0x2f40 [ 309.336706][T15793] ? dst_output+0x170/0x170 [ 309.341227][T15793] ? lock_downgrade+0x920/0x920 [ 309.346088][T15793] ? __kasan_check_write+0x14/0x20 [ 309.351222][T15793] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 309.357468][T15793] ? aa_label_sk_perm+0x91/0xf0 [ 309.362328][T15793] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 309.362346][T15793] ? aa_sk_perm+0x288/0x880 [ 309.362359][T15793] ? __kasan_check_read+0x11/0x20 [ 309.362376][T15793] ? __lock_acquire+0x8a0/0x4a00 [ 309.372482][T15793] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 309.372507][T15793] inet_sendmsg+0x9e/0xe0 [ 309.372525][T15793] ? inet_sendmsg+0x9e/0xe0 [ 309.396799][T15793] ? inet_send_prepare+0x4f0/0x4f0 [ 309.401918][T15793] sock_sendmsg+0xd7/0x130 [ 309.406348][T15793] kernel_sendmsg+0x44/0x50 [ 309.410862][T15793] sock_no_sendpage+0x116/0x150 [ 309.415709][T15793] ? sock_kzfree_s+0x70/0x70 [ 309.420299][T15793] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 309.426529][T15793] inet_sendpage+0x10f/0x150 [ 309.431122][T15793] kernel_sendpage+0x92/0xf0 [ 309.435694][T15793] ? inet_sendmsg+0xe0/0xe0 [ 309.440183][T15793] sock_sendpage+0x8b/0xc0 [ 309.444584][T15793] pipe_to_sendpage+0x296/0x360 [ 309.449415][T15793] ? kernel_sendpage+0xf0/0xf0 [ 309.454162][T15793] ? direct_splice_actor+0x190/0x190 [ 309.459444][T15793] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 309.465666][T15793] ? splice_from_pipe_next.part.0+0x262/0x300 [ 309.471719][T15793] __splice_from_pipe+0x397/0x7d0 [ 309.476730][T15793] ? direct_splice_actor+0x190/0x190 [ 309.482175][T15793] ? direct_splice_actor+0x190/0x190 [ 309.487444][T15793] splice_from_pipe+0x108/0x170 [ 309.492280][T15793] ? splice_shrink_spd+0xd0/0xd0 [ 309.497217][T15793] ? apparmor_file_permission+0x25/0x30 [ 309.502745][T15793] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 309.508967][T15793] ? security_file_permission+0x8f/0x380 [ 309.514601][T15793] generic_splice_sendpage+0x3c/0x50 [ 309.519867][T15793] ? splice_from_pipe+0x170/0x170 [ 309.524890][T15793] do_splice+0x708/0x1410 [ 309.529208][T15793] ? opipe_prep.part.0+0x2e0/0x2e0 [ 309.534390][T15793] ? __fget_light+0x1a9/0x230 [ 309.539227][T15793] __x64_sys_splice+0x2c6/0x330 [ 309.544067][T15793] do_syscall_64+0xfa/0x760 [ 309.548556][T15793] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 309.554426][T15793] RIP: 0033:0x459a59 [ 309.558302][T15793] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 309.577886][T15793] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 309.586276][T15793] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 309.594228][T15793] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 309.602179][T15793] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 309.610131][T15793] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 309.618091][T15793] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 [ 309.632736][T15799] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock 21:14:19 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(0x0, 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 21:14:19 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:19 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 309.664269][T15799] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 309.699905][T15799] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock 21:14:19 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, 0xffffffffffffffff) [ 309.824455][T15809] input: syz1 as /devices/virtual/input/input111 21:14:20 executing program 3 (fault-call:11 fault-nth:6): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:14:20 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(0x0, 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 21:14:20 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(0x0, 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 309.947652][T15819] input: syz1 as /devices/virtual/input/input113 [ 309.964162][T15799] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated [ 310.034640][T15799] EXT4-fs (loop0): get root inode failed [ 310.052063][T15826] input: syz1 as /devices/virtual/input/input114 [ 310.060021][T15799] EXT4-fs (loop0): mount failed 21:14:20 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, 0xffffffffffffffff) [ 310.138355][T15836] FAULT_INJECTION: forcing a failure. [ 310.138355][T15836] name failslab, interval 1, probability 0, space 0, times 0 21:14:20 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 21:14:20 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285b"], 0x5a}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:20 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(0x0, 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 310.211113][T15836] CPU: 0 PID: 15836 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 310.219067][T15836] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 310.229133][T15836] Call Trace: [ 310.232440][T15836] dump_stack+0x172/0x1f0 [ 310.237488][T15836] should_fail.cold+0xa/0x15 [ 310.242091][T15836] ? fault_create_debugfs_attr+0x180/0x180 [ 310.247894][T15836] ? ___might_sleep+0x163/0x2c0 [ 310.247914][T15836] __should_failslab+0x121/0x190 [ 310.247932][T15836] should_failslab+0x9/0x14 [ 310.247947][T15836] kmem_cache_alloc_node_trace+0x274/0x750 [ 310.247962][T15836] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 310.247975][T15836] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 310.247996][T15836] __kmalloc_node_track_caller+0x3d/0x70 [ 310.285372][T15836] __kmalloc_reserve.isra.0+0x40/0xf0 [ 310.290816][T15836] __alloc_skb+0x10b/0x5e0 [ 310.295216][T15836] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 310.300744][T15836] ? raw_getfrag+0x164/0x230 [ 310.305319][T15836] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 310.311023][T15836] __ip_append_data.isra.0+0x2667/0x30d0 [ 310.316644][T15836] ? raw_destroy+0x30/0x30 [ 310.321045][T15836] ? __lock_acquire+0x16f2/0x4a00 [ 310.326078][T15836] ? __ip_flush_pending_frames.isra.0+0x2d0/0x2d0 [ 310.332486][T15836] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 310.338706][T15836] ? ip_setup_cork+0x59c/0x8e0 [ 310.343465][T15836] ? raw_destroy+0x30/0x30 [ 310.347864][T15836] ip_append_data.part.0+0xf2/0x170 [ 310.353052][T15836] ? raw_destroy+0x30/0x30 [ 310.357456][T15836] ip_append_data+0x6e/0x90 [ 310.361947][T15836] raw_sendmsg+0xba8/0x2f40 [ 310.366442][T15836] ? dst_output+0x170/0x170 [ 310.370935][T15836] ? lock_downgrade+0x920/0x920 [ 310.375771][T15836] ? __kasan_check_write+0x14/0x20 [ 310.380878][T15836] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 310.387101][T15836] ? aa_label_sk_perm+0x91/0xf0 [ 310.391936][T15836] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 310.397552][T15836] ? aa_sk_perm+0x288/0x880 [ 310.402036][T15836] ? __kasan_check_read+0x11/0x20 [ 310.407043][T15836] ? __lock_acquire+0x8a0/0x4a00 [ 310.411965][T15836] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 310.417495][T15836] inet_sendmsg+0x9e/0xe0 [ 310.421805][T15836] ? inet_sendmsg+0x9e/0xe0 [ 310.426288][T15836] ? inet_send_prepare+0x4f0/0x4f0 [ 310.431391][T15836] sock_sendmsg+0xd7/0x130 [ 310.435792][T15836] kernel_sendmsg+0x44/0x50 [ 310.440278][T15836] sock_no_sendpage+0x116/0x150 [ 310.445111][T15836] ? sock_kzfree_s+0x70/0x70 [ 310.449699][T15836] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 310.456962][T15836] inet_sendpage+0x10f/0x150 [ 310.461542][T15836] kernel_sendpage+0x92/0xf0 [ 310.466110][T15836] ? inet_sendmsg+0xe0/0xe0 [ 310.470604][T15836] sock_sendpage+0x8b/0xc0 [ 310.475012][T15836] pipe_to_sendpage+0x296/0x360 [ 310.479844][T15836] ? kernel_sendpage+0xf0/0xf0 [ 310.484589][T15836] ? direct_splice_actor+0x190/0x190 [ 310.489871][T15836] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 310.496092][T15836] ? splice_from_pipe_next.part.0+0x262/0x300 [ 310.502171][T15836] __splice_from_pipe+0x397/0x7d0 [ 310.507179][T15836] ? direct_splice_actor+0x190/0x190 [ 310.512451][T15836] ? direct_splice_actor+0x190/0x190 [ 310.517717][T15836] splice_from_pipe+0x108/0x170 [ 310.523593][T15836] ? splice_shrink_spd+0xd0/0xd0 [ 310.528516][T15836] ? apparmor_file_permission+0x25/0x30 [ 310.534043][T15836] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 310.540266][T15836] ? security_file_permission+0x8f/0x380 [ 310.545884][T15836] generic_splice_sendpage+0x3c/0x50 [ 310.551152][T15836] ? splice_from_pipe+0x170/0x170 [ 310.556159][T15836] do_splice+0x708/0x1410 [ 310.560477][T15836] ? opipe_prep.part.0+0x2e0/0x2e0 [ 310.565576][T15836] ? __fget_light+0x1a9/0x230 [ 310.570236][T15836] __x64_sys_splice+0x2c6/0x330 [ 310.575073][T15836] do_syscall_64+0xfa/0x760 [ 310.579562][T15836] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 310.585437][T15836] RIP: 0033:0x459a59 [ 310.589314][T15836] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 310.610032][T15836] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 310.618438][T15836] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 310.626401][T15836] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 310.634358][T15836] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 310.642307][T15836] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 310.650259][T15836] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 21:14:20 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c0311000000190015", 0x2b}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 310.783318][T15846] input: syz1 as /devices/virtual/input/input116 [ 310.816850][T15845] input: syz1 as /devices/virtual/input/input117 21:14:20 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(0x0, 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:21 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, 0xffffffffffffffff) 21:14:21 executing program 3 (fault-call:11 fault-nth:7): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:14:21 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:21 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 311.121062][T15871] input: syz1 as /devices/virtual/input/input121 [ 311.161976][T15873] input: syz1 as /devices/virtual/input/input122 21:14:21 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 311.205508][T15840] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 311.216045][T15840] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 311.228558][T15876] FAULT_INJECTION: forcing a failure. [ 311.228558][T15876] name failslab, interval 1, probability 0, space 0, times 0 [ 311.233775][T15840] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 311.297213][T15876] CPU: 1 PID: 15876 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 311.305149][T15876] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 311.315382][T15876] Call Trace: [ 311.318690][T15876] dump_stack+0x172/0x1f0 [ 311.323049][T15876] should_fail.cold+0xa/0x15 [ 311.327658][T15876] ? fault_create_debugfs_attr+0x180/0x180 [ 311.333495][T15876] __should_failslab+0x121/0x190 [ 311.338449][T15876] should_failslab+0x9/0x14 [ 311.342967][T15876] kmem_cache_alloc+0x47/0x710 [ 311.347745][T15876] ? lock_downgrade+0x920/0x920 [ 311.352609][T15876] skb_clone+0x154/0x3d0 [ 311.356866][T15876] ip_mc_output+0x3aa/0xf70 [ 311.361386][T15876] ? __ip_queue_xmit+0x1c10/0x1c10 [ 311.366682][T15876] ? ip_append_data.part.0+0x170/0x170 [ 311.372142][T15876] ? dst_release+0x62/0xe0 [ 311.372163][T15876] ? __ip_make_skb+0xf31/0x17b0 [ 311.372183][T15876] ip_local_out+0xbb/0x1b0 [ 311.372201][T15876] ip_send_skb+0x42/0xf0 [ 311.381532][T15876] ip_push_pending_frames+0x64/0x80 [ 311.381550][T15876] raw_sendmsg+0x13c4/0x2f40 [ 311.381575][T15876] ? dst_output+0x170/0x170 [ 311.381596][T15876] ? lock_downgrade+0x920/0x920 [ 311.390306][T15876] ? __kasan_check_write+0x14/0x20 [ 311.390343][T15876] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 311.390357][T15876] ? aa_label_sk_perm+0x91/0xf0 [ 311.390377][T15876] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 311.400300][T15876] ? aa_sk_perm+0x288/0x880 [ 311.400314][T15876] ? __kasan_check_read+0x11/0x20 [ 311.400329][T15876] ? __lock_acquire+0x8a0/0x4a00 [ 311.400348][T15876] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 311.400370][T15876] inet_sendmsg+0x9e/0xe0 [ 311.414769][T15876] ? inet_sendmsg+0x9e/0xe0 [ 311.414784][T15876] ? inet_send_prepare+0x4f0/0x4f0 [ 311.414808][T15876] sock_sendmsg+0xd7/0x130 [ 311.424167][T15840] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated [ 311.425859][T15876] kernel_sendmsg+0x44/0x50 [ 311.425879][T15876] sock_no_sendpage+0x116/0x150 [ 311.425895][T15876] ? sock_kzfree_s+0x70/0x70 [ 311.425932][T15876] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 311.440558][T15840] EXT4-fs (loop0): get root inode failed [ 311.441067][T15876] inet_sendpage+0x10f/0x150 [ 311.441091][T15876] kernel_sendpage+0x92/0xf0 [ 311.441104][T15876] ? inet_sendmsg+0xe0/0xe0 [ 311.441122][T15876] sock_sendpage+0x8b/0xc0 [ 311.441143][T15876] pipe_to_sendpage+0x296/0x360 [ 311.451614][T15876] ? kernel_sendpage+0xf0/0xf0 [ 311.451635][T15876] ? direct_splice_actor+0x190/0x190 [ 311.451655][T15876] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 311.451670][T15876] ? splice_from_pipe_next.part.0+0x262/0x300 [ 311.451691][T15876] __splice_from_pipe+0x397/0x7d0 [ 311.456552][T15840] EXT4-fs (loop0): mount failed [ 311.460477][T15876] ? direct_splice_actor+0x190/0x190 [ 311.460503][T15876] ? direct_splice_actor+0x190/0x190 [ 311.460520][T15876] splice_from_pipe+0x108/0x170 [ 311.460540][T15876] ? splice_shrink_spd+0xd0/0xd0 [ 311.460565][T15876] ? apparmor_file_permission+0x25/0x30 [ 311.589482][T15876] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 311.595703][T15876] ? security_file_permission+0x8f/0x380 [ 311.601322][T15876] generic_splice_sendpage+0x3c/0x50 [ 311.606602][T15876] ? splice_from_pipe+0x170/0x170 [ 311.611695][T15876] do_splice+0x708/0x1410 [ 311.616024][T15876] ? opipe_prep.part.0+0x2e0/0x2e0 [ 311.621120][T15876] ? __fget_light+0x1a9/0x230 [ 311.625782][T15876] __x64_sys_splice+0x2c6/0x330 [ 311.630622][T15876] do_syscall_64+0xfa/0x760 [ 311.635113][T15876] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 311.640983][T15876] RIP: 0033:0x459a59 [ 311.644857][T15876] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 311.664792][T15876] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 311.673184][T15876] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 311.681137][T15876] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 311.689087][T15876] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 21:14:21 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:21 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c0311000000190015", 0x2b}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 311.697038][T15876] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 311.704991][T15876] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 21:14:21 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 21:14:21 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1"], 0x7c}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:21 executing program 5 (fault-call:7 fault-nth:0): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:21 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:22 executing program 3 (fault-call:11 fault-nth:8): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) [ 312.008867][T15901] input: syz1 as /devices/virtual/input/input124 [ 312.019751][T15902] input: syz1 as /devices/virtual/input/input125 21:14:22 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) dup2(r0, r1) 21:14:22 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) 21:14:22 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 312.210497][T15900] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 312.230054][T15900] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 312.243491][T15900] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 312.283892][T15900] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated [ 312.298432][T15924] FAULT_INJECTION: forcing a failure. [ 312.298432][T15924] name failslab, interval 1, probability 0, space 0, times 0 [ 312.324646][T15900] EXT4-fs (loop0): get root inode failed [ 312.340744][T15924] CPU: 0 PID: 15924 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 312.348675][T15924] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 312.358736][T15924] Call Trace: [ 312.362049][T15924] dump_stack+0x172/0x1f0 [ 312.366401][T15924] should_fail.cold+0xa/0x15 [ 312.366422][T15924] ? fault_create_debugfs_attr+0x180/0x180 [ 312.378101][T15924] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 312.378120][T15924] ? __kasan_check_read+0x11/0x20 [ 312.378141][T15924] __should_failslab+0x121/0x190 [ 312.378158][T15924] should_failslab+0x9/0x14 [ 312.378172][T15924] kmem_cache_alloc+0x47/0x710 [ 312.378187][T15924] ? ip_mc_output+0x584/0xf70 [ 312.378202][T15924] ? find_held_lock+0x35/0x130 [ 312.378221][T15924] dst_alloc+0x10e/0x200 [ 312.389450][T15924] rt_dst_clone+0x59/0x8c0 [ 312.389470][T15924] ip_mc_finish_output+0xb6/0x4a0 [ 312.389491][T15924] ip_mc_output+0x5dd/0xf70 [ 312.389511][T15924] ? __ip_queue_xmit+0x1c10/0x1c10 [ 312.408403][T15924] ? dst_output+0x170/0x170 [ 312.408419][T15924] ? dst_release+0x62/0xe0 [ 312.408436][T15924] ? __ip_make_skb+0xf31/0x17b0 [ 312.408455][T15924] ip_local_out+0xbb/0x1b0 [ 312.429605][T15927] input: syz1 as /devices/virtual/input/input128 [ 312.431327][T15924] ip_send_skb+0x42/0xf0 [ 312.431344][T15924] ip_push_pending_frames+0x64/0x80 [ 312.431363][T15924] raw_sendmsg+0x13c4/0x2f40 [ 312.436637][T15900] EXT4-fs (loop0): mount failed [ 312.440959][T15924] ? dst_output+0x170/0x170 [ 312.440984][T15924] ? lock_downgrade+0x920/0x920 [ 312.441003][T15924] ? __kasan_check_write+0x14/0x20 [ 312.441037][T15924] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 312.461483][T15924] ? aa_label_sk_perm+0x91/0xf0 [ 312.461504][T15924] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 312.461521][T15924] ? aa_sk_perm+0x288/0x880 [ 312.484830][T15924] ? __kasan_check_read+0x11/0x20 [ 312.484849][T15924] ? __lock_acquire+0x8a0/0x4a00 [ 312.484867][T15924] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 312.484890][T15924] inet_sendmsg+0x9e/0xe0 [ 312.484904][T15924] ? inet_sendmsg+0x9e/0xe0 21:14:22 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1"], 0x7c}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) [ 312.484916][T15924] ? inet_send_prepare+0x4f0/0x4f0 [ 312.484932][T15924] sock_sendmsg+0xd7/0x130 [ 312.484947][T15924] kernel_sendmsg+0x44/0x50 [ 312.484962][T15924] sock_no_sendpage+0x116/0x150 [ 312.484976][T15924] ? sock_kzfree_s+0x70/0x70 [ 312.485009][T15924] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 312.485028][T15924] inet_sendpage+0x10f/0x150 [ 312.485057][T15924] kernel_sendpage+0x92/0xf0 [ 312.494985][T15924] ? inet_sendmsg+0xe0/0xe0 [ 312.495007][T15924] sock_sendpage+0x8b/0xc0 21:14:22 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) dup2(r0, r1) [ 312.495029][T15924] pipe_to_sendpage+0x296/0x360 [ 312.495046][T15924] ? kernel_sendpage+0xf0/0xf0 [ 312.511717][T15924] ? direct_splice_actor+0x190/0x190 [ 312.521250][T15924] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 312.521271][T15924] ? splice_from_pipe_next.part.0+0x262/0x300 [ 312.521293][T15924] __splice_from_pipe+0x397/0x7d0 [ 312.521313][T15924] ? direct_splice_actor+0x190/0x190 [ 312.536088][T15924] ? direct_splice_actor+0x190/0x190 [ 312.536105][T15924] splice_from_pipe+0x108/0x170 [ 312.536124][T15924] ? splice_shrink_spd+0xd0/0xd0 [ 312.575508][T15924] ? apparmor_file_permission+0x25/0x30 [ 312.575529][T15924] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 312.575546][T15924] ? security_file_permission+0x8f/0x380 [ 312.575571][T15924] generic_splice_sendpage+0x3c/0x50 [ 312.575587][T15924] ? splice_from_pipe+0x170/0x170 [ 312.575602][T15924] do_splice+0x708/0x1410 [ 312.575626][T15924] ? opipe_prep.part.0+0x2e0/0x2e0 [ 312.589095][T15924] ? __fget_light+0x1a9/0x230 [ 312.589117][T15924] __x64_sys_splice+0x2c6/0x330 [ 312.616244][T15924] do_syscall_64+0xfa/0x760 [ 312.616268][T15924] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 312.616280][T15924] RIP: 0033:0x459a59 [ 312.616299][T15924] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 312.616306][T15924] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 312.616320][T15924] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 21:14:22 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1"], 0x7c}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:22 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c0311000000190015", 0x2b}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 312.616334][T15924] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 312.664576][T15924] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 312.664584][T15924] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 312.664592][T15924] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 21:14:22 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) dup2(r0, r1) 21:14:23 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) 21:14:23 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(0xffffffffffffffff, r1) 21:14:23 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r3, 0x0, 0x0, 0x0) r4 = openat(r3, &(0x7f0000000180)='./file0\x00', 0x100, 0x979313d4b6d349b3) ioctl$SNDRV_TIMER_IOCTL_GINFO(r4, 0xc0f85403, &(0x7f0000000240)={{0x2, 0x0, 0x2, 0x2, 0xe759}, 0x6, 0x6bb0, 'id1\x00', 'timer0\x00', 0x0, 0x9, 0x0, 0x2dce, 0x100}) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) semget(0x1, 0x3, 0x40) r5 = gettid() ptrace$setopts(0x4206, r5, 0x0, 0x0) gettid() fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000140)={0x0, 0x0}) tkill(r6, 0xc) ptrace$cont(0x18, r5, 0x0, 0x0) ptrace$setregs(0xd, r5, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r5, 0x0, 0x0) sched_getattr(0xffffffffffffffff, &(0x7f0000000380)={0x30}, 0xfffffe1b, 0x0) 21:14:23 executing program 3 (fault-call:11 fault-nth:9): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) [ 313.141227][T15958] input: syz1 as /devices/virtual/input/input133 [ 313.156719][T15941] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 313.171264][T15941] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 313.187638][T15941] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 313.236481][T15941] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated [ 313.254393][T15960] input: syz1 as /devices/virtual/input/input134 [ 313.269247][T15976] FAULT_INJECTION: forcing a failure. [ 313.269247][T15976] name failslab, interval 1, probability 0, space 0, times 0 21:14:23 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(0xffffffffffffffff, r1) [ 313.284573][T15941] EXT4-fs (loop0): get root inode failed [ 313.299984][T15941] EXT4-fs (loop0): mount failed [ 313.315195][T15976] CPU: 0 PID: 15976 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 313.323107][T15976] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 313.333164][T15976] Call Trace: [ 313.336461][T15976] dump_stack+0x172/0x1f0 [ 313.340804][T15976] should_fail.cold+0xa/0x15 [ 313.345410][T15976] ? fault_create_debugfs_attr+0x180/0x180 [ 313.351313][T15976] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 313.357562][T15976] ? __kasan_check_read+0x11/0x20 [ 313.362602][T15976] __should_failslab+0x121/0x190 [ 313.368178][T15976] should_failslab+0x9/0x14 [ 313.372688][T15976] kmem_cache_alloc+0x47/0x710 [ 313.377444][T15976] ? ip_mc_output+0x584/0xf70 [ 313.382103][T15976] ? find_held_lock+0x35/0x130 [ 313.386864][T15976] dst_alloc+0x10e/0x200 [ 313.391099][T15976] rt_dst_clone+0x59/0x8c0 [ 313.395522][T15976] ip_mc_finish_output+0xb6/0x4a0 [ 313.400553][T15976] ip_mc_output+0x5dd/0xf70 [ 313.405064][T15976] ? __ip_queue_xmit+0x1c10/0x1c10 [ 313.410168][T15976] ? dst_output+0x170/0x170 [ 313.414663][T15976] ? dst_release+0x62/0xe0 [ 313.419084][T15976] ? __ip_make_skb+0xf31/0x17b0 [ 313.423916][T15976] ip_local_out+0xbb/0x1b0 [ 313.428317][T15976] ip_send_skb+0x42/0xf0 [ 313.432539][T15976] ip_push_pending_frames+0x64/0x80 [ 313.437714][T15976] raw_sendmsg+0x13c4/0x2f40 [ 313.442297][T15976] ? dst_output+0x170/0x170 [ 313.449834][T15976] ? lock_downgrade+0x920/0x920 [ 313.454691][T15976] ? __kasan_check_write+0x14/0x20 [ 313.459803][T15976] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 313.466036][T15976] ? aa_label_sk_perm+0x91/0xf0 [ 313.470880][T15976] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 313.476505][T15976] ? aa_sk_perm+0x288/0x880 [ 313.481009][T15976] ? __kasan_check_read+0x11/0x20 [ 313.486112][T15976] ? __lock_acquire+0x8a0/0x4a00 [ 313.491043][T15976] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 313.496584][T15976] inet_sendmsg+0x9e/0xe0 [ 313.500899][T15976] ? inet_sendmsg+0x9e/0xe0 [ 313.505391][T15976] ? inet_send_prepare+0x4f0/0x4f0 [ 313.510493][T15976] sock_sendmsg+0xd7/0x130 [ 313.514907][T15976] kernel_sendmsg+0x44/0x50 [ 313.519443][T15976] sock_no_sendpage+0x116/0x150 [ 313.524283][T15976] ? sock_kzfree_s+0x70/0x70 [ 313.528924][T15976] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 313.535182][T15976] inet_sendpage+0x10f/0x150 [ 313.539768][T15976] kernel_sendpage+0x92/0xf0 [ 313.544367][T15976] ? inet_sendmsg+0xe0/0xe0 [ 313.548861][T15976] sock_sendpage+0x8b/0xc0 [ 313.553260][T15976] pipe_to_sendpage+0x296/0x360 [ 313.558095][T15976] ? kernel_sendpage+0xf0/0xf0 [ 313.562843][T15976] ? direct_splice_actor+0x190/0x190 [ 313.568113][T15976] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 313.574345][T15976] ? splice_from_pipe_next.part.0+0x262/0x300 [ 313.580404][T15976] __splice_from_pipe+0x397/0x7d0 [ 313.585418][T15976] ? direct_splice_actor+0x190/0x190 [ 313.590705][T15976] ? direct_splice_actor+0x190/0x190 [ 313.596002][T15976] splice_from_pipe+0x108/0x170 [ 313.601280][T15976] ? splice_shrink_spd+0xd0/0xd0 [ 313.606229][T15976] ? apparmor_file_permission+0x25/0x30 [ 313.611765][T15976] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 313.617991][T15976] ? security_file_permission+0x8f/0x380 [ 313.624574][T15976] generic_splice_sendpage+0x3c/0x50 [ 313.629846][T15976] ? splice_from_pipe+0x170/0x170 [ 313.634860][T15976] do_splice+0x708/0x1410 [ 313.639191][T15976] ? opipe_prep.part.0+0x2e0/0x2e0 [ 313.644296][T15976] ? __fget_light+0x1a9/0x230 [ 313.648964][T15976] __x64_sys_splice+0x2c6/0x330 [ 313.653799][T15976] do_syscall_64+0xfa/0x760 [ 313.658299][T15976] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 313.664177][T15976] RIP: 0033:0x459a59 [ 313.668060][T15976] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 21:14:23 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75a", 0x40}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 313.687709][T15976] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 313.696134][T15976] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 313.704104][T15976] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 313.712066][T15976] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 313.720026][T15976] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 313.727994][T15976] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 21:14:23 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f"], 0x8d}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:23 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000180)='/dev/vcs#\x00', 0xfffffffffffffffd, 0x20000) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r2, 0x0, 0x0, 0x0) ioctl$VIDIOC_QUERYSTD(r2, 0x8008563f, &(0x7f00000001c0)=0x0) ioctl$VIDIOC_S_STD(r1, 0x40085618, &(0x7f0000000240)=r3) r4 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r5, 0x0, 0xffffffffffffffdd, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r5, 0x84, 0x7c, &(0x7f0000000280)={0x0, 0x0, 0x7}, 0x8) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') r7 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r7, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) bind$inet(r7, &(0x7f0000000480)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r7, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x24e23, @local}, 0x10) setsockopt$sock_int(r7, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r7, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) write$binfmt_elf64(r7, &(0x7f00000000c0)=ANY=[@ANYRES64], 0xc63b9e35) getsockopt$inet_sctp_SCTP_MAX_BURST(r7, 0x84, 0x14, &(0x7f0000000340), &(0x7f0000000380)=0x4) pread64(r6, 0x0, 0x0, 0x0) r8 = perf_event_open(&(0x7f00000002c0)={0x4, 0x70, 0x26, 0x2, 0x4, 0x0, 0x0, 0x8, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x2, 0x0, @perf_config_ext={0x58e, 0x2}, 0x210, 0xfff, 0x101, 0x0, 0x8, 0x2, 0x200}, 0xffffffffffffffff, 0x9, r6, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) link(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='./file0\x00') ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r4) 21:14:24 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) [ 313.981257][T15992] input: syz1 as /devices/virtual/input/input137 21:14:24 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(0xffffffffffffffff, r1) 21:14:24 executing program 3 (fault-call:11 fault-nth:10): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) [ 314.028456][T15996] input: syz1 as /devices/virtual/input/input138 [ 314.162473][T15997] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 314.195943][T16009] FAULT_INJECTION: forcing a failure. [ 314.195943][T16009] name failslab, interval 1, probability 0, space 0, times 0 21:14:24 executing program 1 (fault-call:4 fault-nth:0): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 314.210044][T15997] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 314.231830][T15997] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 314.293777][T16009] CPU: 1 PID: 16009 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 314.301715][T16009] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 314.311779][T16009] Call Trace: [ 314.315178][T16009] dump_stack+0x172/0x1f0 [ 314.315695][T15997] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated [ 314.319518][T16009] should_fail.cold+0xa/0x15 [ 314.319539][T16009] ? fault_create_debugfs_attr+0x180/0x180 [ 314.319559][T16009] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 314.319575][T16009] ? __kasan_check_read+0x11/0x20 [ 314.319601][T16009] __should_failslab+0x121/0x190 [ 314.332173][T15997] EXT4-fs (loop0): get root inode failed [ 314.336128][T16009] should_failslab+0x9/0x14 [ 314.336146][T16009] kmem_cache_alloc+0x47/0x710 [ 314.336162][T16009] ? ip_mc_output+0x584/0xf70 [ 314.336179][T16009] ? find_held_lock+0x35/0x130 [ 314.336199][T16009] dst_alloc+0x10e/0x200 [ 314.336217][T16009] rt_dst_clone+0x59/0x8c0 [ 314.342137][T15997] EXT4-fs (loop0): mount failed [ 314.348223][T16009] ip_mc_finish_output+0xb6/0x4a0 [ 314.348245][T16009] ip_mc_output+0x5dd/0xf70 [ 314.348268][T16009] ? __ip_queue_xmit+0x1c10/0x1c10 [ 314.348286][T16009] ? dst_output+0x170/0x170 [ 314.348299][T16009] ? dst_release+0x62/0xe0 [ 314.348317][T16009] ? __ip_make_skb+0xf31/0x17b0 [ 314.368334][T16009] ip_local_out+0xbb/0x1b0 [ 314.368355][T16009] ip_send_skb+0x42/0xf0 [ 314.368372][T16009] ip_push_pending_frames+0x64/0x80 [ 314.368388][T16009] raw_sendmsg+0x13c4/0x2f40 [ 314.368410][T16009] ? dst_output+0x170/0x170 [ 314.377820][T16009] ? lock_downgrade+0x920/0x920 [ 314.377840][T16009] ? __kasan_check_write+0x14/0x20 [ 314.377876][T16009] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 314.377891][T16009] ? aa_label_sk_perm+0x91/0xf0 [ 314.377912][T16009] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 314.386881][T16009] ? aa_sk_perm+0x288/0x880 [ 314.386895][T16009] ? __kasan_check_read+0x11/0x20 [ 314.386912][T16009] ? __lock_acquire+0x8a0/0x4a00 [ 314.386931][T16009] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 314.386952][T16009] inet_sendmsg+0x9e/0xe0 [ 314.386962][T16009] ? inet_sendmsg+0x9e/0xe0 [ 314.386978][T16009] ? inet_send_prepare+0x4f0/0x4f0 [ 314.405698][T16009] sock_sendmsg+0xd7/0x130 [ 314.405718][T16009] kernel_sendmsg+0x44/0x50 [ 314.405737][T16009] sock_no_sendpage+0x116/0x150 [ 314.405754][T16009] ? sock_kzfree_s+0x70/0x70 [ 314.416011][T16015] input: syz1 as /devices/virtual/input/input140 [ 314.419753][T16009] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 314.419774][T16009] inet_sendpage+0x10f/0x150 [ 314.419794][T16009] kernel_sendpage+0x92/0xf0 [ 314.419810][T16009] ? inet_sendmsg+0xe0/0xe0 [ 314.440504][T16017] FAULT_INJECTION: forcing a failure. [ 314.440504][T16017] name failslab, interval 1, probability 0, space 0, times 0 [ 314.443108][T16009] sock_sendpage+0x8b/0xc0 [ 314.443132][T16009] pipe_to_sendpage+0x296/0x360 [ 314.443148][T16009] ? kernel_sendpage+0xf0/0xf0 [ 314.443168][T16009] ? direct_splice_actor+0x190/0x190 [ 314.452489][T16009] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 314.452507][T16009] ? splice_from_pipe_next.part.0+0x262/0x300 [ 314.452530][T16009] __splice_from_pipe+0x397/0x7d0 [ 314.452545][T16009] ? direct_splice_actor+0x190/0x190 [ 314.452568][T16009] ? direct_splice_actor+0x190/0x190 [ 314.612936][T16009] splice_from_pipe+0x108/0x170 [ 314.617785][T16009] ? splice_shrink_spd+0xd0/0xd0 [ 314.622723][T16009] ? apparmor_file_permission+0x25/0x30 [ 314.628268][T16009] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 314.634502][T16009] ? security_file_permission+0x8f/0x380 [ 314.640159][T16009] generic_splice_sendpage+0x3c/0x50 [ 314.645451][T16009] ? splice_from_pipe+0x170/0x170 [ 314.650476][T16009] do_splice+0x708/0x1410 [ 314.654817][T16009] ? opipe_prep.part.0+0x2e0/0x2e0 [ 314.659932][T16009] ? __fget_light+0x1a9/0x230 [ 314.664618][T16009] __x64_sys_splice+0x2c6/0x330 [ 314.669485][T16009] do_syscall_64+0xfa/0x760 [ 314.673998][T16009] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 314.679893][T16009] RIP: 0033:0x459a59 [ 314.683781][T16009] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 314.703372][T16009] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 314.711776][T16009] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 314.719741][T16009] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 314.727705][T16009] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 314.735668][T16009] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 21:14:24 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75a", 0x40}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 314.743628][T16009] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 [ 314.751614][T16017] CPU: 0 PID: 16017 Comm: syz-executor.1 Not tainted 5.4.0-rc2+ #0 [ 314.759599][T16017] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 314.769653][T16017] Call Trace: [ 314.769677][T16017] dump_stack+0x172/0x1f0 [ 314.777268][T16017] should_fail.cold+0xa/0x15 [ 314.782387][T16017] ? fault_create_debugfs_attr+0x180/0x180 [ 314.788211][T16017] ? ___might_sleep+0x163/0x2c0 [ 314.793071][T16017] __should_failslab+0x121/0x190 [ 314.798015][T16017] should_failslab+0x9/0x14 [ 314.802518][T16017] __kmalloc+0x2e0/0x770 [ 314.802539][T16017] ? mark_held_locks+0xf0/0xf0 [ 314.802553][T16017] ? mark_lock+0xc2/0x1220 [ 314.802572][T16017] ? _parse_integer+0x190/0x190 [ 314.812851][T16017] ? tomoyo_realpath_from_path+0xcd/0x7b0 [ 314.812873][T16017] tomoyo_realpath_from_path+0xcd/0x7b0 [ 314.812887][T16017] ? tomoyo_path_number_perm+0x193/0x520 [ 314.812909][T16017] tomoyo_path_number_perm+0x1dd/0x520 21:14:24 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, 0xffffffffffffffff) [ 314.844689][T16017] ? tomoyo_path_number_perm+0x193/0x520 [ 314.850331][T16017] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 314.856246][T16017] ? __f_unlock_pos+0x19/0x20 [ 314.860944][T16017] ? __fget+0x384/0x560 [ 314.865090][T16017] ? ksys_dup3+0x3e0/0x3e0 [ 314.869490][T16017] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 314.875716][T16017] ? fput_many+0x12c/0x1a0 [ 314.880219][T16017] tomoyo_file_ioctl+0x23/0x30 [ 314.884973][T16017] security_file_ioctl+0x77/0xc0 [ 314.889910][T16017] ksys_ioctl+0x57/0xd0 [ 314.894112][T16017] __x64_sys_ioctl+0x73/0xb0 [ 314.898684][T16017] do_syscall_64+0xfa/0x760 [ 314.903174][T16017] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 314.909045][T16017] RIP: 0033:0x459a59 [ 314.912918][T16017] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 314.933297][T16017] RSP: 002b:00007efe3a3d6c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 21:14:25 executing program 3 (fault-call:11 fault-nth:11): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) [ 314.941793][T16017] RAX: ffffffffffffffda RBX: 00007efe3a3d6c90 RCX: 0000000000459a59 [ 314.949771][T16017] RDX: 0000000000000000 RSI: 0000000000005502 RDI: 0000000000000003 [ 314.957740][T16017] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 314.965703][T16017] R10: 0000000000000000 R11: 0000000000000246 R12: 00007efe3a3d76d4 [ 314.973663][T16017] R13: 00000000004c4811 R14: 00000000004d8fe8 R15: 0000000000000005 21:14:25 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) fspick(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1) dup2(r0, r1) [ 314.992241][T16017] ERROR: Out of memory at tomoyo_realpath_from_path. 21:14:25 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f"], 0x8d}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) [ 315.155781][T16028] input: syz1 as /devices/virtual/input/input142 21:14:25 executing program 1 (fault-call:4 fault-nth:1): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 315.202299][T16034] FAULT_INJECTION: forcing a failure. [ 315.202299][T16034] name failslab, interval 1, probability 0, space 0, times 0 [ 315.250659][T16034] CPU: 1 PID: 16034 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 315.258588][T16034] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 315.269593][T16034] Call Trace: [ 315.269619][T16034] dump_stack+0x172/0x1f0 [ 315.269642][T16034] should_fail.cold+0xa/0x15 [ 315.269661][T16034] ? fault_create_debugfs_attr+0x180/0x180 [ 315.269680][T16034] ? ___might_sleep+0x163/0x2c0 [ 315.269700][T16034] __should_failslab+0x121/0x190 [ 315.297440][T16034] should_failslab+0x9/0x14 [ 315.301952][T16034] kmem_cache_alloc_node_trace+0x274/0x750 [ 315.307769][T16034] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 315.313756][T16034] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 315.319569][T16034] __kmalloc_node_track_caller+0x3d/0x70 [ 315.319592][T16034] __kmalloc_reserve.isra.0+0x40/0xf0 [ 315.319612][T16034] __alloc_skb+0x10b/0x5e0 [ 315.319629][T16034] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 315.319645][T16034] ? dst_init+0x38e/0x4d0 [ 315.330630][T16034] __ip_append_data.isra.0+0x2667/0x30d0 [ 315.340649][T16034] ? raw_destroy+0x30/0x30 [ 315.340669][T16034] ? __lock_acquire+0x16f2/0x4a00 [ 315.340694][T16034] ? __ip_flush_pending_frames.isra.0+0x2d0/0x2d0 [ 315.340715][T16034] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 315.372628][T16034] ? ip_setup_cork+0x59c/0x8e0 [ 315.377376][T16034] ? raw_destroy+0x30/0x30 [ 315.381778][T16034] ip_append_data.part.0+0xf2/0x170 [ 315.386962][T16034] ? raw_destroy+0x30/0x30 [ 315.391380][T16034] ip_append_data+0x6e/0x90 [ 315.395873][T16034] raw_sendmsg+0xba8/0x2f40 [ 315.400368][T16034] ? dst_output+0x170/0x170 [ 315.404861][T16034] ? __lock_acquire+0x16f2/0x4a00 [ 315.409878][T16034] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 315.415841][T16034] ? finish_task_switch+0x147/0x750 [ 315.421045][T16034] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 315.427274][T16034] ? aa_label_sk_perm+0x91/0xf0 [ 315.432118][T16034] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 315.437733][T16034] ? aa_sk_perm+0x288/0x880 [ 315.442221][T16034] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 315.447756][T16034] inet_sendmsg+0x9e/0xe0 [ 315.452082][T16034] ? inet_sendmsg+0x9e/0xe0 [ 315.456566][T16034] ? inet_send_prepare+0x4f0/0x4f0 [ 315.461661][T16034] sock_sendmsg+0xd7/0x130 [ 315.466151][T16034] kernel_sendmsg+0x44/0x50 [ 315.470637][T16034] sock_no_sendpage+0x116/0x150 [ 315.475471][T16034] ? sock_kzfree_s+0x70/0x70 [ 315.480052][T16034] ? retint_kernel+0x2b/0x2b [ 315.484629][T16034] ? inet_send_prepare+0x22/0x4f0 [ 315.489636][T16034] ? inet_send_prepare+0x3c/0x4f0 [ 315.494645][T16034] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 315.500889][T16034] inet_sendpage+0x10f/0x150 [ 315.505469][T16034] kernel_sendpage+0x92/0xf0 [ 315.510041][T16034] ? inet_sendmsg+0xe0/0xe0 [ 315.514529][T16034] sock_sendpage+0x8b/0xc0 [ 315.518931][T16034] pipe_to_sendpage+0x296/0x360 [ 315.523763][T16034] ? kernel_sendpage+0xf0/0xf0 [ 315.528508][T16034] ? direct_splice_actor+0x190/0x190 [ 315.533776][T16034] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 315.539999][T16034] ? anon_pipe_buf_release+0x1c6/0x270 [ 315.545445][T16034] __splice_from_pipe+0x397/0x7d0 [ 315.550453][T16034] ? direct_splice_actor+0x190/0x190 [ 315.555735][T16034] ? direct_splice_actor+0x190/0x190 [ 315.561013][T16034] splice_from_pipe+0x108/0x170 [ 315.565849][T16034] ? splice_shrink_spd+0xd0/0xd0 [ 315.570781][T16034] ? apparmor_file_permission+0x25/0x30 [ 315.576313][T16034] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 315.582535][T16034] ? security_file_permission+0x8f/0x380 [ 315.588157][T16034] generic_splice_sendpage+0x3c/0x50 [ 315.593427][T16034] ? splice_from_pipe+0x170/0x170 [ 315.598438][T16034] do_splice+0x708/0x1410 [ 315.602764][T16034] ? opipe_prep.part.0+0x2e0/0x2e0 [ 315.607875][T16034] ? __fget_light+0x1a9/0x230 [ 315.612558][T16034] __x64_sys_splice+0x2c6/0x330 [ 315.617413][T16034] do_syscall_64+0xfa/0x760 [ 315.621909][T16034] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 315.627784][T16034] RIP: 0033:0x459a59 [ 315.631663][T16034] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 315.651264][T16034] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 315.659671][T16034] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 315.667622][T16034] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 315.675590][T16034] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 315.683544][T16034] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 315.691499][T16034] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 [ 315.703138][T16045] FAULT_INJECTION: forcing a failure. [ 315.703138][T16045] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 315.716365][T16045] CPU: 0 PID: 16045 Comm: syz-executor.1 Not tainted 5.4.0-rc2+ #0 [ 315.724268][T16045] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 315.734673][T16045] Call Trace: [ 315.737986][T16045] dump_stack+0x172/0x1f0 [ 315.742332][T16045] should_fail.cold+0xa/0x15 [ 315.746937][T16045] ? fault_create_debugfs_attr+0x180/0x180 [ 315.752759][T16045] ? lock_downgrade+0x920/0x920 [ 315.757631][T16045] should_fail_alloc_page+0x50/0x60 [ 315.762825][T16045] __alloc_pages_nodemask+0x1a1/0x900 [ 315.768186][T16045] ? __kasan_check_read+0x11/0x20 [ 315.768201][T16045] ? mark_lock+0xc2/0x1220 [ 315.768220][T16045] ? __alloc_pages_slowpath+0x2910/0x2910 [ 315.777627][T16045] ? __kasan_check_read+0x11/0x20 [ 315.777648][T16045] ? fault_create_debugfs_attr+0x180/0x180 [ 315.777669][T16045] cache_grow_begin+0x90/0xd20 [ 315.777684][T16045] ? tomoyo_realpath_from_path+0xcd/0x7b0 [ 315.777705][T16045] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 315.788409][T16045] __kmalloc+0x6b2/0x770 [ 315.788425][T16045] ? mark_held_locks+0xf0/0xf0 [ 315.788445][T16045] ? mark_lock+0xc2/0x1220 [ 315.797128][T16038] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 315.799006][T16045] ? tomoyo_realpath_from_path+0xcd/0x7b0 [ 315.799028][T16045] tomoyo_realpath_from_path+0xcd/0x7b0 [ 315.799040][T16045] ? tomoyo_path_number_perm+0x193/0x520 [ 315.799061][T16045] tomoyo_path_number_perm+0x1dd/0x520 [ 315.824428][T16038] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 315.824570][T16045] ? tomoyo_path_number_perm+0x193/0x520 [ 315.824589][T16045] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 315.842546][T16038] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 315.844381][T16045] ? __f_unlock_pos+0x19/0x20 [ 315.844434][T16045] ? __fget+0x384/0x560 21:14:26 executing program 3 (fault-call:11 fault-nth:12): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) [ 315.844455][T16045] ? ksys_dup3+0x3e0/0x3e0 [ 315.844472][T16045] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 315.844485][T16045] ? fput_many+0x12c/0x1a0 [ 315.844504][T16045] tomoyo_file_ioctl+0x23/0x30 [ 315.870894][T16045] security_file_ioctl+0x77/0xc0 [ 315.870918][T16045] ksys_ioctl+0x57/0xd0 [ 315.870938][T16045] __x64_sys_ioctl+0x73/0xb0 [ 315.870963][T16045] do_syscall_64+0xfa/0x760 [ 315.925471][T16045] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 315.925485][T16045] RIP: 0033:0x459a59 [ 315.925499][T16045] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 315.925511][T16045] RSP: 002b:00007efe3a3d6c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 315.938715][T16045] RAX: ffffffffffffffda RBX: 00007efe3a3d6c90 RCX: 0000000000459a59 [ 315.938725][T16045] RDX: 0000000000000000 RSI: 0000000000005502 RDI: 0000000000000003 [ 315.938734][T16045] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 21:14:26 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75a", 0x40}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 315.938743][T16045] R10: 0000000000000000 R11: 0000000000000246 R12: 00007efe3a3d76d4 [ 315.938752][T16045] R13: 00000000004c4811 R14: 00000000004d8fe8 R15: 0000000000000005 [ 315.986486][T16038] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated [ 316.029803][T16044] input: syz1 as /devices/virtual/input/input144 21:14:26 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, 0xffffffffffffffff) [ 316.134651][T16038] EXT4-fs (loop0): get root inode failed [ 316.140485][T16038] EXT4-fs (loop0): mount failed [ 316.156999][T16058] FAULT_INJECTION: forcing a failure. [ 316.156999][T16058] name failslab, interval 1, probability 0, space 0, times 0 [ 316.178402][T16041] input: syz1 as /devices/virtual/input/input145 21:14:26 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f"], 0x8d}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) [ 316.205607][T16058] CPU: 0 PID: 16058 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 316.213642][T16058] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 316.223823][T16058] Call Trace: [ 316.227130][T16058] dump_stack+0x172/0x1f0 [ 316.231478][T16058] should_fail.cold+0xa/0x15 [ 316.236168][T16058] ? lock_downgrade+0x920/0x920 [ 316.241033][T16058] ? fault_create_debugfs_attr+0x180/0x180 [ 316.246868][T16058] ? __kasan_check_read+0x11/0x20 [ 316.251900][T16058] __should_failslab+0x121/0x190 [ 316.256852][T16058] should_failslab+0x9/0x14 [ 316.261366][T16058] kmem_cache_alloc+0x47/0x710 [ 316.266147][T16058] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 316.272311][T16058] dst_alloc+0x10e/0x200 [ 316.276561][T16058] rt_dst_alloc+0x83/0x440 [ 316.280988][T16058] ip_route_output_key_hash_rcu+0x8d7/0x2d70 [ 316.286982][T16058] ? ip_route_input_noref+0x270/0x270 [ 316.292369][T16058] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 316.298625][T16058] ? __kasan_check_read+0x11/0x20 [ 316.303661][T16058] ip_route_output_key_hash+0x1ef/0x360 [ 316.309217][T16058] ? ip_route_output_key_hash_rcu+0x2d70/0x2d70 [ 316.315491][T16058] ? lock_downgrade+0x920/0x920 [ 316.315511][T16058] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 316.315528][T16058] ip_route_output_flow+0x28/0xc0 [ 316.315545][T16058] raw_sendmsg+0xa30/0x2f40 [ 316.315570][T16058] ? dst_output+0x170/0x170 [ 316.315590][T16058] ? lock_downgrade+0x920/0x920 [ 316.315607][T16058] ? __kasan_check_write+0x14/0x20 [ 316.315635][T16058] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 316.326770][T16058] ? aa_label_sk_perm+0x91/0xf0 [ 316.326791][T16058] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 316.326805][T16058] ? aa_sk_perm+0x288/0x880 [ 316.326819][T16058] ? __kasan_check_read+0x11/0x20 [ 316.326833][T16058] ? __lock_acquire+0x8a0/0x4a00 [ 316.326851][T16058] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 316.326872][T16058] inet_sendmsg+0x9e/0xe0 [ 316.326884][T16058] ? inet_sendmsg+0x9e/0xe0 [ 316.326896][T16058] ? inet_send_prepare+0x4f0/0x4f0 [ 316.326914][T16058] sock_sendmsg+0xd7/0x130 [ 316.345729][T16058] kernel_sendmsg+0x44/0x50 [ 316.345749][T16058] sock_no_sendpage+0x116/0x150 [ 316.345762][T16058] ? sock_kzfree_s+0x70/0x70 [ 316.345796][T16058] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 316.345815][T16058] inet_sendpage+0x10f/0x150 [ 316.345832][T16058] kernel_sendpage+0x92/0xf0 [ 316.345848][T16058] ? inet_sendmsg+0xe0/0xe0 [ 316.439523][T16058] sock_sendpage+0x8b/0xc0 [ 316.444714][T16058] pipe_to_sendpage+0x296/0x360 [ 316.449551][T16058] ? kernel_sendpage+0xf0/0xf0 [ 316.454298][T16058] ? direct_splice_actor+0x190/0x190 [ 316.459580][T16058] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 316.465803][T16058] ? anon_pipe_buf_release+0x1c6/0x270 [ 316.471250][T16058] __splice_from_pipe+0x397/0x7d0 [ 316.476258][T16058] ? direct_splice_actor+0x190/0x190 [ 316.481533][T16058] ? direct_splice_actor+0x190/0x190 [ 316.486800][T16058] splice_from_pipe+0x108/0x170 [ 316.491641][T16058] ? splice_shrink_spd+0xd0/0xd0 [ 316.496574][T16058] ? apparmor_file_permission+0x25/0x30 [ 316.502107][T16058] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 316.508336][T16058] ? security_file_permission+0x8f/0x380 [ 316.513962][T16058] generic_splice_sendpage+0x3c/0x50 [ 316.519250][T16058] ? splice_from_pipe+0x170/0x170 [ 316.524262][T16058] do_splice+0x708/0x1410 [ 316.528594][T16058] ? opipe_prep.part.0+0x2e0/0x2e0 [ 316.533691][T16058] ? __fget_light+0x1a9/0x230 [ 316.538353][T16058] __x64_sys_splice+0x2c6/0x330 [ 316.543194][T16058] do_syscall_64+0xfa/0x760 [ 316.547687][T16058] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 316.553561][T16058] RIP: 0033:0x459a59 [ 316.557446][T16058] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 316.577396][T16058] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 316.585792][T16058] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 316.593743][T16058] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 316.602218][T16058] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 316.610173][T16058] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 316.618135][T16058] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 21:14:26 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) bind$inet(r4, &(0x7f0000000480)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r4, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x24e23, @local}, 0x10) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r4, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) write$binfmt_elf64(r4, &(0x7f00000000c0)=ANY=[@ANYRES64], 0xc63b9e35) setsockopt$inet_tcp_buf(r4, 0x6, 0x1c, &(0x7f0000000240)="1b11160a81530f805c430e796e3f481afd01b735f47645f2ed2f1efba897963a9602cd607ca2f47eec68b305cb67bdbadc222bc9282e100f77ee9807c8aa3f0b33b80e6ed951989b15b3c0874a8cb703f7885655b98fe7a6f10fff175da538d3f7b357906b44ae5e304e84c96138d85244a9f3ba0aed8a66dda582ee1ad612eb2f3daa848c34b7af65ea40691640edfc6ab3453ad9902735de8604e15d3c597cf06cf4ca05d19b19aa5ead412e3df3d1563b04032995e09b4394c863cfa422133890dafe0b098576d4a7e5481eacb1d2da7f70447e87c73e418c92e6ddf7a0cff0739399b721ed6ecc516ce22c2934e805536961cf678f36fbeb66fb219cf2e3a0e45044866d6009cb13a4a34af4f5676840d24f8fd8eadd24c276028bcc3cc8515c7a49fd4cef2bfa53a3f8bd7de780b51b16115d7e1b0665a8e965bd7adf1080e6587fd5d8e76ce8a72745ae4d56ee5926110b5994ff43c98432448e1093e2834cd048089711faea923a01765eba787ac120f73284cfb09fca6b7f28db4e0ce7106950fbd68de9bd196ab1f9d4e9f56c66675f7656d3dfc65d4355bb5744b7918dbde906473b25ef1707dda7dec5e7c4a24df3ffd12dcf5acd44dcb80b5ddccaf49571fd4f5aa59f9042fc47139b99f90fbcee62d4e206418c2ee88c370c6066f583c725af589399497939a4894822ad0fbf547a4447f10638bf5997c06dc94431513d6c918872652cf107dedabccb9f3191f8d0fb151be2f9ba4248009dec2d1799ebe37f847182989e41c15517e9d348ad3707a6f5df967a73791ea45b1464c66f8997e1e8012c8c0bfb9b09c69a62d7c058269f90d9d4c60d4baa8dc771ff6f30935f68145c86d7fea084d72b91e33a81c4bf4d8afe29098de3980d98517a47229d9a2603bb1952d036e7e6962b2e13da917e0be505d85621325b38df1dad7bd441b10ff1e99287e58ee1735a3b40e7e37679eded2d35ee2f6582e0b2bc9b1b33b838ae2f5e1ede97a615915da185beae9f5e88b6384b217e5dd35affcbd7a39449231a8448f081f5452879347714ab305c574ce4371a9e2bd676fd06388fa2d9c426155ef250b37aee978b92c40549347bd24c2dcb072d8fc0ab00eef45c79309c025572eac2c741d9eef9d3776c9d5b1872aabdc6fe147f7b386225085d66e26559f414c130025ca0a3538d6068cd283ff12718e4ec93872d988ded677eb31c46c687a95bed796a58409ff52fb2d1bfc06b4945381efdda8a6cc19f7cee5d847f11ae798451cd024b60808e4d6c91597f1cb52d686302b78db1c6f717118792af6a6678ceadff9ccf80b1273943bf862ed5b052ba6ec5cc739e7555dd881030eb0e8ae7d8c06fefa5c33d582c7ebc13653d075ece29895ebf81649d44b2ef0eaa76ec717351b5d37731bc4f6c313e030aa0f7f94ba534d6b19c6d31c505d29437a49371d44f217cd2b53be5cadadd95d99654e5b8c0959032f9f5675cb89bba32cb2df1cc5b4a2ad7d4479ae80318689371e55bb376f1afcd11fb5a396cf06580c7cb3d5710774e23048085d2171cbb5caaa1e61bfaf05cf461101cd191b90b94d079997d10dd9a660854598c9910abec42dba28b55a8bcb358dd8b22474bbda23ff0bbc7d1bc3e9cdf84aa72c59b958b25068d0ffec54720f0bb94f214db1bf06104b659f46ffe539677615aeed2dfb94ffa404c94ba4a465c472326a97352e596ea0cd9926d65504aca06391809d5ef39988911e14e5388b35b8ed374a059ad8b40c37721f9c045a6178fcc588c818cb65cf249ca72e82eb011d9fde7067fb41991e18cd38ac2b824f7a971ade8490d2492c0a7c37e86ffb267f780e50e96ce87c5b20397573ba5c35696ed1b673a19ba81653deedaa7fd31d312718c97628caef52e4c356c36d84745726fe49d4cbccdac0257f53b4ec4200ab91474f0e1e272089337cf74def47ff3d4221ac634dde1fd45a1ab9f9d4667f748b506c9acad42b4c665529781abad2c54f8c0a263304dfdb7b9dc503777fe048c07d9a700ef803ac8be125b65ea737d1cfcc03d1a0c1879e8a2ec7c9c96e184dfdf0d0b18a641f8562dc6fe128ae55277d5f86834be2fdb222ad66df7d111ea46f4979d89e69db21ddbdfe399b40841a9fb65cd207562b8a9277ad886710c9d2ea153eb3cebf22e2a9f49664268e0d74a1dbd6d3455656c4c50519ffe612d7ad53181ddd457980c6a8117b324493c0b93753cf973d4d5e594db8df616bc09619b49dc2912b0062cf4b7f2c151d9ba813f44b090a20283a741d3810c1ed345780b784279d4f14f3e805178710e03ff05d594f20ac9773657c054cc5fa7d7e9e7508dbdd5f9ff0bd2caa1ebd677728d01df4cce6e5d1e939e683c56026493a70765c1e825232afc8a54c8312a733cf884d7a3249404aa906655c2ae6f4fc7fb904faeb6cbd1eb86b2f7f88087e2a5eb3a1078efb8f75b81e483abd683b16b677175be20b50b73afeba3f4e71509d756bc5d0b902d29aeed2ac21ba0260489709c33bdd681be817919129d96782b1de96df71d7333a58be5327bbe5a93ac9fb004fdf3910f53cb3f7146dfbdb7ef492b34b3ee3b57cd0df0211e4bcf6a3bd7a4cbdf081695a6ff15985db5d54e3bbdd4992df3d65db5c80cf875be29daf002eb947f264a3045bc946534145e44c442cbefe9b9608b87f98310e543d0ff70c16af786baa289d8503de95b58ab07056a2d80d46bf5f8eeb4807010b87b93d3a945a0736ce431fa0b14c1eb9da98ddaacd919774a5e35e2f0d6fee24a037fee9447b1984c94057776b3249d24368c63cfbad0b36a74eaa9b2e8cb53a2981ecd4a9c33f017429c663a10484ad642582e5e97bc6a356184e5587066a580441f8c08dce2c436b3911ca9e9b5e8d477061177078c99f3faf18ed6fb61bcff19330f0ca1c84c05288cd9e6843b6042bd6d1e92f128d9f55cc5ce83a7629c1c4cb589013472284b8bc43d6ac00dfcfd2f691e43184dc744d6360a09b8bec0d78d5bbf475a033a80de1248a7f63798be256c43d1d936b13c947f85aa29e1b586b35da5f2bda0206b9734e31f06ed91fcf6f448adccfe6dc3b4155dae36d1c5e94ec1c30fcbc8cab19407a9f5e07528027acd6c8e2b85e423fd86337eb355956ca9c7612024e492bac43326312f57505bbb1282ee9a1c458b575d7dadce74786a84de634db60b5d703f6eeab485b36d3e780f905a4b7c80bf859fbafad87884a0d8a7ebd566fd7d525b84afe1e3c42fd6abb85b848cb486e8cbb73cac103e779643c7cd0c08573a4fbeccdc1488f25a3c86fcd8fa47b2403cbe20e75bca07e736c56fd9860366e6faab67397d6e4a568432568cdfbe917eb878b4732b9482299d2433f38ee04b0b9dc695b88422cb5c574fb978a8b55220aeb4849d2eda72f5f352d20bf4d5d72a434ce84ac51c6fc0723da3a7d126708e5cc26442d3412439606731cbed79ab0683585b15724793869a378a7f98a8f9bca00e4ad0b6ee563451dd6acf5822aaac2f544243c8e3e769f4b06e0a2c0f0e9ef2454b2da941159a215a2cd3ece520d7e81430aeba9629cc23718a4891ce8b7753692e226a25956be8d24cb9d6fabfe864f080aacebbc3162e2eb353c4efde48dc883d7585e0c60e33559a4ca33525001aee422eefd1ae63ae23a79688dcbbc1af3a687ec5e0dc94f25a5346752e38c982d9255af7a314de298ff3ce71436e9c487f90c0a9e413cb9aa3be5f68c182c73149945e5ce07d56a0a335abfb1b793f068f546cb3e6deca768a5fc61a710157493b8d6a21693ab4b3607164fc1caecd86081a6bf127b98c0d27c6a5db434fbb192100ce02e03d2269ca8575e43b40f0dcb96364cd31076a14f5f6d2d99be37a9bb257f2c7ed861459be213ba98ed4e640aed9ed6ca9996d1d515661c7cc30793527296b3397d2129115a3daa0ea53e38bfe71dee48c5c121be53499145a983c0c5b122303e04d98e5b53edbe45bdfe3e5eb24ff5d245030bff68fd377a981980d10ae6fa4dd3121ca45d788e6bf7bb057786ceffc634918e88c86f44d943a2c011d241c04784d1b0d02ebae92f1aef74f22931f337028b5b6d07bc8356fc0c0f8cc2e72a46e13e97652ff42eb1c486b92e985416e9b58149a677141b35255c9fed26b68f5a5401b517263590ecdb13e166922e935295071792339f8686303a978ee4197d93c7e3ebe64b4a5636cc10834ce942b63850adb469cbd14553047deb67271e887988d5fbacd6e9f872cbb922e1f5085cc39e379672cc9161180b8173228f99f0adc6a0cabc1f92787385a8c3c996afcad58d03379c3e190534bf1d63ce613e4267812f64aa664cc420d16394a562bc81159159f75508597fe8e070e37282fece3458d45e02e00bbe3854774de583d58b0b977527cf718c36e079763c58827268626306c8972d518c3d80b8d952f3f8f4199e436ed5abcc1a952da13e7d0cc62daf78656e369243fb814b79d493541b4536a7d463f109fa278111d625ad51775121dff073741fefa1e6f13040366513149d1393376a5b9d987469634173bc31a8c4a087a016cf1aa3bd6ff4c2809afeb7ced0719e17dc31d67e634f352c92cf10ce0dcaa7e7b48b82fcf6f4d6d0ade25ce666303ea19948810898404cdbc8a72ef07ed96dad890c533c04d3e204c94eac7c36977337166d46bd7f474ae3d686cddeb7b39fdff38c6cc943cce90a04be1152ee226ec40793e672587b1eca249f2b5986e6f5d978c2e25d27548bc11159c967cb3ab96368fc88713ff7c9b07c471f083cc09681fd1b9aec1ea226137660bb2e3384b52be0bea725b1417e8a853436f8f32c9eb2c35a01d8835bfff0ccf2a862b27464d733d9ce939acc4adf8a4e691848c488c16988562f3c275dbc6c513d85c35e894bd364b8e589b1522278355a996ec473661534cca353ee656ab5af78ab400bf4b7c352719fb97f718567c535a90d67e6be1bfae3aaf52c7dcd80b9b8c65f47612f0bdfc0a85986e1fd873d3ca0f81b4764d72a256c2c89a6df0a5bf9c3f7966b914d0f9283669c62d62e46d26450227dbe817ca402ddf28424269cbf2e7c6c1d6ba138ef61372f2400288d279a38d9df45ae0006b23b8b6d13c27152c9812d59b26ad9daeddeaa770b5b01f7800885e6c8f5e1700e2a03b16050372cac0b645cc4ab02504a0982708751b8d83c5d983f2b68b4df888945f6e1470659c842ea81a71c3332f24966ce72ef9b36f147007744d2e202131ae8b1deb5055a008d7083fa5da078cf95787fd02ed4b3908c8bf5a6ad5f9249ae5314562b6c5ef8dccdaa2f223fd9ea44925b6230e35ee110be4296fbced3bd198e02d5a0acfbed7d6168e0b8437c05712ac9cf44d1eb88c6c2bb810eadb6b1e8a9cd5700abca40443f75a2f27f9e9ecf6dfd5310a310aa4ba7ad3abbf0bcf288392cfdc4e615a2e5ee4a49e057eb0752132f26f3375acce92443d1f73435d6660e0fd1e275738dda677b688e3f089ef2885725baf161d192fecae2bece05dfc1c0bf405a077e3e178bccfd364caeff5564e787e72e15d46fab34505107dba406e28c7545631bb66ebc6c46bf5f373803a8001b70725fe0af38c3fa69fe806a46c537dfdcb8f2f22c0073e0416b63421ad4992e25d40d86c124028115e89c8771cb9be640ea02f72541b7d6654485539b2ced998a526542157b806d8924085d4644832864d946115575857660ba527e89646d8d2419b544b20622c2790e62b82ccee736108257aee7401e9ee5c79330733acc3", 0x1000) r5 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_RUN(r6, 0x4004ae8b, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x200000, 0x0) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$FICLONE(r6, 0x40049409, r7) dup2(r0, r1) 21:14:26 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, 0xffffffffffffffff) 21:14:26 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 316.711498][T16064] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 316.730266][T16064] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 316.764074][T16064] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 316.805054][T16072] input: syz1 as /devices/virtual/input/input146 21:14:27 executing program 3 (fault-call:11 fault-nth:13): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) [ 316.864419][T16064] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated 21:14:27 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8", 0x4b}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 316.966182][T16064] EXT4-fs (loop0): get root inode failed [ 316.972070][T16064] EXT4-fs (loop0): mount failed [ 316.993871][T16079] input: syz1 as /devices/virtual/input/input147 21:14:27 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e41"], 0x95}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:27 executing program 4 (fault-call:4 fault-nth:0): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 317.136090][T16095] FAULT_INJECTION: forcing a failure. [ 317.136090][T16095] name failslab, interval 1, probability 0, space 0, times 0 [ 317.220904][T16095] CPU: 0 PID: 16095 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 317.228891][T16095] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 317.238951][T16095] Call Trace: [ 317.242261][T16095] dump_stack+0x172/0x1f0 [ 317.246616][T16095] should_fail.cold+0xa/0x15 [ 317.252956][T16095] ? fault_create_debugfs_attr+0x180/0x180 [ 317.261758][T16095] ? ___might_sleep+0x163/0x2c0 [ 317.261781][T16095] __should_failslab+0x121/0x190 [ 317.261800][T16095] should_failslab+0x9/0x14 [ 317.261819][T16095] kmem_cache_alloc_node_trace+0x274/0x750 [ 317.261836][T16095] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 317.261854][T16095] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 317.293763][T16095] __kmalloc_node_track_caller+0x3d/0x70 [ 317.299411][T16095] __kmalloc_reserve.isra.0+0x40/0xf0 [ 317.304800][T16095] __alloc_skb+0x10b/0x5e0 [ 317.304822][T16095] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 317.304840][T16095] ? raw_getfrag+0x164/0x230 [ 317.304855][T16095] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 317.304881][T16095] __ip_append_data.isra.0+0x2667/0x30d0 [ 317.319514][T16095] ? raw_destroy+0x30/0x30 [ 317.319543][T16095] ? __lock_acquire+0x16f2/0x4a00 [ 317.319570][T16095] ? __ip_flush_pending_frames.isra.0+0x2d0/0x2d0 [ 317.319589][T16095] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 317.319606][T16095] ? ip_setup_cork+0x59c/0x8e0 [ 317.330927][T16095] ? raw_destroy+0x30/0x30 [ 317.362717][T16095] ip_append_data.part.0+0xf2/0x170 [ 317.367925][T16095] ? raw_destroy+0x30/0x30 [ 317.372959][T16095] ip_append_data+0x6e/0x90 [ 317.377520][T16095] raw_sendmsg+0xba8/0x2f40 [ 317.382054][T16095] ? dst_output+0x170/0x170 [ 317.386586][T16095] ? lock_downgrade+0x920/0x920 [ 317.392316][T16095] ? __kasan_check_write+0x14/0x20 [ 317.397455][T16095] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 317.403709][T16095] ? aa_label_sk_perm+0x91/0xf0 [ 317.408673][T16095] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 317.414318][T16095] ? aa_sk_perm+0x288/0x880 21:14:27 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 317.418827][T16095] ? __kasan_check_read+0x11/0x20 [ 317.423869][T16095] ? __lock_acquire+0x8a0/0x4a00 [ 317.428905][T16095] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 317.434464][T16095] inet_sendmsg+0x9e/0xe0 [ 317.438809][T16095] ? inet_sendmsg+0x9e/0xe0 [ 317.443424][T16095] ? inet_send_prepare+0x4f0/0x4f0 [ 317.448572][T16095] sock_sendmsg+0xd7/0x130 [ 317.452998][T16095] kernel_sendmsg+0x44/0x50 [ 317.458725][T16095] sock_no_sendpage+0x116/0x150 [ 317.463585][T16095] ? sock_kzfree_s+0x70/0x70 [ 317.468201][T16095] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 317.474449][T16095] inet_sendpage+0x10f/0x150 [ 317.479048][T16095] kernel_sendpage+0x92/0xf0 [ 317.483643][T16095] ? inet_sendmsg+0xe0/0xe0 [ 317.488169][T16095] sock_sendpage+0x8b/0xc0 [ 317.492600][T16095] pipe_to_sendpage+0x296/0x360 [ 317.497455][T16095] ? kernel_sendpage+0xf0/0xf0 [ 317.502229][T16095] ? direct_splice_actor+0x190/0x190 [ 317.507623][T16095] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 317.514073][T16095] ? anon_pipe_buf_release+0x1c6/0x270 [ 317.520067][T16095] __splice_from_pipe+0x397/0x7d0 [ 317.525102][T16095] ? direct_splice_actor+0x190/0x190 [ 317.530405][T16095] ? direct_splice_actor+0x190/0x190 [ 317.535687][T16095] splice_from_pipe+0x108/0x170 [ 317.535709][T16095] ? splice_shrink_spd+0xd0/0xd0 [ 317.535732][T16095] ? apparmor_file_permission+0x25/0x30 [ 317.535750][T16095] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 317.535767][T16095] ? security_file_permission+0x8f/0x380 [ 317.535789][T16095] generic_splice_sendpage+0x3c/0x50 [ 317.535803][T16095] ? splice_from_pipe+0x170/0x170 [ 317.535820][T16095] do_splice+0x708/0x1410 [ 317.535855][T16095] ? opipe_prep.part.0+0x2e0/0x2e0 [ 317.535876][T16095] ? __fget_light+0x1a9/0x230 [ 317.535895][T16095] __x64_sys_splice+0x2c6/0x330 [ 317.535917][T16095] do_syscall_64+0xfa/0x760 [ 317.551236][T16095] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 317.551249][T16095] RIP: 0033:0x459a59 [ 317.551266][T16095] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 317.551274][T16095] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 317.551289][T16095] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 317.551297][T16095] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 317.551306][T16095] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 317.551314][T16095] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 21:14:27 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x2) [ 317.551328][T16095] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 [ 317.704254][T16105] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 317.724206][T16105] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 317.748132][T16105] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 317.759181][T16091] input: syz1 as /devices/virtual/input/input151 [ 317.800855][T16118] input: syz1 as /devices/virtual/input/input152 [ 317.807599][T16105] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated [ 317.851741][T16105] EXT4-fs (loop0): get root inode failed [ 317.871590][T16105] EXT4-fs (loop0): mount failed 21:14:28 executing program 3 (fault-call:11 fault-nth:14): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:14:28 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) r2 = syz_open_dev$midi(&(0x7f00000009c0)='/dev/midi#\x00', 0x6, 0x8080) getsockopt$inet_sctp_SCTP_INITMSG(r2, 0x84, 0x2, &(0x7f0000000a00), &(0x7f0000000a40)=0x8) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r3, 0x0, 0x0, 0x0) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) bind$inet(r4, &(0x7f0000000480)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r4, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x24e23, @local}, 0x10) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r4, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) write$binfmt_elf64(r4, &(0x7f00000000c0)=ANY=[@ANYRES64], 0xc63b9e35) ioctl$sock_kcm_SIOCKCMCLONE(r3, 0x89e2, &(0x7f0000000080)={r4}) getsockopt$netrom_NETROM_T4(r5, 0x103, 0x6, &(0x7f00000000c0)=0x6, &(0x7f0000000100)=0x4) 21:14:28 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r1, 0x0, 0x0, 0x0) ioctl$UI_SET_MSCBIT(r1, 0x40045568, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_RUN(r4, 0x4004ae8b, 0x0) ioctl$FITRIM(r4, 0xc0185879, &(0x7f0000000140)={0x80, 0x1ff, 0x3}) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r5, 0x0, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r5, 0x54a0) r6 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r6) 21:14:28 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8", 0x4b}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 318.042343][T16131] FAULT_INJECTION: forcing a failure. [ 318.042343][T16131] name failslab, interval 1, probability 0, space 0, times 0 [ 318.093679][T16131] CPU: 1 PID: 16131 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 318.102321][T16131] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 318.112459][T16131] Call Trace: [ 318.112484][T16131] dump_stack+0x172/0x1f0 [ 318.112506][T16131] should_fail.cold+0xa/0x15 [ 318.112529][T16131] ? fault_create_debugfs_attr+0x180/0x180 [ 318.131211][T16131] ? ___might_sleep+0x163/0x2c0 [ 318.136075][T16131] __should_failslab+0x121/0x190 [ 318.141044][T16131] should_failslab+0x9/0x14 [ 318.146513][T16131] kmem_cache_alloc_node+0x268/0x740 [ 318.151806][T16131] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 318.158051][T16131] ? ip_generic_getfrag+0x120/0x230 [ 318.163279][T16131] __alloc_skb+0xd5/0x5e0 [ 318.167624][T16131] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 318.173180][T16131] ? raw_getfrag+0x164/0x230 [ 318.177811][T16131] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 318.183637][T16131] __ip_append_data.isra.0+0x2667/0x30d0 [ 318.189278][T16131] ? raw_destroy+0x30/0x30 [ 318.193686][T16131] ? __lock_acquire+0x16f2/0x4a00 [ 318.198710][T16131] ? __ip_flush_pending_frames.isra.0+0x2d0/0x2d0 [ 318.205234][T16131] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 318.211459][T16131] ? ip_setup_cork+0x59c/0x8e0 [ 318.216219][T16131] ? raw_destroy+0x30/0x30 [ 318.220639][T16131] ip_append_data.part.0+0xf2/0x170 [ 318.225833][T16131] ? raw_destroy+0x30/0x30 [ 318.231465][T16131] ip_append_data+0x6e/0x90 [ 318.235966][T16131] raw_sendmsg+0xba8/0x2f40 [ 318.240500][T16131] ? dst_output+0x170/0x170 [ 318.244999][T16131] ? lock_downgrade+0x920/0x920 [ 318.250640][T16131] ? __kasan_check_write+0x14/0x20 [ 318.255764][T16131] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 318.261991][T16131] ? aa_label_sk_perm+0x91/0xf0 [ 318.266841][T16131] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 318.272455][T16131] ? aa_sk_perm+0x288/0x880 [ 318.276940][T16131] ? __kasan_check_read+0x11/0x20 [ 318.281961][T16131] ? __lock_acquire+0x8a0/0x4a00 [ 318.286886][T16131] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 318.292421][T16131] inet_sendmsg+0x9e/0xe0 [ 318.296744][T16131] ? inet_sendmsg+0x9e/0xe0 [ 318.301228][T16131] ? inet_send_prepare+0x4f0/0x4f0 [ 318.306324][T16131] sock_sendmsg+0xd7/0x130 [ 318.311075][T16131] kernel_sendmsg+0x44/0x50 [ 318.315567][T16131] sock_no_sendpage+0x116/0x150 [ 318.320487][T16131] ? sock_kzfree_s+0x70/0x70 [ 318.325091][T16131] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 318.331319][T16131] inet_sendpage+0x10f/0x150 [ 318.335915][T16131] kernel_sendpage+0x92/0xf0 [ 318.340490][T16131] ? inet_sendmsg+0xe0/0xe0 [ 318.344981][T16131] sock_sendpage+0x8b/0xc0 [ 318.349400][T16131] pipe_to_sendpage+0x296/0x360 [ 318.354249][T16131] ? kernel_sendpage+0xf0/0xf0 [ 318.358996][T16131] ? direct_splice_actor+0x190/0x190 [ 318.364277][T16131] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 318.370500][T16131] ? anon_pipe_buf_release+0x1c6/0x270 [ 318.375999][T16131] __splice_from_pipe+0x397/0x7d0 [ 318.381108][T16131] ? direct_splice_actor+0x190/0x190 [ 318.386384][T16131] ? direct_splice_actor+0x190/0x190 [ 318.391657][T16131] splice_from_pipe+0x108/0x170 [ 318.396507][T16131] ? splice_shrink_spd+0xd0/0xd0 [ 318.401452][T16131] ? apparmor_file_permission+0x25/0x30 [ 318.406997][T16131] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 318.413221][T16131] ? security_file_permission+0x8f/0x380 [ 318.418865][T16131] generic_splice_sendpage+0x3c/0x50 [ 318.424150][T16131] ? splice_from_pipe+0x170/0x170 [ 318.429374][T16131] do_splice+0x708/0x1410 [ 318.433709][T16131] ? opipe_prep.part.0+0x2e0/0x2e0 [ 318.438818][T16131] ? __fget_light+0x1a9/0x230 [ 318.443483][T16131] __x64_sys_splice+0x2c6/0x330 [ 318.448324][T16131] do_syscall_64+0xfa/0x760 [ 318.452818][T16131] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 318.458866][T16131] RIP: 0033:0x459a59 [ 318.462760][T16131] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 318.482347][T16131] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 21:14:28 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e41"], 0x95}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) [ 318.490741][T16131] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 318.498698][T16131] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 318.506669][T16131] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 318.514634][T16131] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 318.523471][T16131] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 21:14:28 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x10) [ 318.683431][T16149] input: syz1 as /devices/virtual/input/input155 [ 318.720429][T16137] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 318.772120][T16137] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 318.782591][T16132] input input156: cannot allocate more than FF_MAX_EFFECTS effects [ 318.790915][T16137] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock 21:14:28 executing program 3 (fault-call:11 fault-nth:15): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) [ 318.820403][T16137] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated [ 318.839467][T16137] EXT4-fs (loop0): get root inode failed [ 318.848338][T16137] EXT4-fs (loop0): mount failed 21:14:29 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$adsp(&(0x7f0000000100)='/dev/adsp#\x00', 0x8, 0x110080) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r3, 0x0, 0x0, 0x0) r4 = syz_open_dev$media(&(0x7f0000000240)='/dev/media#\x00', 0x8990, 0x800) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_IRQFD(r6, 0x4020ae76, &(0x7f0000000280)={r4, 0x4, 0x3}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:29 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e41"], 0x95}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:29 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x227c) [ 319.015159][T16165] FAULT_INJECTION: forcing a failure. [ 319.015159][T16165] name failslab, interval 1, probability 0, space 0, times 0 21:14:29 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 319.090583][T16165] CPU: 1 PID: 16165 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 319.098526][T16165] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 319.108588][T16165] Call Trace: [ 319.111895][T16165] dump_stack+0x172/0x1f0 [ 319.116239][T16165] should_fail.cold+0xa/0x15 [ 319.120844][T16165] ? fault_create_debugfs_attr+0x180/0x180 [ 319.126753][T16165] ? ___might_sleep+0x163/0x2c0 [ 319.131623][T16165] __should_failslab+0x121/0x190 [ 319.136789][T16165] should_failslab+0x9/0x14 [ 319.141297][T16165] kmem_cache_alloc_node_trace+0x274/0x750 [ 319.147115][T16165] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 319.153095][T16165] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 319.153121][T16165] __kmalloc_node_track_caller+0x3d/0x70 [ 319.153142][T16165] __kmalloc_reserve.isra.0+0x40/0xf0 [ 319.170732][T16165] __alloc_skb+0x10b/0x5e0 [ 319.175515][T16165] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 319.175532][T16165] ? raw_getfrag+0x164/0x230 [ 319.175548][T16165] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 319.175568][T16165] __ip_append_data.isra.0+0x2667/0x30d0 [ 319.175595][T16165] ? raw_destroy+0x30/0x30 [ 319.191423][T16165] ? __lock_acquire+0x16f2/0x4a00 [ 319.191451][T16165] ? __ip_flush_pending_frames.isra.0+0x2d0/0x2d0 [ 319.191473][T16165] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 319.191486][T16165] ? ip_setup_cork+0x59c/0x8e0 [ 319.191505][T16165] ? raw_destroy+0x30/0x30 [ 319.201542][T16165] ip_append_data.part.0+0xf2/0x170 [ 319.201565][T16165] ? raw_destroy+0x30/0x30 [ 319.201582][T16165] ip_append_data+0x6e/0x90 [ 319.201604][T16165] raw_sendmsg+0xba8/0x2f40 [ 319.201630][T16165] ? dst_output+0x170/0x170 [ 319.219278][T16165] ? lock_downgrade+0x920/0x920 [ 319.219297][T16165] ? __kasan_check_write+0x14/0x20 [ 319.219331][T16165] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 319.219346][T16165] ? aa_label_sk_perm+0x91/0xf0 [ 319.219367][T16165] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 319.234043][T16165] ? aa_sk_perm+0x288/0x880 [ 319.234059][T16165] ? __kasan_check_read+0x11/0x20 [ 319.234075][T16165] ? __lock_acquire+0x8a0/0x4a00 [ 319.234095][T16165] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 319.234116][T16165] inet_sendmsg+0x9e/0xe0 [ 319.234132][T16165] ? inet_sendmsg+0x9e/0xe0 [ 319.247509][T16165] ? inet_send_prepare+0x4f0/0x4f0 [ 319.247528][T16165] sock_sendmsg+0xd7/0x130 [ 319.247547][T16165] kernel_sendmsg+0x44/0x50 [ 319.247564][T16165] sock_no_sendpage+0x116/0x150 [ 319.247582][T16165] ? sock_kzfree_s+0x70/0x70 [ 319.252191][T16169] input: syz1 as /devices/virtual/input/input160 [ 319.256921][T16165] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 319.256940][T16165] inet_sendpage+0x10f/0x150 [ 319.256961][T16165] kernel_sendpage+0x92/0xf0 [ 319.256973][T16165] ? inet_sendmsg+0xe0/0xe0 [ 319.256990][T16165] sock_sendpage+0x8b/0xc0 [ 319.257010][T16165] pipe_to_sendpage+0x296/0x360 [ 319.268341][T16165] ? kernel_sendpage+0xf0/0xf0 [ 319.268361][T16165] ? direct_splice_actor+0x190/0x190 [ 319.268383][T16165] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 319.268398][T16165] ? anon_pipe_buf_release+0x1c6/0x270 [ 319.268417][T16165] __splice_from_pipe+0x397/0x7d0 [ 319.268438][T16165] ? direct_splice_actor+0x190/0x190 [ 319.294650][T16165] ? direct_splice_actor+0x190/0x190 [ 319.294668][T16165] splice_from_pipe+0x108/0x170 [ 319.294688][T16165] ? splice_shrink_spd+0xd0/0xd0 [ 319.294711][T16165] ? apparmor_file_permission+0x25/0x30 [ 319.294730][T16165] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 319.294743][T16165] ? security_file_permission+0x8f/0x380 [ 319.294763][T16165] generic_splice_sendpage+0x3c/0x50 [ 319.441162][T16165] ? splice_from_pipe+0x170/0x170 [ 319.446178][T16165] do_splice+0x708/0x1410 [ 319.450518][T16165] ? opipe_prep.part.0+0x2e0/0x2e0 [ 319.455622][T16165] ? __fget_light+0x1a9/0x230 [ 319.460288][T16165] __x64_sys_splice+0x2c6/0x330 [ 319.465132][T16165] do_syscall_64+0xfa/0x760 [ 319.469626][T16165] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 319.475517][T16165] RIP: 0033:0x459a59 [ 319.479405][T16165] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 319.499008][T16165] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 319.507842][T16165] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 319.515801][T16165] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 319.524022][T16165] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 319.531991][T16165] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 319.539959][T16165] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 [ 319.590034][T16171] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock 21:14:29 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8", 0x4b}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 319.638307][T16186] input: syz1 as /devices/virtual/input/input161 [ 319.644490][T16171] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 319.711442][T16171] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 319.753361][T16171] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated 21:14:29 executing program 3 (fault-call:11 fault-nth:16): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) [ 319.789128][T16171] EXT4-fs (loop0): get root inode failed [ 319.806765][T16171] EXT4-fs (loop0): mount failed [ 319.840863][T16169] input: syz1 as /devices/virtual/input/input163 21:14:30 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) bind$inet(r0, &(0x7f0000000480)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x24e23, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000100), 0x4) recvmsg(r0, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) write$binfmt_elf64(r0, &(0x7f00000000c0)=ANY=[@ANYRES64], 0xc63b9e35) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0, 0x0}, &(0x7f0000000180)=0xc) r2 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f00000014c0)={0x0, 0x0, 0x0}, &(0x7f0000001480)=0xc) setregid(0xee01, r3) setregid(r1, r3) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r4, 0x5501, 0x0) r5 = syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0xd717, 0x20000) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r6, 0x0, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r6, 0x40345410, &(0x7f00000000c0)={{0x1, 0x7, 0x0, 0x2, 0xfefe}}) r7 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r4, 0x5502) ioctl$PPPIOCSCOMPRESS(r5, 0x4010744d) dup2(r4, r7) 21:14:30 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x800, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000400)='autogroup\x00') pread64(r3, 0x0, 0x0, 0x0) ioctl$EVIOCGLED(r3, 0x80404519, &(0x7f0000000100)=""/123) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r4, 0x0, 0x0, 0x0) ioctl$TIOCSSERIAL(r4, 0x541f, &(0x7f0000000240)={0x81, 0x0, 0x6, 0x696c, 0x8, 0x839, 0x6, 0x6, 0x0, 0xd0, 0x16, 0x557b, 0x7, 0x33b, &(0x7f0000000180)=""/87, 0x81, 0x401, 0x34b}) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r5, 0x0, 0x0, 0x0) ioctl$UI_SET_EVBIT(r5, 0x40045564, 0x13) ioctl$SG_SET_TIMEOUT(r3, 0x2201, &(0x7f0000000440)=0x3ff) r6 = dup2(r0, r1) r7 = accept4$bt_l2cap(r6, &(0x7f00000002c0), &(0x7f0000000300)=0xe, 0x400) lstat(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r7, 0xee00, r8) 21:14:30 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8d"], 0x99}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:30 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x4c00) [ 320.095286][T16208] FAULT_INJECTION: forcing a failure. [ 320.095286][T16208] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 320.108550][T16208] CPU: 1 PID: 16208 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 320.117227][T16208] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 320.127303][T16208] Call Trace: [ 320.127326][T16208] dump_stack+0x172/0x1f0 [ 320.127350][T16208] should_fail.cold+0xa/0x15 [ 320.127369][T16208] ? fault_create_debugfs_attr+0x180/0x180 [ 320.127389][T16208] ? __kasan_check_read+0x11/0x20 [ 320.135017][T16208] ? __lock_acquire+0x16f2/0x4a00 [ 320.145381][T16208] ? __ip_append_data.isra.0+0x2667/0x30d0 [ 320.145405][T16208] should_fail_alloc_page+0x50/0x60 [ 320.145420][T16208] __alloc_pages_nodemask+0x1a1/0x900 [ 320.145436][T16208] ? fs_reclaim_acquire.part.0+0x30/0x30 [ 320.145451][T16208] ? __alloc_pages_slowpath+0x2910/0x2910 [ 320.145465][T16208] ? fs_reclaim_acquire.part.0+0x30/0x30 [ 320.145490][T16208] ? fault_create_debugfs_attr+0x180/0x180 [ 320.171890][T16208] cache_grow_begin+0x90/0xd20 [ 320.171910][T16208] ? __kmalloc_node_track_caller+0x3d/0x70 [ 320.171929][T16208] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 320.171949][T16208] kmem_cache_alloc_node_trace+0x689/0x750 [ 320.171975][T16208] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 320.184082][T16208] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 320.184109][T16208] __kmalloc_node_track_caller+0x3d/0x70 [ 320.184130][T16208] __kmalloc_reserve.isra.0+0x40/0xf0 [ 320.184148][T16208] __alloc_skb+0x10b/0x5e0 [ 320.184165][T16208] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 320.184188][T16208] ? raw_getfrag+0x164/0x230 [ 320.195601][T16208] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 320.195625][T16208] __ip_append_data.isra.0+0x2667/0x30d0 [ 320.195648][T16208] ? raw_destroy+0x30/0x30 [ 320.195667][T16208] ? __lock_acquire+0x16f2/0x4a00 [ 320.195692][T16208] ? __ip_flush_pending_frames.isra.0+0x2d0/0x2d0 [ 320.195712][T16208] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 320.195731][T16208] ? ip_setup_cork+0x59c/0x8e0 [ 320.212520][T16208] ? raw_destroy+0x30/0x30 [ 320.212540][T16208] ip_append_data.part.0+0xf2/0x170 [ 320.212561][T16208] ? raw_destroy+0x30/0x30 [ 320.212578][T16208] ip_append_data+0x6e/0x90 [ 320.212605][T16208] raw_sendmsg+0xba8/0x2f40 [ 320.241151][T16208] ? dst_output+0x170/0x170 [ 320.241175][T16208] ? lock_downgrade+0x920/0x920 [ 320.241202][T16208] ? __kasan_check_write+0x14/0x20 [ 320.241234][T16208] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 320.241254][T16208] ? aa_label_sk_perm+0x91/0xf0 [ 320.267200][T16208] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 320.287829][T16215] input: syz1 as /devices/virtual/input/input167 [ 320.289248][T16208] ? aa_sk_perm+0x288/0x880 [ 320.289264][T16208] ? __kasan_check_read+0x11/0x20 [ 320.289280][T16208] ? __lock_acquire+0x8a0/0x4a00 [ 320.289300][T16208] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 320.289321][T16208] inet_sendmsg+0x9e/0xe0 [ 320.317389][T16208] ? inet_sendmsg+0x9e/0xe0 [ 320.322355][T16212] input: syz1 as /devices/virtual/input/input165 [ 320.326705][T16208] ? inet_send_prepare+0x4f0/0x4f0 [ 320.326725][T16208] sock_sendmsg+0xd7/0x130 [ 320.326745][T16208] kernel_sendmsg+0x44/0x50 [ 320.326764][T16208] sock_no_sendpage+0x116/0x150 [ 320.326779][T16208] ? sock_kzfree_s+0x70/0x70 [ 320.326813][T16208] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 320.326831][T16208] inet_sendpage+0x10f/0x150 [ 320.354926][T16208] kernel_sendpage+0x92/0xf0 [ 320.354944][T16208] ? inet_sendmsg+0xe0/0xe0 [ 320.369396][T16208] sock_sendpage+0x8b/0xc0 [ 320.369420][T16208] pipe_to_sendpage+0x296/0x360 [ 320.369437][T16208] ? kernel_sendpage+0xf0/0xf0 [ 320.369455][T16208] ? direct_splice_actor+0x190/0x190 [ 320.369477][T16208] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 320.369493][T16208] ? anon_pipe_buf_release+0x1c6/0x270 [ 320.369513][T16208] __splice_from_pipe+0x397/0x7d0 [ 320.369529][T16208] ? direct_splice_actor+0x190/0x190 [ 320.369550][T16208] ? direct_splice_actor+0x190/0x190 [ 320.391013][T16208] splice_from_pipe+0x108/0x170 [ 320.400687][T16208] ? splice_shrink_spd+0xd0/0xd0 [ 320.400712][T16208] ? apparmor_file_permission+0x25/0x30 [ 320.400732][T16208] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 320.400749][T16208] ? security_file_permission+0x8f/0x380 [ 320.400772][T16208] generic_splice_sendpage+0x3c/0x50 [ 320.400788][T16208] ? splice_from_pipe+0x170/0x170 [ 320.400808][T16208] do_splice+0x708/0x1410 [ 320.410136][T16208] ? opipe_prep.part.0+0x2e0/0x2e0 [ 320.410157][T16208] ? __fget_light+0x1a9/0x230 [ 320.410179][T16208] __x64_sys_splice+0x2c6/0x330 [ 320.410205][T16208] do_syscall_64+0xfa/0x760 [ 320.410228][T16208] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 320.410240][T16208] RIP: 0033:0x459a59 [ 320.410254][T16208] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 320.410268][T16208] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 320.430226][T16208] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 21:14:30 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060c", 0x50}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 320.430236][T16208] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 320.430245][T16208] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 320.430254][T16208] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 320.430263][T16208] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 [ 320.603503][T16217] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 320.650886][T16217] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 320.678862][T16217] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock 21:14:30 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) r3 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video2\x00', 0x2, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(r3, 0xc0945662, &(0x7f0000000140)={0x9, 0x0, [], {0x0, @bt={0x800, 0x4, 0x1, 0x0, 0x4, 0x0, 0x8001, 0x5, 0x1f, 0x5e8, 0x8, 0x8, 0x1ff, 0x2, 0x8, 0xb}}}) dup2(r0, r1) [ 320.728097][T16215] input: syz1 as /devices/virtual/input/input169 [ 320.781748][T16217] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated 21:14:30 executing program 3 (fault-call:11 fault-nth:17): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) [ 320.837045][T16238] input: syz1 as /devices/virtual/input/input170 [ 320.854374][T16217] EXT4-fs (loop0): get root inode failed [ 320.883740][T16217] EXT4-fs (loop0): mount failed 21:14:31 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) r2 = syz_open_dev$mouse(&(0x7f0000000080)='/dev/input/mouse#\x00', 0x3ff, 0x40) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000002640)='TIPC\x00') sendmsg$TIPC_CMD_ENABLE_BEARER(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYPTR, @ANYRES16=r4, @ANYBLOB="095a0000000000000001410000001400170000446c6f00000000004c000000000000"], 0x3}}, 0x0) sendmsg$TIPC_CMD_SHOW_STATS(r2, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x860c2a860567ecd0}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r4, 0x8, 0x70bd28, 0x25dfdbfe, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x60001c9}, 0x4000000) ioctl$UI_DEV_DESTROY(r0, 0x5502) r5 = dup2(r0, r1) ioctl$IMGETVERSION(r5, 0x80044942, &(0x7f00000001c0)) 21:14:31 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x4c01) [ 320.996936][T16248] FAULT_INJECTION: forcing a failure. [ 320.996936][T16248] name failslab, interval 1, probability 0, space 0, times 0 [ 321.034150][T16248] CPU: 0 PID: 16248 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 21:14:31 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8d"], 0x99}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) [ 321.043956][T16248] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 321.054281][T16248] Call Trace: [ 321.057584][T16248] dump_stack+0x172/0x1f0 [ 321.061938][T16248] should_fail.cold+0xa/0x15 [ 321.066541][T16248] ? fault_create_debugfs_attr+0x180/0x180 [ 321.066566][T16248] ? ___might_sleep+0x163/0x2c0 [ 321.066587][T16248] __should_failslab+0x121/0x190 [ 321.066606][T16248] should_failslab+0x9/0x14 [ 321.066629][T16248] kmem_cache_alloc_node_trace+0x274/0x750 [ 321.077310][T16248] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 321.077330][T16248] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 321.104605][T16248] __kmalloc_node_track_caller+0x3d/0x70 [ 321.110247][T16248] __kmalloc_reserve.isra.0+0x40/0xf0 [ 321.110268][T16248] __alloc_skb+0x10b/0x5e0 [ 321.110286][T16248] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 321.110305][T16248] ? raw_getfrag+0x164/0x230 [ 321.120068][T16248] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 321.120093][T16248] __ip_append_data.isra.0+0x2667/0x30d0 [ 321.120117][T16248] ? raw_destroy+0x30/0x30 [ 321.120139][T16248] ? __lock_acquire+0x16f2/0x4a00 [ 321.130252][T16248] ? __ip_flush_pending_frames.isra.0+0x2d0/0x2d0 [ 321.146166][T16248] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 321.146184][T16248] ? ip_setup_cork+0x59c/0x8e0 [ 321.146200][T16248] ? raw_destroy+0x30/0x30 [ 321.146214][T16248] ip_append_data.part.0+0xf2/0x170 [ 321.146232][T16248] ? raw_destroy+0x30/0x30 [ 321.146248][T16248] ip_append_data+0x6e/0x90 [ 321.146267][T16248] raw_sendmsg+0xba8/0x2f40 [ 321.146293][T16248] ? dst_output+0x170/0x170 [ 321.146314][T16248] ? lock_downgrade+0x920/0x920 [ 321.163976][T16248] ? __kasan_check_write+0x14/0x20 [ 321.164013][T16248] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 321.164029][T16248] ? aa_label_sk_perm+0x91/0xf0 [ 321.164048][T16248] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 321.164061][T16248] ? aa_sk_perm+0x288/0x880 [ 321.164076][T16248] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 321.164095][T16248] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 321.164123][T16248] inet_sendmsg+0x9e/0xe0 [ 321.173288][T16248] ? inet_sendmsg+0x9e/0xe0 [ 321.173304][T16248] ? inet_send_prepare+0x4f0/0x4f0 [ 321.173321][T16248] sock_sendmsg+0xd7/0x130 [ 321.173338][T16248] kernel_sendmsg+0x44/0x50 [ 321.173357][T16248] sock_no_sendpage+0x116/0x150 [ 321.182942][T16248] ? sock_kzfree_s+0x70/0x70 [ 321.182960][T16248] ? trace_hardirqs_on+0x67/0x240 [ 321.182976][T16248] ? __kasan_check_read+0x11/0x20 [ 321.183010][T16248] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 321.191979][T16248] inet_sendpage+0x10f/0x150 [ 321.192004][T16248] kernel_sendpage+0x92/0xf0 [ 321.192018][T16248] ? inet_sendmsg+0xe0/0xe0 [ 321.192037][T16248] sock_sendpage+0x8b/0xc0 [ 321.192061][T16248] pipe_to_sendpage+0x296/0x360 [ 321.206572][T16248] ? kernel_sendpage+0xf0/0xf0 [ 321.206593][T16248] ? direct_splice_actor+0x190/0x190 [ 321.206614][T16248] ? anon_pipe_buf_release+0x1c6/0x270 [ 321.206634][T16248] __splice_from_pipe+0x397/0x7d0 [ 321.206652][T16248] ? direct_splice_actor+0x190/0x190 [ 321.217860][T16248] ? direct_splice_actor+0x190/0x190 [ 321.217877][T16248] splice_from_pipe+0x108/0x170 [ 321.217897][T16248] ? splice_shrink_spd+0xd0/0xd0 [ 321.217917][T16248] ? apparmor_file_permission+0x25/0x30 [ 321.217939][T16248] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 321.228199][T16253] input: syz1 as /devices/virtual/input/input173 [ 321.234178][T16248] ? security_file_permission+0x8f/0x380 [ 321.234203][T16248] generic_splice_sendpage+0x3c/0x50 [ 321.234219][T16248] ? splice_from_pipe+0x170/0x170 [ 321.234235][T16248] do_splice+0x708/0x1410 [ 321.234261][T16248] ? opipe_prep.part.0+0x2e0/0x2e0 21:14:31 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_RUN(r5, 0x4004ae8b, 0x0) r6 = syz_open_dev$vcsa(&(0x7f0000000180)='/dev/vcsa#\x00', 0x4, 0x0) ioctl$VIDIOC_SUBDEV_S_CROP(r6, 0xc038563c, &(0x7f00000001c0)={0x0, 0x0, {0xffffffff, 0x3, 0x5, 0x7}}) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r8 = gettid() r9 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000240)='/dev/hwrng\x00', 0x8000, 0x0) r10 = gettid() ptrace$setopts(0x4206, r10, 0x0, 0x0) tkill(r10, 0x3c) ptrace$cont(0x18, r10, 0x0, 0x0) ptrace$setregs(0xd, r10, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r10, 0x0, 0x0) fcntl$setownex(r9, 0xf, &(0x7f0000000280)={0x0, r10}) ptrace$setopts(0x4206, r8, 0x0, 0x0) tkill(r8, 0x3c) ptrace$cont(0x18, r8, 0x0, 0x0) ptrace$setregs(0xd, r8, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r8, 0x0, 0x0) r11 = syz_open_procfs(r8, &(0x7f0000000100)='net/anycast6\x00') ioctl$BLKSECTGET(r11, 0x1267, &(0x7f0000000140)) socket$key(0xf, 0x3, 0x2) r12 = dup3(r1, 0xffffffffffffffff, 0x0) dup2(r0, r12) [ 321.234278][T16248] ? __fget_light+0x1a9/0x230 [ 321.234297][T16248] __x64_sys_splice+0x2c6/0x330 [ 321.283310][T16248] do_syscall_64+0xfa/0x760 [ 321.283334][T16248] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 321.283347][T16248] RIP: 0033:0x459a59 [ 321.283362][T16248] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 321.283370][T16248] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 321.365241][T16248] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 321.365250][T16248] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 321.365260][T16248] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 321.365269][T16248] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 321.365278][T16248] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 21:14:31 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060c", 0x50}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 21:14:31 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_GET_IRQCHIP(r4, 0xc208ae62, &(0x7f0000000100)={0x0, 0x0, @ioapic}) dup2(r0, r1) 21:14:31 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) sched_yield() lsetxattr$trusted_overlay_upper(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='trusted.overlay.upper\x00', &(0x7f0000000200)={0x0, 0xfb, 0xe3, 0x4, 0x0, "d1c1e5d966cbd65459062b723dab8cca", "310f26a05bc94d555abe3992503ac20b8a9b86bc9c3208064a0a77e36fd75068377502613e911dbed243a31e064dfcc9251ac21624a64347f90b3cad4bec857a291d2e9391b190feda072b050793622249855bc7d6400a5a62f8c913e5483d3ff6c652891528fa68a9bf86457eb5076f8ccc2e81426616a409cbf9b5140adfb056e938fdfa1296e799673c0482c0c7742a3593a529d8cf8de1b1049984375eb880bf853d22112a164f54d6aec118f77357d4197a0fa5c0d4c97c8c3eaa2ac1943b2c200ef9d9f235ae1882176a15"}, 0xe3, 0x1) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/btrfs-control\x00', 0x901000, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r3, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x4, &(0x7f00000000c0)={0xffffffffffffffff}, 0x13f, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r2, &(0x7f0000000140)={0x7, 0x8, 0xfa00, {r4, 0x10001}}, 0x10) dup2(r0, r1) [ 321.589617][T16262] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 321.643607][T16262] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 321.685268][T16273] input: syz1 as /devices/virtual/input/input176 [ 321.706391][T16262] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock 21:14:31 executing program 3 (fault-call:11 fault-nth:18): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) [ 321.766934][T16262] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated [ 321.787187][T16262] EXT4-fs (loop0): get root inode failed [ 321.794551][T16262] EXT4-fs (loop0): mount failed 21:14:32 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000080), 0x1, 0x0) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 321.874802][T16283] input: syz1 as /devices/virtual/input/input180 21:14:32 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x540f) [ 321.976835][T16291] FAULT_INJECTION: forcing a failure. [ 321.976835][T16291] name failslab, interval 1, probability 0, space 0, times 0 [ 321.989770][T16291] CPU: 1 PID: 16291 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 321.997671][T16291] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 322.007732][T16291] Call Trace: [ 322.011042][T16291] dump_stack+0x172/0x1f0 [ 322.015386][T16291] should_fail.cold+0xa/0x15 [ 322.019987][T16291] ? fault_create_debugfs_attr+0x180/0x180 [ 322.020025][T16291] ? skb_checksum_trimmed+0x266/0x400 [ 322.020047][T16291] ? igmp_group_added+0x850/0x850 [ 322.036259][T16291] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 322.042511][T16291] __should_failslab+0x121/0x190 [ 322.042532][T16291] should_failslab+0x9/0x14 [ 322.042550][T16291] kmem_cache_alloc+0x47/0x710 [ 322.042643][T16291] ? br_allowed_ingress+0x1770/0x1770 [ 322.042666][T16291] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 322.052210][T16291] skb_clone+0x154/0x3d0 [ 322.052302][T16291] deliver_clone+0x46/0xc0 [ 322.052323][T16291] maybe_deliver+0x2c7/0x390 [ 322.062429][T16291] br_flood+0x13a/0x3d0 [ 322.062456][T16291] br_dev_xmit+0x98c/0x15a0 [ 322.062479][T16291] ? br_poll_controller+0x10/0x10 [ 322.062497][T16291] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 322.062517][T16291] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 322.072893][T16291] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 322.072913][T16291] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 322.072960][T16291] dev_hard_start_xmit+0x1a3/0x9b0 [ 322.072981][T16291] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 322.082129][T16291] __dev_queue_xmit+0x2c6c/0x3720 [ 322.082145][T16291] ? __kasan_check_read+0x11/0x20 [ 322.082162][T16291] ? __lock_acquire+0x16f2/0x4a00 [ 322.082178][T16291] ? arch_stack_walk+0x97/0xf0 [ 322.082199][T16291] ? netdev_core_pick_tx+0x2f0/0x2f0 [ 322.082218][T16291] ? __kasan_check_read+0x11/0x20 [ 322.090836][T16291] ? mark_lock+0xc2/0x1220 [ 322.090857][T16291] ? mark_held_locks+0xa4/0xf0 [ 322.090874][T16291] ? ip_finish_output2+0x1415/0x2590 [ 322.090889][T16291] ? ip_do_fragment+0x1805/0x1d00 [ 322.090903][T16291] ? ip_finish_output2+0x1415/0x2590 [ 322.090922][T16291] dev_queue_xmit+0x18/0x20 [ 322.090940][T16291] ? dev_queue_xmit+0x18/0x20 [ 322.102080][T16291] ip_finish_output2+0x1759/0x2590 [ 322.102108][T16291] ? ip_frag_next+0x910/0x910 [ 322.102125][T16291] ? ip_fraglist_prepare+0x3a4/0x590 [ 322.102145][T16291] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 322.102162][T16291] ip_do_fragment+0x1805/0x1d00 [ 322.102179][T16291] ? ip_do_fragment+0x1805/0x1d00 [ 322.108013][T16295] input: syz1 as /devices/virtual/input/input182 [ 322.113667][T16291] ? ip_frag_next+0x910/0x910 [ 322.113687][T16291] ? ip_finish_output2+0x2590/0x2590 [ 322.113779][T16291] ? nf_ct_deliver_cached_events+0x23d/0x6e0 [ 322.113797][T16291] ? ip_mc_output+0xb34/0xf70 [ 322.125112][T16291] ? find_held_lock+0x35/0x130 [ 322.125128][T16291] ? ip_mc_output+0xb34/0xf70 [ 322.125150][T16291] ip_fragment.constprop.0+0x176/0x240 [ 322.125169][T16291] __ip_finish_output+0x4c5/0xbd0 [ 322.125186][T16291] ? audit_add_tree_rule+0xb60/0xbe0 [ 322.125205][T16291] ip_finish_output+0x38/0x1f0 [ 322.125221][T16291] ip_mc_output+0x292/0xf70 [ 322.125241][T16291] ? __ip_queue_xmit+0x1c10/0x1c10 [ 322.294312][T16291] ? __ip_finish_output+0xbd0/0xbd0 [ 322.299528][T16291] ? dst_release+0x62/0xe0 [ 322.303946][T16291] ? __ip_make_skb+0xf31/0x17b0 [ 322.303966][T16291] ip_local_out+0xbb/0x1b0 [ 322.303986][T16291] ip_send_skb+0x42/0xf0 [ 322.304003][T16291] ip_push_pending_frames+0x64/0x80 [ 322.304020][T16291] raw_sendmsg+0x13c4/0x2f40 [ 322.304047][T16291] ? dst_output+0x170/0x170 [ 322.304068][T16291] ? lock_downgrade+0x920/0x920 [ 322.304090][T16291] ? __kasan_check_write+0x14/0x20 [ 322.313358][T16291] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 322.313376][T16291] ? aa_label_sk_perm+0x91/0xf0 [ 322.313396][T16291] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 322.313411][T16291] ? aa_sk_perm+0x288/0x880 [ 322.313423][T16291] ? __kasan_check_read+0x11/0x20 [ 322.313438][T16291] ? __lock_acquire+0x8a0/0x4a00 [ 322.313457][T16291] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 322.313480][T16291] inet_sendmsg+0x9e/0xe0 [ 322.382722][T16291] ? inet_sendmsg+0x9e/0xe0 [ 322.387208][T16291] ? inet_send_prepare+0x4f0/0x4f0 [ 322.392307][T16291] sock_sendmsg+0xd7/0x130 [ 322.396720][T16291] kernel_sendmsg+0x44/0x50 [ 322.401209][T16291] sock_no_sendpage+0x116/0x150 [ 322.406039][T16291] ? sock_kzfree_s+0x70/0x70 [ 322.410633][T16291] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 322.416860][T16291] inet_sendpage+0x10f/0x150 [ 322.421438][T16291] kernel_sendpage+0x92/0xf0 [ 322.426007][T16291] ? inet_sendmsg+0xe0/0xe0 [ 322.430493][T16291] sock_sendpage+0x8b/0xc0 [ 322.434896][T16291] pipe_to_sendpage+0x296/0x360 [ 322.439726][T16291] ? kernel_sendpage+0xf0/0xf0 [ 322.444474][T16291] ? direct_splice_actor+0x190/0x190 [ 322.449746][T16291] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 322.456664][T16291] ? anon_pipe_buf_release+0x1c6/0x270 [ 322.462109][T16291] __splice_from_pipe+0x397/0x7d0 [ 322.467142][T16291] ? direct_splice_actor+0x190/0x190 [ 322.472413][T16291] ? direct_splice_actor+0x190/0x190 [ 322.477677][T16291] splice_from_pipe+0x108/0x170 [ 322.482511][T16291] ? splice_shrink_spd+0xd0/0xd0 [ 322.487433][T16291] ? apparmor_file_permission+0x25/0x30 [ 322.492977][T16291] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 322.499202][T16291] ? security_file_permission+0x8f/0x380 [ 322.504830][T16291] generic_splice_sendpage+0x3c/0x50 [ 322.510096][T16291] ? splice_from_pipe+0x170/0x170 [ 322.515102][T16291] do_splice+0x708/0x1410 [ 322.519454][T16291] ? opipe_prep.part.0+0x2e0/0x2e0 [ 322.524550][T16291] ? __fget_light+0x1a9/0x230 [ 322.529227][T16291] __x64_sys_splice+0x2c6/0x330 [ 322.534069][T16291] do_syscall_64+0xfa/0x760 [ 322.538613][T16291] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 322.544484][T16291] RIP: 0033:0x459a59 [ 322.548363][T16291] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 322.567959][T16291] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 21:14:32 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8d"], 0x99}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) [ 322.576349][T16291] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 322.584311][T16291] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 322.592301][T16291] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 322.600255][T16291] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 322.608208][T16291] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 21:14:32 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000100)='/proc/capi/capi20\x00', 0x400000, 0x0) ioctl$ION_IOC_HEAP_QUERY(r2, 0xc0184908, &(0x7f0000000180)={0x34, 0x0, &(0x7f0000000140)}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:32 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060c", 0x50}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 21:14:32 executing program 3 (fault-call:11 fault-nth:19): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) [ 322.779985][T16309] input: syz1 as /devices/virtual/input/input183 21:14:32 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) bind$inet(r2, &(0x7f0000000480)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x24e23, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r2, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) write$binfmt_elf64(r2, &(0x7f00000000c0)=ANY=[@ANYRES64], 0xc63b9e35) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, 0x0, 0x0) connect$inet6(r3, &(0x7f0000d83fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, 0x0, &(0x7f0000000180)) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f0000000180)=0x8) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r3, 0x84, 0x14, &(0x7f0000000200)=@assoc_value={r5}, 0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f0000000080)={0x9737, 0x4209, 0xffffffff, 0x2, r5}, &(0x7f00000000c0)=0x10) [ 322.821105][T16301] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 322.874609][T16301] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock 21:14:33 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5421) [ 322.930720][T16301] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 322.956853][T16301] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated 21:14:33 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_END_FF_ERASE(r0, 0x400c55cb, &(0x7f0000000100)={0x8, 0xb5, 0x9}) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 322.988167][T16301] EXT4-fs (loop0): get root inode failed [ 322.996096][T16301] EXT4-fs (loop0): mount failed [ 323.016033][T16326] input: syz1 as /devices/virtual/input/input187 [ 323.025642][T16328] FAULT_INJECTION: forcing a failure. [ 323.025642][T16328] name failslab, interval 1, probability 0, space 0, times 0 [ 323.064258][T16328] CPU: 0 PID: 16328 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 323.072963][T16328] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 323.083017][T16328] Call Trace: [ 323.086318][T16328] dump_stack+0x172/0x1f0 [ 323.090656][T16328] should_fail.cold+0xa/0x15 [ 323.095250][T16328] ? fault_create_debugfs_attr+0x180/0x180 [ 323.095276][T16328] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 323.107311][T16328] ? __kasan_check_read+0x11/0x20 [ 323.112340][T16328] __should_failslab+0x121/0x190 [ 323.117294][T16328] should_failslab+0x9/0x14 [ 323.121793][T16328] kmem_cache_alloc+0x47/0x710 [ 323.121809][T16328] ? ip_mc_output+0x584/0xf70 [ 323.121827][T16328] ? find_held_lock+0x35/0x130 [ 323.121850][T16328] dst_alloc+0x10e/0x200 [ 323.121872][T16328] rt_dst_clone+0x59/0x8c0 [ 323.144676][T16328] ip_mc_finish_output+0xb6/0x4a0 [ 323.149711][T16328] ip_mc_output+0x5dd/0xf70 [ 323.154225][T16328] ? __ip_queue_xmit+0x1c10/0x1c10 [ 323.159340][T16328] ? dst_output+0x170/0x170 [ 323.163837][T16328] ? dst_release+0x62/0xe0 [ 323.168245][T16328] ? __ip_make_skb+0xf31/0x17b0 [ 323.168266][T16328] ip_local_out+0xbb/0x1b0 [ 323.168294][T16328] ip_send_skb+0x42/0xf0 [ 323.168307][T16328] ip_push_pending_frames+0x64/0x80 [ 323.168325][T16328] raw_sendmsg+0x13c4/0x2f40 [ 323.177697][T16328] ? dst_output+0x170/0x170 [ 323.177722][T16328] ? lock_downgrade+0x920/0x920 [ 323.177743][T16328] ? __kasan_check_write+0x14/0x20 [ 323.177779][T16328] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 323.177795][T16328] ? aa_label_sk_perm+0x91/0xf0 [ 323.177814][T16328] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 323.177828][T16328] ? aa_sk_perm+0x288/0x880 [ 323.177840][T16328] ? __kasan_check_read+0x11/0x20 [ 323.177852][T16328] ? __lock_acquire+0x8a0/0x4a00 [ 323.177873][T16328] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 323.196341][T16328] inet_sendmsg+0x9e/0xe0 [ 323.196355][T16328] ? inet_sendmsg+0x9e/0xe0 [ 323.196370][T16328] ? inet_send_prepare+0x4f0/0x4f0 [ 323.196388][T16328] sock_sendmsg+0xd7/0x130 [ 323.196404][T16328] kernel_sendmsg+0x44/0x50 [ 323.196421][T16328] sock_no_sendpage+0x116/0x150 [ 323.196433][T16328] ? sock_kzfree_s+0x70/0x70 [ 323.196468][T16328] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 323.196486][T16328] inet_sendpage+0x10f/0x150 [ 323.212673][T16328] kernel_sendpage+0x92/0xf0 [ 323.212689][T16328] ? inet_sendmsg+0xe0/0xe0 [ 323.212709][T16328] sock_sendpage+0x8b/0xc0 [ 323.212730][T16328] pipe_to_sendpage+0x296/0x360 [ 323.212744][T16328] ? kernel_sendpage+0xf0/0xf0 [ 323.212763][T16328] ? direct_splice_actor+0x190/0x190 [ 323.314377][T16328] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 323.314392][T16328] ? anon_pipe_buf_release+0x1c6/0x270 [ 323.314411][T16328] __splice_from_pipe+0x397/0x7d0 [ 323.314429][T16328] ? direct_splice_actor+0x190/0x190 [ 323.336380][T16328] ? direct_splice_actor+0x190/0x190 [ 323.341667][T16328] splice_from_pipe+0x108/0x170 [ 323.341687][T16328] ? splice_shrink_spd+0xd0/0xd0 [ 323.341710][T16328] ? apparmor_file_permission+0x25/0x30 [ 323.341729][T16328] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 323.341744][T16328] ? security_file_permission+0x8f/0x380 [ 323.341764][T16328] generic_splice_sendpage+0x3c/0x50 [ 323.374157][T16328] ? splice_from_pipe+0x170/0x170 [ 323.379202][T16328] do_splice+0x708/0x1410 [ 323.383631][T16328] ? opipe_prep.part.0+0x2e0/0x2e0 [ 323.383653][T16328] ? __fget_light+0x1a9/0x230 [ 323.383675][T16328] __x64_sys_splice+0x2c6/0x330 [ 323.383700][T16328] do_syscall_64+0xfa/0x760 [ 323.383720][T16328] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 323.393468][T16328] RIP: 0033:0x459a59 21:14:33 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd"], 0x9b}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) [ 323.412537][T16328] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 323.432230][T16328] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 323.440643][T16328] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 323.448614][T16328] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 323.456595][T16328] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 323.464573][T16328] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 323.472538][T16328] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 [ 323.520703][T16337] input: syz1 as /devices/virtual/input/input188 [ 323.547574][T16338] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 323.557579][T16338] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 323.577940][T16338] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 323.601072][T16338] EXT4-fs (loop0): corrupt root inode, run e2fsck [ 323.615126][T16326] input: syz1 as /devices/virtual/input/input189 21:14:33 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab", 0x53}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 323.640120][T16338] EXT4-fs (loop0): mount failed [ 323.686826][T16339] input: syz1 as /devices/virtual/input/input190 21:14:33 executing program 3 (fault-call:11 fault-nth:20): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:14:33 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5450) 21:14:33 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd"], 0x9b}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:33 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) bind$inet(r2, &(0x7f0000000480)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x24e23, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r2, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) write$binfmt_elf64(r2, &(0x7f00000000c0)=ANY=[@ANYRES64], 0xc63b9e35) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000440)={0x3, [0x0, 0x0, 0x0]}, &(0x7f00000004c0)=0x10) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) bind$inet(r4, &(0x7f0000000480)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r4, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x24e23, @local}, 0x10) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r4, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) write$binfmt_elf64(r4, &(0x7f00000000c0)=ANY=[@ANYRES64], 0xc63b9e35) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) bind$inet(r3, &(0x7f0000000480)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x24e23, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) write$binfmt_elf64(r3, &(0x7f00000000c0)=ANY=[@ANYRES64], 0xc63b9e35) accept4$inet(r3, &(0x7f0000000380)={0x2, 0x0, @local}, &(0x7f0000000400)=0x10, 0xc0800) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) pread64(r6, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_IRQ_BUSID(r1, 0xc0106403, &(0x7f00000001c0)={0x6, 0x3, 0x1f, 0x7f}) ioctl$DRM_IOCTL_VERSION(r1, 0xc0406400, &(0x7f00000003c0)={0x1f, 0xffffffc0, 0x7f, 0x98, &(0x7f0000000200)=""/152, 0xfffffe6f, &(0x7f00000002c0)=""/41, 0x54, &(0x7f0000000300)=""/84}) r7 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x80000001, 0x200000) ioctl$UI_DEV_DESTROY(r0, 0x5502) ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0xd5) r8 = dup2(r0, r7) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r8, 0x810c5701, &(0x7f0000000080)) 21:14:33 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) r3 = syz_open_dev$sndpcmp(&(0x7f0000000100)='/dev/snd/pcmC#D#p\x00', 0x9, 0x111040) write$FUSE_NOTIFY_POLL(r3, &(0x7f0000000140)={0x18, 0x1, 0x0, {0x200}}, 0x18) dup2(r0, r1) [ 323.917614][T16365] input: syz1 as /devices/virtual/input/input192 [ 323.946640][T16370] FAULT_INJECTION: forcing a failure. [ 323.946640][T16370] name failslab, interval 1, probability 0, space 0, times 0 [ 324.008268][T16373] input: syz1 as /devices/virtual/input/input194 [ 324.057242][T16370] CPU: 1 PID: 16370 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 324.065175][T16370] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 324.075234][T16370] Call Trace: [ 324.078536][T16370] dump_stack+0x172/0x1f0 [ 324.082888][T16370] should_fail.cold+0xa/0x15 [ 324.087486][T16370] ? fault_create_debugfs_attr+0x180/0x180 [ 324.093299][T16370] ? ___might_sleep+0x163/0x2c0 [ 324.093322][T16370] __should_failslab+0x121/0x190 [ 324.093342][T16370] should_failslab+0x9/0x14 [ 324.093362][T16370] kmem_cache_alloc_node+0x268/0x740 [ 324.093377][T16370] ? rt_add_uncached_list+0x147/0x1a0 [ 324.093396][T16370] ? __local_bh_enable_ip+0x15a/0x270 [ 324.103155][T16370] __alloc_skb+0xd5/0x5e0 [ 324.103176][T16370] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 324.103191][T16370] ? dst_init+0x38e/0x4d0 [ 324.103216][T16370] __ip_append_data.isra.0+0x2667/0x30d0 [ 324.103240][T16370] ? raw_destroy+0x30/0x30 [ 324.103259][T16370] ? __lock_acquire+0x16f2/0x4a00 [ 324.152858][T16370] ? __ip_flush_pending_frames.isra.0+0x2d0/0x2d0 [ 324.159266][T16370] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 324.165489][T16370] ? ip_setup_cork+0x59c/0x8e0 [ 324.170235][T16370] ? raw_destroy+0x30/0x30 [ 324.174634][T16370] ip_append_data.part.0+0xf2/0x170 [ 324.179818][T16370] ? raw_destroy+0x30/0x30 [ 324.184217][T16370] ip_append_data+0x6e/0x90 [ 324.188706][T16370] raw_sendmsg+0xba8/0x2f40 [ 324.193218][T16370] ? dst_output+0x170/0x170 [ 324.197721][T16370] ? lock_downgrade+0x920/0x920 [ 324.202586][T16370] ? __kasan_check_write+0x14/0x20 [ 324.207700][T16370] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 324.213946][T16370] ? aa_label_sk_perm+0x91/0xf0 [ 324.218801][T16370] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 324.224779][T16370] ? aa_sk_perm+0x288/0x880 [ 324.229276][T16370] ? __kasan_check_read+0x11/0x20 [ 324.234287][T16370] ? __lock_acquire+0x8a0/0x4a00 [ 324.239240][T16370] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 324.244778][T16370] inet_sendmsg+0x9e/0xe0 [ 324.249087][T16370] ? inet_sendmsg+0x9e/0xe0 [ 324.253570][T16370] ? inet_send_prepare+0x4f0/0x4f0 [ 324.258662][T16370] sock_sendmsg+0xd7/0x130 [ 324.263061][T16370] kernel_sendmsg+0x44/0x50 [ 324.267547][T16370] sock_no_sendpage+0x116/0x150 [ 324.272402][T16370] ? sock_kzfree_s+0x70/0x70 [ 324.276975][T16370] ? mark_lock+0xc2/0x1220 [ 324.281378][T16370] ? mark_held_locks+0xa4/0xf0 [ 324.286130][T16370] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 324.291917][T16370] ? debug_check_no_obj_freed+0x20a/0x43f [ 324.297615][T16370] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 324.303405][T16370] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 324.309629][T16370] inet_sendpage+0x10f/0x150 [ 324.314224][T16370] kernel_sendpage+0x92/0xf0 [ 324.318794][T16370] ? inet_sendmsg+0xe0/0xe0 [ 324.323281][T16370] sock_sendpage+0x8b/0xc0 [ 324.327682][T16370] pipe_to_sendpage+0x296/0x360 [ 324.332511][T16370] ? kernel_sendpage+0xf0/0xf0 [ 324.337259][T16370] ? direct_splice_actor+0x190/0x190 [ 324.342526][T16370] ? __put_page+0xa7/0xe0 [ 324.346841][T16370] ? anon_pipe_buf_release+0x1c6/0x270 [ 324.352280][T16370] __splice_from_pipe+0x397/0x7d0 [ 324.357293][T16370] ? direct_splice_actor+0x190/0x190 [ 324.362565][T16370] ? direct_splice_actor+0x190/0x190 [ 324.367831][T16370] splice_from_pipe+0x108/0x170 [ 324.372751][T16370] ? splice_shrink_spd+0xd0/0xd0 [ 324.377675][T16370] ? apparmor_file_permission+0x25/0x30 [ 324.383200][T16370] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 324.389430][T16370] ? security_file_permission+0x8f/0x380 [ 324.395046][T16370] generic_splice_sendpage+0x3c/0x50 [ 324.400311][T16370] ? splice_from_pipe+0x170/0x170 [ 324.405325][T16370] do_splice+0x708/0x1410 [ 324.409642][T16370] ? opipe_prep.part.0+0x2e0/0x2e0 [ 324.414738][T16370] ? __fget_light+0x1a9/0x230 [ 324.419404][T16370] __x64_sys_splice+0x2c6/0x330 [ 324.424241][T16370] do_syscall_64+0xfa/0x760 [ 324.428742][T16370] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 324.434614][T16370] RIP: 0033:0x459a59 [ 324.438491][T16370] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 324.458421][T16370] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 324.466902][T16370] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 324.474853][T16370] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 324.482891][T16370] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 324.490931][T16370] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 324.498884][T16370] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 21:14:34 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinp\xff\xff\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) pipe2(&(0x7f00000000c0)={0xffffffffffffffff}, 0x80000) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm-control\x00', 0x2d8faa96c9c25c29, 0x0) ioctl$TIOCGWINSZ(r1, 0x5413, &(0x7f0000000100)) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r2 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180)='/dev/zero\x00', 0x40000, 0x0) ioctl$TUNGETDEVNETNS(r3, 0x54e3, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r2) [ 324.507824][T16374] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 324.527019][T16374] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 324.549003][T16374] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock 21:14:34 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab", 0x53}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 21:14:34 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) dup2(r4, r1) [ 324.576176][T16374] EXT4-fs (loop0): corrupt root inode, run e2fsck [ 324.608928][T16374] EXT4-fs (loop0): mount failed [ 324.701389][T16394] input: syz1 as /devices/virtual/input/input197 21:14:34 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd"], 0x9b}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:34 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5451) 21:14:34 executing program 3 (fault-call:11 fault-nth:21): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:14:35 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x802, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r1, 0x0, 0x0, 0x0) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000580)={{0x6, 0x3, 0xfff, 0x2}, 'syz1\x00', 0x3b}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) bind$inet(r2, &(0x7f0000000480)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x24e23, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r2, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r3 = add_key$keyring(&(0x7f0000000180)='keyring\x00', &(0x7f0000000200)={'\x86yz'}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000980)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, r3) keyctl$update(0x2, r3, &(0x7f0000000600)="4bfe00c6aede9ab531e86eef5498cf0625759c3e8983d708b8c1178b739eb054abadbeea0f029e5b860d7787bd6b766c59e0aac43d20521cd704d21fd63e29b9271f311bba7399123ea945bf94e588df01f6abec99fffb30c6ed6ae2a072473f9baac2fed9bb2c716db071e6b5893afd12f86d5a1c207d834f66dc4c0df2bd7dbc06e57949c912c5dfc3ad0556b016e9557eab9b0295757996a8cf321a0123c2e75550843f0e2b186ab32d62dcb4efe04d5963b3cd780bc71ecf2bd8e51ce91f40510bec8a16e149ccaa4880ad21615004fe8ab57ccd65", 0xd7) write$binfmt_elf64(r2, &(0x7f00000000c0)=ANY=[@ANYRES64], 0xc63b9e35) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f00000001c0)=@raw={'raw\x00', 0x9, 0x3, 0x328, 0x0, 0x0, 0x0, 0x0, 0x140, 0x290, 0x290, 0x290, 0x290, 0x290, 0x3, &(0x7f0000000180), {[{{@uncond, 0x0, 0xd8, 0x140, 0x0, {}, [@common=@set={0x40, 'set\x00', 0x0, {{0x40, [0x9, 0x81, 0x4, 0x5, 0x80, 0x40], 0x0, 0x4}}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x1a, 0xbb8, 0xe4f, 'netbios-ns\x00', 'syz0\x00', 0x9}}}, {{@uncond, 0x0, 0xe8, 0x150, 0x0, {}, [@common=@icmp={0x28, 'icmp\x00', 0x0, {0xf, 0x6, 0x1}}, @inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x1}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x12, 0x100, 0x100, 0x711, '\x00', 'syz0\x00', 0x3}}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x388) lstat(&(0x7f0000003a80)='./file0\x00', &(0x7f0000004ac0)={0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$xfs(&(0x7f0000000700)='xfs\x00', &(0x7f0000000780)='./file0\x00', 0x401, 0x7, &(0x7f00000039c0)=[{&(0x7f00000007c0)="2f4cb95626373618a6cb5d99f353da89617c1a3239274cd85e1094a065d29e0481ea2fda841e4856dcc1e6d35240a5e80dadd1206347c164b7a4ff82276b30dababad83a8feb76c8b2b5be060df1908b9a7607bbc52b7b70910ef9ec285a56e9245e3ba3c497270c40430e8ac50d0e376e9af7db09c817cf46a1a0c23bbe4ec573f28ffb6e9854e6f60b26a97b2580b850e2098c", 0x94, 0xff}, {&(0x7f00000009c0)="3ee9db9ded2046cf8ddf1a5e7bd80c23247255400506d41db418eef674d68d5aec46b88c8fb2f69178b5b37c05431c12db24dbb42f870a3fcf002cc020fb52ea85283f7d79c41fd0073a3d38a4e7b3bb5fcab42961206dc7a4d9c1882afcc7b9ff13f21e39ae34897cababf4c55d8937e424af0ebf9a5174eda743af891682d4cd52ba29e5e8c040975537efca8335ca5b1eeb57f12247d9d33fd697639e4f20455d9b0bce77ebaca3e15f79379ddc5ea9c1f67567f2af3ec2378b0bcb47a9b0cae18d1628b3200a43cf25a9c440f90b525384c16f5c3b6a7276c1c1712b7d7a1aa5dd3e930f941a924cefd7ff63b84dae5cff1a1fa04de57e9af2417c199e303891f625a9c3b4503c9228fdf32f4b57597c1395c50c52618900792c9c241dccb809fb3442fcb2c0b6b4141fbc614070fb5e8ef8273a75f56b33e125eab6b502c7655fd9c628f4645cf07db00f87d89ff778e6bd397faa9919d04d02176894b8110fe09e7edfcc09c9394e3a1fd3ccf9d40036b5068efeb8c88ad7c35f788aec1399148f5c19fe054266b30ace58415abaea3bd96936f4accbad3681bc75cbb5787c7f3c5cefadfd55a1a4253b6b8eacef07e91bef3e879ee05701b7fcfaaa3f293ef1432ebe18e674dade5768653bfc8b54430a305aec48561c2e363e64a5cbaa57d46ff049e05ab2c85283a7457ebe1f02b38b0fb472dbdbf60393d6818b237e8917b9f25930395b474da80083268fc1c42b6c2d6589dfcbad2337f6df58a6ad43a071d069d0ea889540bc3b27ea2bdaef78952c1e057bd885fbb5c07f9dfebec1d2808722a80d4a522aed4b9331da8280b542e25327663a3c0ca929470a1688d315d3de804e3778342ec8db248cb92b674fe6a452fd8122b730c210ac2db9408c8dc568fd20776d7c07dd077b8a6510ef4e44176658ce066f26d4062143c783fa67b59e8907fbe708e6db696f302b7f2da5e15ccab651d61629cf2202258dbfe22623c924c8044a8b4cc71486318f64d84db1dd8032068eb789676dea39084e457d28f3f09b849d8e0cf8b9732f00ea96aec6923722b4998960b621f765c31bbb0e8103fb6116bd3b6f3a31b3df34e574fe7eaba297f270e65218f0a933f1714fda531f4d6fcdaff157e877f0ebaaf932040fce0cd343604a57b2e8b8a104d1b72e0ca5c03897c7c75dfa1978cc4b5abedbf221d40827a83c94a606e9c46a6b79a55f0596a364f9633a00d8759f64929b69dbe031e1d837f161cbecf9f044c3269c92e25713b33536d7ed23501d2917ce84b4ffddf38cab4fa2f193bc7d52cb70c8146c0ccab4be8420365bdec03a3f69b7a134482220cb340bfe44fe28423a60cb23c128d3808b245048a2eefcfa8ef6982db2c8dc908f214eab3f9f7245297868a9cadb85756c42c258c0ae45f4f28a1fe65fe79d6632d40fc86d8529a87d6ad20ab6403578563daf9b21b0a355cb05d6fdbf8a99416dbff36c34dbf20972d6b72c3cc4880bcc4f3dba7d2ba6bf45b4590bae0c95c6e9dd27964d1dbb9602cea2f458ae66860cb3cdfef76676c10684433dc0179b148eca5a337ba49b4ad47177ce4b510d636ef5e595292d79852f97e5d2c58e766f121d9a30e0301b4da7320d3a44b11b6a6d78ae9cf2d724cb343bbcc8b0e8d2eb3930ec976cc14fdcebea4f0cd7a8eb3dded53cee85c59600d280b2ab67937305f1ca2d497e65f5480e553d962183809a55f9fce722d0b753a98a467076beaaf638bce661f5d0a73c861bbc002ad33f4a0d96fe5627ca05833577bc800f23aa8ce49316c9790476c8ee5a40bd7066e3856f18b078389eb0a8d6224c2fd46c910b8e7f0dd19e473d6338f228a022888ee3ccb98608f3666b56e2bf8895ad6fca17c356b6aba5b733f505c3dd4dfc49903355f6d6e1097d1ea62cb095352c7b6300106c69eff65d2a927d14054638212e594ffe058be65bd880bfd3f02370e2437e4ac00ed53e5d1eebd40aeb0520355b256169061221cbdb157fac42db4618f47cb5c42b975594dbf68262486188e87f99b3962b060f380ca99ac6dc71e1e0d0937a727c43d84930027977e0b7420bf86d682bca06bf1dc987e477301ec7035cb88cb6c4e9e013157a7a461c29c88a72e02c0fa90ab112fabf0b0bd0bcdd1e5fea9aaf889212a51dd0f3fe8b288cd9d7681004ca71a7393eb532a5fb75069287aeb97b16f57760e0eb08a1460d58a8ec1d30dfc8afbf9a42cc59d01fda68ff181e041b65c6a765ac94ce4a69527133e4365985ae7759eaab267f24a93c349ab0c20765bf446632269b11ffbb4b7562f3b93ebf088b9f9ab2f6975412c5d1d1639b18436a3a67d9654b5777002ce7f9ee10cd887b8b00e51c64a02e169911b5fb450389ff542fdc62dde422a09b8aad9e012f82c322fecc55e27ac69f097924fd0e640ecaa7aaab83e11b129528c2ef433f885f07a57052cf5f995f4aa645b87a0a8a035baa36da6a71baf2b175cfe26eca313b53b7c005de4ab6360ecd119a76ac1119a615cb00eee5aa5b17a765c95b3ec0d69d0e58a8a5ef51a5aaf3bcffdfc9323d4e49d79c814c0b703b1cf8872ddca8b66239c52eb48a754f12bdcc029e24da1740bd8067d7c8e716d04aaea84a26b403728c91ace9e20b8bca78751bbfc9ca704e277bd0b39a80c0e21aa2181f1fdbb8def7e217dbfcbd5d2e8fb8076e82394b90a6d3ddfdebe8c0f4354d60b530559e4b5ea1d22f470bdf0dad9cb111b2668433204334da21277d7c13e3a2e8513bd96a09d14d838f8e7957cd16edadaf6d9971ba80285ed3f7800dd82aa77d4d0c6a9ab102822b43b40b35050b066d8e00963446038e3da46a84656adba0dedc7491157c7612f0ea1dfccdf88dc45f238f5cd2a94b9cfb61acfe9897b5913429423c1fb54ed8aa89ac87ccf888355cd5b13c1a765888aa1f67325decfeb46c47f4fd430d66a02466c43c8e031f553fba936da0424cdba82ed19278da473ee2cb348322f2d07a27e2d4b7d2ae680d93e4d63d968431ae7cdde096b357524d84cfce94e1f660ba86e5407c35e9ac29c6d89af1ad5558c302e49e046a8638a5249e6201fb504115a957bb089a5d34667eb94cba64f2c34e66fe9174327fe081e86b3714fc8d0bef5a5a46d1b9b0ad9464f0b6fa1dd13cf8e9948e49c5cc2f0aa7ec6e75241154321ff6270a46deaa8d43959077a4018a67ce83bab4381dfff9163b167c22342b20f2ddd2801e7620d7e5e16574e54559d9f0d40dbe9757a52bc58ea5537ed075a17e76274c0711bbb39f98370de3ca60d2b9c59b41af8ee7cb75e434b8e28ac827e8447fb2d8a2a579bff74a50a87ae7d111de5875b15de68e1f70f5e62460472b255e65df5f8975bdeaf3e5da99edf3bf5fd13dec5f3777c44c53bb734bef2dd79ece828a8970573116b60d1cddb893e20791557b982e70da056e8ffd2a73830c4e7833b1c13788d6c9feb5a3bf7bb818de906d8c5349057e8d33bdbe47f69fad3071895ceda89aa04ab2db863b785dbe89db1a29eb5cc8cdb33fa894f100e817f4a6f2bcd97dd39e8de037ff1cf7ee521d07b61b3f943e5fbe9834dbd545d4baaeda63c762d4ce10ac7cc0499d666806421a5a4e930118092821bacf7db792dd687e4e648bae4553da3328170dfef9d47476f6352432b93800ab02d1bfe64d8c156ed0d047ba95555a757b68ffe51905cb52c8e41cb343835533885fcd1f8dd7bc2fdb266d3e2245b1aeccc89070fd438cd25cfe77151ba9e62d2f0590e8c69e480b590ae4e76dd499fd90d5eaa378d8f70500df768825c4780bb451294459b849cbcde37fb883af9498dc2f3f774e2b3b1f0bac8b08756ba1fe82d8968ff6dffbb2483f3bbc5699626370544278a41c8a10083db33ff51e701847bd7d9b33e3a4ca574f1297858fa54e3155e94ac3ebfc93ab5d431122f83cefe233505d0d98a9d90f517873fabd190a5398ce99933ab8404e95464355b77ce390bcd6a856c36088eb14ff41967df9de1bd8a1b9af7b72f6c71331bbb9ed3f49a94c28623118ca9b803c13cfc0fcce9023a7d3494e1b10cf2309ed46b4ab9170f29d9d2b060ce29ed3e75b3d8a2965bba76da527f87dacc9ed737e1369e8d456024b9906127cb9b41e640f32c8ba421e3b13cff1ba8064e34d0899ccb3e2b8cdb6725fb2cb601c77b8d8821b02e4bbc35b5dcb11166b96a1417e416546a3208a7f019087a2748aa1ff6b3501c6605f86d81bc68a4e56b1389ea777b380a2ec1dd7bc436f5042ea0d9b92ae0b710cd57d352475117e3a75f946f07d82718bfe354b5bc86c56126330446c94cce7ecf7f292a1af0875eb281765639a7ef288f0d7c89a8e6d46c4ac429d3b3ee1e3a06a576acc353367e09e7ab2d670c80e4abda2730dd889d1a42264b3a190055946ce7748c54417b54f2080b7bfd0522e7e95026cf8eda704fcf5739785ddbc57602751b98f04063148263ded67e97346b24a208a2524370460fbfa2e7921c366441cfc6e0f4a93da87f2afe94396c86bc96645effaf91c7ecfee34b494c32e220d583336b55878b796b3e55cd48bc59f58184423287c58e9d39a72c8aebc64aaf851ec5210728dca2e46e69f768050abac8e8f8c69038c2896620a43838fe48719a07df3c160bc474848eaed121ad3cfe9178acf5e69cfc9c70642ddc5a901320624da648bd3179892326fdcd0750a3789ea79ca2931a5e8709d7057a11ff11755eb612b0a133389d0d4b580517b330053b9b114e86868170baaf5cac46ef558b498eef75d579b74ce37cec1f6b2b2fd9636b0aa992351af5f2930d13033cb0f4788e89b3a9181e2bd3d4409dec93374d344b80e8f375ac992d11152eda87ff13f9166f82cdfd4b37757c20d6035dbb1a68ec54897727caba52373ecfd1256c53a598aedc34447388e9f123ea1da78d9b37d4ad1d4e15e849a3587ccb71215ee0413c0b1c84f75d5959d88e546c1264d7e4f5338eb16840a83e3644aaea9490bedcacaa25b5abd0c8c7aaf13dc5042c73fe756ef52732b1c64bf00c36f2d1db78aad73e79b707f3a606847c11f2aefa45290a4dcf412758b223331da11d13b6b9610c39590b37ffb9aa93c18ce549f930472c21d6f7a647674de6f472e5cec40d6d1eed68af9e6a38c04f0e64747e08157e9e44ac0caaeaed8fe7c3b56c29a9ef489c85259a2983dd8768f936baf2553001e50832aa8d8458f00da8047c0acd4de2aaf8443c39e3a680d83e8c2b6b6c9aee20474d0b5b178d6db0a639d658f217f1dd78a8daf27cccc25db33bc4f40d45a3cc582da6b48442e0237971b5e31d9010537dad5db13a7aad723eeb62b58c839259ee5d60054d6d18fcb010709286b697abd63827ff10cfc33cda7e17714127233bac49b77d88dfbc12e43d60a725020731e0b48cb2ac2d0491bd54e35cd75d0cfd09b64f45953d5d231f67e83d4e8f63ee3b44e82dda4d109d2a85b627ce8f9269c2c981cdb165ea5edbfa8b3dbb8348165847e2bc2acbe5fcb8162012bd65860a14d3f59c2ada9cfe2b58f4979e6a5314e701dd76240e047da4cb060fa24896e53f283ff8b09db49cd30b25cc67a3f614a5b965e32a91944802cfb7bc0008d903f97ecacdaaae45ed74856b80e6b629cd962cb6c2a7fb0a49d01165062255730c870aedf5e86f5fcf70b66885f885d42d800145b4d0581720b15614fd2051eba13c7112fa4a579bc291097351c98599f1dcac4abb4cb2d949d2b36e2bbcff92ec355d5ff2b962f701fcaba373c4e6cfc207e08e2b0672d0dff", 0x1000, 0x100000001}, {&(0x7f0000000880), 0x0, 0xd1d7e6f}, {&(0x7f0000000900)="d288908199ebd9caeff05db877b8a5d053374977cecad28c618835548151a56e6ab3c3c8", 0x24, 0x4}, {&(0x7f0000000940)="b8c910ea7a1aa08a71b8f7a948", 0xd, 0x287}, {&(0x7f00000019c0)="cb483cbebf942216f19001df7fedcb77490d4283936285731121ec1eeccb91344c03e4a503fb25b317629c8451f0cbed017ebad6fbd4a687898baf88e8bb96d27c66c991d24f67aed4441f8f3739655447e69a2c7a1a037d2de0f3c4b1ef57ae20832112461c37fc849063ba8cdc5fa6aec603a8eca0dd065cf353d60d23b12fcd3f578ab06a0db2fca4ecc64dfeca7a5e13ed8076248aa738f83a91c5043aecd0b95104fdcbf7bb0aa3dc19fa0c978b327ffbe95126de6964a51b2f5028e62b05451bce004ffa9d1b46ccfe402d5df72676579940af9b7ebb5fbf81e01039cef5adf94ebbde899455dd35f966b8e09e6d8863705fe42429bf518fd4823b9b8ebe95ba83226c1870879571707df48a855466ac30171269f547e70f85b467e30a5afd5cc56037348e46ba7c4f9bd4c5b7d1789c01801959cba0d70a4f5f0a244d5385fde598a79206530beeb1b3be14f773caa6235380f9369189d368081dde97a2b704718fbafa4a587a9053bed578c5021206209d50f780cab542c081061bc0f10a5d61da96ba218688eece960eb1416f652c03655a4e6b8a44fba4d5b8616754c0df5aaaf5d52f44390e8af3eb5c6bb44167306383c1f3b3150964798269da643293573657a851757a066a025546a13fcd574b73a5c8b7c62bdd011ad887fc15f13b034e0bdd2f1be795a23caf0a68914a83f879510efab31f976c35b524ddbfec914520c61131298f6fdeb9a80906d4b18262d3e76470875a7dd694507d1a06ed5285fa0703c7adbe9fb455079e2d8129c82e52c1bf6ae3c70b22bd0587897fcafff32ae9aa66846ae7f5ca7aaaaebf0c7da72ebf1352288ebb6d6b6942df3faf8966b77696eac792695255d49528a5e53a97d4142e0c6c44987d1f4f0ac4c9e6b80a1bc3040ee2673994b14df41d3fabe05835801e44ad3611d78a2de12ea838f6ff53cc0922b0a9d432de3b0da84eeeed5975ad73021038fdbf7a4b9a7deed653ae4c9a80468316d09541d82917a067da80f7145d0544c850148eb38513e0965707b58058c45cb3f22b00e553e5100271b127d9b3152756795ba7769cda21e34e80c4700d189d90399278cc41575cbad5e26cfe3076d644bebf069fd40f4bef7f83b1ce8480b75358bd03f247a4905e8792359585bf266c3f80c58fd593da7b77830ddc56144718c072da9ea4f511e33a5ed74f1369b7133e6a3065096944798f9f13462f9be79aff3862f5ef9646ecdfa079216bddd1d6181dba39dfef2501ab9bcf08a375c7e9933351e507dc3d65e73924748fa5e6edb6989ed59a48a33c9179ffc886714f9ce7c4959e2554f94f5b4a7f4c039aac8312dd50bcd3b05f52607c1470f8cb7ca08cbc95f2119c90f5f7f1ff441b4bfbc6d6529c5c981b21fdc8b516b235e48e3396e7223ff5f4790c9abd6203ece2095758c8e3624da8a6ef5d1ba6fc08f84f36e16c4703e2511c8913b2048564c12ea6f5b215e2a6a589ef110c3a154fa5f1ddafc0154d4113dca23af32879854bac945573968aee5c95cc61d59e12c5a1a6bc0f7b2fcff867de5e73f0d51bd60a34df85f627fe7c63e1a3285a25e9813cf827f2f8133a6bdd1bc7db638678b7b6f564709488df0ff5849972daa77ce9189c708a6d2459666018ee30fd5d8f73863cd30b5139d96e86a63c581222cedb130fcde2811349845a5420e3bf38131aaf000a09522ed87e650482b613c01536ca2d15d667b1e5e579959aea3590437c650f141dab0c9fb7da8248ff12b50353feb2345a879f917ad8c60155fd3635f7e31a9f0a2115036d9e2d700bee8a6c269c8bde8a3604f10a9b969348d2c919ff18304df65bb8e180d0276f37604c84cbe8d7ff3c368a3ef9470c64700920971a946d41f13d749a6021aa34aaf073803ee2fe9ebf5658ea70fe5f067d88ae5128ecf82018b6f2ccaa194a2dde3860e334739a6d71fec36855d81db6859559555f5781b7e6f997e749b7cd9b4a8d310bf86e0a4e227386d083a0540c2ba76f2d3b1085dbf050fdf9ec40db8f723dd9b3a3bb9ffd45e5f0ddcf8069e09b3061353793264e3713e61cb2c9d3e4c0f70668ae0249ff436c471e6fc551e42330352bf308a0453290a091d40a7b4035b93e34b8444ea3486f90137bf5406a81238744a939eb68cdf95d39d91d14577a55c5bda6467f0264a0bf3a5866ee89ba8a3a8d07d2209ebbdaf3d8a16aeef7105d42c1e57bb9bc098b4ec97d11c61f6137a468cfc6aeae51d992235a1b44d41a87bc567ba8c70429147c698fda2d44f20df35f6348395667a3b8a59216eebc222485b7497723d98c60bad41ec6a35ddfe3bdc5a4621a8f1f86e06a0edfc82fc2bfaaa9fb51353077fc46d9fb2659088e7306b756a40360c2b9fe752d186db5e1caba34cfe2cd9457201ff561cb9f4f804759b0bdd89a24f46ce46c40b123923bc019e27230ba19464b4d52f9ce91af474770bd1fa467ba93cc4c5714f35ec4becbac1e448f792bb356e907f1edf8ab3e9348b1bbf4175af58148ff9a2132997ca4f26357b807cee9e043e2942d3ef816b368e06ca651895493783e9f5de9a49c7ba0715834e7f6056dc0d8513604d82ca1a0bf27f590d768152b06a40059c632173af86681fb0936f06a0cfc201d99d250bcb3399648d1253e17ea08bc4a39337c7919fbee26c48d6c94c34129aa378feb3d84d07ac4193545413ba54636dabe2b6888ad7c6157c5aac5dab11a443838e357c53d6993266dec96a7faa55a04f801f444995543c2b61ba36e748c1fea3e901be221c702e54b49edc90fabf87e88e12b8d2357450c23b7d53a445e67a9289416793af3e7a112de329709c669dc3c7952692c29f2892d1a9ccff86800896b2ef9e82ec96a697bb150d648cd7d6ae91846ec6c5af25c3fe55e18800402cdc9ded92af67e063fe1d0fcf6ac6711fef01c1b17e2b6a695f69cb1e703f1410cd4d1a79379f97a1987a6fe95e3cc773a926ad558037598d847f829a7fbe46bdbeab95ce33152eac903932a432a117898ef980d62fab998ac72e5787051f64505c46d0a81eb1c8ce29e8044362d2f20bb94d1ad22008a36cea5830ebf4c6b6598116394374f5c2ab33058ce1ff5f6ef5ec0f539d26e046dbc3aea56258128ea4c12ec61578dd3acab666fc135856249410ec347655944a18f46051d0b90b209d76145a6d0f03ee765930322e31a0d8d2a69d33d12ca6f235f9d58b72dbd63cef74f4330a90d2f8ab4422c8fc9e8651de1532562c8cafb5ec18a9ba7b1a2e71dfdb242c804c5067fe6c924529ec9a4973d8ee2c14b5ab0984d8a2f23f6c43d17594660da3bbb4a70396142f4c5db61b500d781f0eb23f2242e6f71aef082dc77b5cedb1c904d1acf8e5a8ff8c3c92d7de87fdc1db49c3820d4a94676be7168098f4b577879094c43ec40ea2418cd3a9be28064df62b6d312924f5f58956d32084d5c3591d41790619ee3d089b2c0a63197af4c5bfab94b6561a39a65ca401290c1ae7ca87269b6d693fa52d55ee2cb611dc98c055d46b3983917fb32025e3099d92c4c4818df1e5ed6d48740c351c68dc703c9ce534c5295ac1059ddd3fe5e45c60ec0987b7b5d96914c33ffb1d31768c6f94488caff51f240d0e59a045608505b726f078490cde1aa0b7765b65c9a65a5deded0ec5c0a13a29e9f5e97fc314dbfd2a55cfb3f4251aa2bbcc72cbd2d1a54d298c90765aed39e54fe12ec2ddbeb212ed0691fb58e5ca0dfc048f6bd004761ce14c888ea40770f73b8a878c8cbfb46c659061432a37702a5a63c22268367faac676e5b30afe13989f1d227090f476fb427f8585b30ec9a394df43c61e46d9bb8318d944ab069a8970d7885962b811b510b308c4ca41469f4cdde8fdbb8aa7f59bcdfa22c0163487973c3265527d1258bd30df179d39537ba5b3160327feb2eaada6f48a215ec045ae3478c2eb65e9f2a97011eaf7705c505df79d3caedbd06bb47930680e91ad07ca25980dabd647ab35a9b159eacfc59b0911b1f66a0495e1fbad561c9315d27af2983f5696572c6eb84aec02a4370a6a5c08279a48a5cb79310b7276b63a2ee03e2ea84908b246a980342d736ef6316cae4c8fb524bbd3f469199341b144fe73b8671eadddbfef9a396198d8f6a264034c657711c5f08892988a561c4caf00232c89d00603edcad5a86a229a5a1e9437b7db7ad89bf101ef1a4131b4b805f5c0ce73e7718d99a3b77d4c1dbaf1a3ec33890d141b2141301f86ebfcdc56c79beaf6b8c50f8e548f6d6d236e8ee6feea3339d8c9061f009518a6a36c3c48c66e59613f19f933acc47633cae87d904b4d0d5e4950732604d0eec8692bb6915d8a9606aa9b9e65aae6c8264b9fdbd577c152351013b4c3bdb2d06b8b7e2c936e61454e2937a4f007976aa68d2b47f270831aff0ecd4bcf62d7590bad8fb13c0f081ff839480d8ea516a782b8b328501f4ef220294bd9cf8521dae20ce4229293033fc64e81e03a2a72fae4e152902fcbe5b5ea03dce854281ddd874837598a20cc5df935d54a26a1fda2f8683e4a416751bbef9f45a2e7a92ae46248d07d8793f3d418d6ae58974e03eef5bc3c9a9a8213e1c54defc775f3a69503f5cac1c2629b27be008990cad5bda5aff82f2703d6f1e65ec8db2d35fdff45d452d6697d0a8779505c595a0a860bd7982c292f4b126a0338a4f528400d68578f1d1f83743ac4bdd4d692c33b47c9e191d12de5f7e7ecd773ff9857291d908286107e6fe209ff688e67856631d61660014aa31b55f6da06f8642c5f93a2e24501ab174ca6b2c6314f67d1b8a1a96580d91d887721885f56078575e6e95f00cb10c320b1b9fd271917c836e7b007305784a366cee2582e0c418844fbf4c01c6e984b0df5b5f246e84e296a634f7096c618635aeb90949b285620c01defe21b3eae6adef47470578fea97e85e552e42ab288fcc4f63b900a210a88bc3046b427d0888fdfddf98f5cc58e3fbbd77659de0069cdec1643675e79d35225f915378462006047bd603fa1e602eceef0af0c3a7aff6fd307801324f54cb34e54b0c751628d9e0e12530d32887102672c1e3c4d593acd80137606e5dbae8e1c4146b5750dd9ead84bd93c2e38038ff26bba87b0da5e49f655ecc4d3941476da466d6fecd036d76fbd1c4403b36025d600c6829260ffa18a787e3c0148aafeb07bd82882de9f4d429d4bc2e6600a323db81d0172716b09f06298b4f5c292b8d0aa562e7abe302cffa3d439d7c25792d44f38c2ac2fbc3830076491d45e70b6529d616c99263a81486ea98a49351ae3e4eb2f689adf761932f03c36287a92671a7e3870934b80cb25ee266f8c6f09298b5fd7766375e6b291dc9b54eefd025cc4fd5953315283df668e230846f1d627f49018f0660ae6e5055e327cfe9adb5c1a68835e535f0807474c47be55b15f313cc335efb7ac265647b633922a87666d7ac667888c8cb6e7e9a73c2982c6e4479aca9c21107490cb5a15baf7a11ac6b662514baee5f507c4e1c6fe6459d859aa1782a72be96e93c8cc21e3bc778e03b3a9d6d64bfb8331f8d9cd25ca194eb2d73164f877429ff17eadc01c1839255a8fa4ce92252ad478510711028e3ddb3be91bee0cbc2e8e6961e25e1074a95d051d8c0f7e5d12c6e031039b33c7a5cbdb8c416d33ba7a2bffc2f461f49febc18c78517adb3c19a6118234d1c3adc7a4fe01e21bf13ee8dd81ecb94a700633a5f358e8d8609e60e726c50df10009d8d094a991bb06c5b5b78731986fd8d58ea8fed705f2b1", 0x1000, 0x55a}, {&(0x7f00000029c0)="a71860426d4dae10dc5bcdfe83dd51df5f3a1c6183775cbf3f3c053340459057b8c62145f01f4588f65aa2fe2c0e9ba355180a41b001208310d5d789bb555cdda307b5a7125e8529e564dbcc62da2259a58ca8ffc74af88d760ca1db1f2f1644e8916ae0c81323a53550b20b50d40ba6c7dcce18781a6d851b89c9c986fc4a513db54cfb5f5642ff881e6ea6f4d5d6235252152f895df88c6566d91efea314280a82db1d539110bd12676aa982d8340f50c98c071996b6981978415f3f23da00f5f4ca316e7c4eae84af02e5cd86b8705a5dceac38496bfc190981908d8448c98b37c7a8219a0ccd1c1f56cc7182d5684986e646f328a0ecef39d0a042fa210ba88ce2c3355b4caa5166eac669838c260d0e33de7adee0f990a780bb24f26ac0e988c67c39f9dad1a5f1cee1cf95338e5a158b1f9e4351980cd5c0312134558c797c0c9a5aa0682b6af5da36bc3753f7b9ff221d2a70b1e431ecac2813202fd4b9d7c86c34b701a5b4cc54570fb1599eaa560b3147509fb05b1d395a487a57d18b0f7799b4992be115e7e4df847d9d6418f3189d460d3b37074dff35a4582fae7dfd6998d6b44667202e32fa02ba1aa32bbd2cb2f49f8c94ef0a4138cf4df182c228fbf10091d956899826017b585d005a859998c394a62226d6b713e85cc394ab4379bdb8f578fa667aebdfa1022ea5cfa8c4d6267eadd3ae4d23f2ff3828a044d5c8547aada2cbecb12d3194e2e5e39820dd5d9f7275f2bcd49abc89174b31240ff04ed0b9c7bd7a7d60cb2c2b250fb342709edcd759c2f86bffbfe2d96e032203a7462663f908203d6e3009f7c2fe8b5182ff4c267cb5e44022279967b2fa0f1942906bd8818e40feea2f0564008f0ed6394be4907641e1ba00959da0091265cb9bfc518dd8960afe1b6569e31dace99551289bd51d3bb6ed719f34e15b416ccd9a2afccb37209ce219620fc7b2d53b25fc31e2cf42bd74c10a512919fe0335969df4c51744c2e4a215910ddaf3b95f9140730c6d16f4df5361acfec5a99ab6a680f8ef05932e41957dace9be7f15e6c173021bb182dd603f98ea82b52a3828abc61768373cbf3a18f7a5ca3448786ad0dde2ea3046bc442d116d556fe2dbd762514cd9ee20faa2bfb968424288a58ef3bb29983cb6e0c7fc0dee5074f4b1467bea9139e9a576e24e387041b841b78a09499a6ec650e841f0deb12b2b026a8a6d14b85b98d0ce1bce068caa268dc00943f8bd6e4bd21135c0ba0f226f25e917d5527245bf621c33af9ccf2ad12e6328f0eb3940a225e56ccb303d9abe709629f530abc90301873191232dd787d814418eebc59baeb0680d480a2d823e9b6bac049231e9e474f68ac919190383b7a95941c8e54565c8a0df1efc5e0c64ab7fc9d72af50c374f2cdcc432e62a9c2ac28dce44c6062a3d9b7c40ca2204186dfc1250594ab66219a20c933a9aa49d5956f6555dbab6f4cb2bca7c51c7f2bbb60aa165c2dd73c386d0546a2f8cc5b2703c6071fb15e07f1147d05ad2a1c406d634e907b0741e10361c5ab3dbaef07e19c45a0a521110e6bc53c3054137a96959858d525dc34711923c9a6f227293100e9a8b67cbb32ad08b8da2b68b90a4f657b2d0fa91c97635094d8e968be63a477ed82b88742f4a9f815a88326f7ea898d55166cf37119d39ab4622dafc3a345dbcfbe7acf57cd145b8e5c754b8bd948a82e82e831e569d1c3cf067f878109282ceaa41e54f76c15f2556b18a5eb7ba0c951d74f53d19721efcd29ffb846541291095151affc5cb2a73061a4d6367c785de968f28f940923d4bda7e95a3d9e9b6eda8220f823c19f81f8e6416e463b4a3a18fed944923d2fab7b0cee00d5ea1e675169be1d9ce4b8ab86623b6162e526f4c26e3e069ea1a74ae52dc4d06bb5f441cbdf55c09cb26a1ee975bf29d5e641bb7426f2021ba484ca6f76cbbab0b6bf2e2c3566b3448f48dcdd76aabdc77e276ebe6fcddb3a4a24bca2d4c5b1eced32c9be5a58c232a052c15d0499c84db5a2ff9c554161aad19ef1563a9c0a2b137ea505f5bb069a6d7ee22ed36018b276536c74669fc645014a213d4b4cee063e3224b8c2b27408ca26f2e71b121079a7fb76ce57f94589535247c59064d5a8888e870bd0e5f2e7ebc9703689ecf391f24b2c03a8b45c5c9c8ccb2a4973e7b3bef9f9a1f257aed94ee43a6592289c32518842299acb4406b208eefa9577d30e8e66b4cfad0b5798f889a9b97cfcb3e19c24d663eeec6d7e6059bb7952a569c41ca7d31daf427a77015580f2a93a66f0bd3cc402e0e4fa7bf2d3f43fa2a968d42fcbe72ae97ccdbd8af14787073bd829dc722fd83291849a80c7a5d21419a38a22952b24c57f8f29424b3929a881ffde2d4aa6185ed5601423a3c487084254a755a74f353d0a6272a94d543d969eaf84c1a906fddb2b974b0b76a2bbc5c58741f3874d153ae34b08e20a02fb58a3f5f85593bd41b86bdf0b7c2abbcbd083c0842e2fe8f986ef3c3a234b67f058b75cc03205d3ad78d4571ccb867de26439a0a6d7ce0ada8e680c1960e81b279f950fb0fc57187c9a343d18bb02b330d519b9955a8e62e647ffc2a02cb46e5a033b534eaf57c89c1ef0ecfebae846d3a9254318043d3e27b59ed8ba21078a1d1e38ebd64c7a814c102ee6739ae61328dc0368058c2c075633e908bc1b84dcda7100ff942e59d4d5f42e1f0add366c54651811c24843c39996502e69433c4e181d758c88b117579962dc1e20d08d2056ee88eda5d26f06756e2f62227e428d3a4632184ae9011b76374f26170773bcdaf9414f6643efd54c648e702683e8541956839cf5695235acd3062d952d9ebce7c11a80e32b1f5217aa7aae7f6e3d77c06598c186371dbc4e4ae88a1dc914a1a29c52e2603ed70bd9688f6eb49bada551427cfc26fa4442716a44ad1d63821556648d9b4df3210fdb3f1e4d073fadf9de52f5835190c14ccaef9d7915f27489febed8e3dbdd3653a97211e8c8b83b1ed0b0acb735532030d6dc01eb6546fc21d390f5ec9ad0461c8393cef82567c54ba5517835c98dde45a21177ffcab50a8f6242541f7e0ae31981d14bc7079476efd94118f9bdf71ea7b275f3ce8eb2fea5a0bd774999309434f6ebdd431f86618fc98155899ae29671f76a589b650662722fe3af064806c03bf4e304fca1085efac416d16b1bd863b817dde91900ee39ca68330a0dbf9a94870b1c623f6fd056c86569c0f8be2dd127b0ed0a9ed21322c48002ba30172d8652f948ad6b335b2d5238313bd7a41935d4e704ffca7a3b3e597b26d9ceefae47597d54b55d9f27768d7dfa6a75e0e1b062b8470e19b921eb79ca521389a17189cac3aa1bc79c616a64d2b61b9915e1b0e3dc7dc92eb44f361d830a61439ef35dfabf4ee82b5c5d5213c168a0b6e8e1f8c2b6b7d0d7a3381b0620bf0b0d8047f0b49d91d4281c8f235482ada5a2bed5d37f2882be3a81efeb4a890e8430fdeb25466d415ebdff964d1bb3d9995d9603c1d04525c250edf5998a5bdcf95b05c6f9fca5d06304b6f9d34cf330d3433491eba62023020fc9d764a36fdc3893a36fac0d4e780c526c3d3c41d7edbf92ced6e22de9d72a830fecf0bda6ee5776cb2d344695d05f3d0d14906d1ab22af5292838fc8a386eb462a708084b7970a21b83fe82396585165e628f57bffeb3cf2841e3e43c83724a7b3dd45e5e988b4da10043c80d32e57d87f6a9abef531399b0cf3dc805bc243990b1030d0125988bd7fcfd8a4c5bec8dba51f4876ff006884dd335df6503ebf59eee72b8784ef3eeaa09f1d3f1c4f4e8075121e95926326cae5194bb942b1afa2a910922136b81717ff5297ce13a7b86f2cd0ebc0b35b5b9842e2bfc226f2cc3f4ebb810acb9c6342ddc205574041de7b8b3313eebc402b2e8d40c9c0e2dc03dc9b179459f4740515e17ab6d777bea199440b74de488d5e68ac2075e7342469b156ad2dd0f5f3758d3530be919c72a4a19616cca4efc67f259619f2ba0ee7bc4337f86c040c9c8630bf9543def8f251fccb191cc1f1cd49c7a8f4c1650228e8604982cf78ab9fc7369ccd8ef009eb2e21ad1f639b81f81397b7237f4a517d1b780aabb39be99933ab737122700b3175784ce033b4e4d0d3c951dc1d49f4c2656c8f8bb6fae39bee626852cb3242a518b1d057be0b2e2c4e4c06a6cba1affeebe19e2daec3b7cafd3ee281c6855bff2a75b8505ebd82f04a76320d905eaba592fd628da81c66c7954bce228eb3b0a9a891156ff79794d60af16169ed70d54ebc12fd3c961edf6d192fad998aa3de245ecbcfd060bf334ea0f272186d3e035a66c097f8b404c68b9c3d1b008649fd1f03621527696b6a8bccd6c9523511edc18083fa2fbc89738577db9435e450c13f322be16bc89f1140cfcf4e79f8450e19efef7315501a847b087fc268c9a8e6c74fab330e9f4d54a5cbb5a4bfab2c63b11b2df1b9fad281f864c66afc8cdc50444decc2117c5ebe99ebc52f033ac6f7f778a0e9cc65eb4beef28c093900b4a146274b948406b5e6208e7380a695936a674dcc8f163ca793e2065f5042279fcf06d66a4c39eba4f5f1660932be0221489e993686e92070160aadc9450bb1551c7481371caa04a81ccf4b727f2b18def27003967840f77c87d3c1ab907fa809c023ce32241bd128810537fe49f952cc548dc607dc61f196784a669f4409e781e6bcc9929083b967602223df1fdbc2ad3cc95e511d96323407cdcea998cea97652cc3c0bb70d1d79ca9eb3051c5ef5c62dc41ccd4376c4bc141656b04a05516f04afb233fbe7f498a7e3e4b4a03750fdcc4f78a55961de9541c93200e56350489e0753b244bd5dea99001efae05cb79bc40c8884e52f1588fa44c9ab5b73e133b849f343ba068e57b895b69a81ca9f02dd89a671ce64fcb255ad562a400f979e7e9988fbecf2b2bea0a779be82d08d781ceb7fe115ffd5d53d289dd97b542f0d53be17e517ba9d0441ead4ffa56354a51782e010c3d3a5e8440b31b3c54a5e5b840b22d4ed374b25a8d620c7525b205707ab046d5fd3df89f27f4419800f7faecc7f037e573a1e7487c2c199acd468922778b92c20399f1f2ff66df101ae8f7357e55b73c1152dc60b12be3012863f7ec40fde39474d2cfde7e4cd619ea601d4ea8b90ec9ea335f70bb508c8c8b84454ca6b6f4a2cafecbb234420ffb527814e1dcfb18eccc2cc48200d9ffb531b743e091e8b4de20147d06f10dbb32fc4ad78dbf63869f0adcf26c9c914182453b9f04ca73866590a2012d2c11478034b7285ca2c34da7f6eb250582163fbe9ec3bfa509ac67ab4e7c533b7046de3ba0fadddbc69d842f2925d936e29eecdddb51a2704cb5e01b27ca5e9f23377dd38a618f6ec3fce7595ca898b08d37eb25a5adec9c2d2d8b1ea2adfde08af35710a79faf05ede1650a74b77d47a588976d88231c74c65b58a6877ab357f348b07a55e2a8507a8b0d6d725e2bbef7a68ed1c1a8d81e45b7bd4b3b891b49accbd4fafbb9000a2924103551976ad031ee3175bf1735661b1936c4d903aad4272544dd2af392a1094fe00cde5174ddd472340da78d4be177b21cf24fff7d415eeb738cafd91c70a452a435bff7b126f2316f711258bda3df8c47bdfb56ae33d1f795f1d75c3bea0ffdb334e4ea3c8f6b775b5af54483fd443d18e3b5e03f31a8a22485f3a34d902a34d0b3812d15e34d5fe4d4071aa71ea44eebd71071b57d838d44a40bfe9d370f80f190840d35e7fa8cef9a8d7a8f57f", 0x1000, 0xb55b}], 0x80, &(0x7f0000004b40)={[{@nodiscard='nodiscard'}, {@attr2='attr2'}, {@ikeep='ikeep'}, {@noattr2='noattr2'}], [{@rootcontext={'rootcontext', 0x3d, 'sysadm_u'}}, {@euid_gt={'euid>', r4}}, {@dont_appraise='dont_appraise'}, {@subj_type={'subj_type', 0x3d, 'netbios-ns\x00'}}]}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r5 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x8000, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r6, 0x0, 0x59e04e46176478ac, 0xfffffffffffffffc) ioctl$sock_rose_SIOCDELRT(r6, 0x890c, &(0x7f0000000080)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x3}, 0x554, @default, @rose={'rose', 0x0}, 0x7, [@default, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) r7 = dup2(r0, r5) ioctl$SIOCRSSL2CALL(0xffffffffffffffff, 0x89e2, &(0x7f0000000140)=@default) r8 = syz_open_pts(r7, 0x20800) ioctl$KDSETMODE(r8, 0x4b3a, 0x1) [ 324.969169][T16419] FAULT_INJECTION: forcing a failure. [ 324.969169][T16419] name failslab, interval 1, probability 0, space 0, times 0 [ 324.984752][T16417] input: syz1 as /devices/virtual/input/input198 [ 325.014141][T16419] CPU: 1 PID: 16419 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 325.022210][T16419] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 325.022217][T16419] Call Trace: [ 325.022241][T16419] dump_stack+0x172/0x1f0 [ 325.022267][T16419] should_fail.cold+0xa/0x15 [ 325.044484][T16419] ? fault_create_debugfs_attr+0x180/0x180 [ 325.044505][T16419] ? ___might_sleep+0x163/0x2c0 [ 325.044527][T16419] __should_failslab+0x121/0x190 [ 325.060081][T16419] should_failslab+0x9/0x14 [ 325.064603][T16419] kmem_cache_alloc_node_trace+0x274/0x750 [ 325.070417][T16419] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 325.078307][T16419] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 325.084123][T16419] __kmalloc_node_track_caller+0x3d/0x70 [ 325.084145][T16419] __kmalloc_reserve.isra.0+0x40/0xf0 [ 325.084164][T16419] __alloc_skb+0x10b/0x5e0 [ 325.084181][T16419] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 325.084195][T16419] ? dst_init+0x38e/0x4d0 [ 325.084217][T16419] __ip_append_data.isra.0+0x2667/0x30d0 [ 325.095195][T16419] ? raw_destroy+0x30/0x30 [ 325.095216][T16419] ? __lock_acquire+0x16f2/0x4a00 [ 325.095241][T16419] ? __ip_flush_pending_frames.isra.0+0x2d0/0x2d0 [ 325.095262][T16419] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 325.095281][T16419] ? ip_setup_cork+0x59c/0x8e0 [ 325.141866][T16419] ? raw_destroy+0x30/0x30 [ 325.146271][T16419] ip_append_data.part.0+0xf2/0x170 [ 325.151466][T16419] ? raw_destroy+0x30/0x30 [ 325.155877][T16419] ip_append_data+0x6e/0x90 [ 325.160371][T16419] raw_sendmsg+0xba8/0x2f40 [ 325.164868][T16419] ? dst_output+0x170/0x170 [ 325.169376][T16419] ? lock_downgrade+0x920/0x920 [ 325.174211][T16419] ? __kasan_check_write+0x14/0x20 [ 325.179317][T16419] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 325.185542][T16419] ? aa_label_sk_perm+0x91/0xf0 [ 325.190379][T16419] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 325.195995][T16419] ? aa_sk_perm+0x288/0x880 [ 325.200480][T16419] ? __kasan_check_read+0x11/0x20 [ 325.205489][T16419] ? __lock_acquire+0x8a0/0x4a00 [ 325.210413][T16419] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 325.215967][T16419] inet_sendmsg+0x9e/0xe0 [ 325.220501][T16419] ? inet_sendmsg+0x9e/0xe0 [ 325.225011][T16419] ? inet_send_prepare+0x4f0/0x4f0 [ 325.230115][T16419] sock_sendmsg+0xd7/0x130 [ 325.234516][T16419] kernel_sendmsg+0x44/0x50 [ 325.239009][T16419] sock_no_sendpage+0x116/0x150 [ 325.243846][T16419] ? sock_kzfree_s+0x70/0x70 [ 325.248424][T16419] ? mark_lock+0xc2/0x1220 [ 325.252834][T16419] ? mark_held_locks+0xa4/0xf0 [ 325.257588][T16419] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 325.263387][T16419] ? debug_check_no_obj_freed+0x20a/0x43f [ 325.269090][T16419] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 325.274967][T16419] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 325.281192][T16419] inet_sendpage+0x10f/0x150 [ 325.285769][T16419] kernel_sendpage+0x92/0xf0 [ 325.290347][T16419] ? inet_sendmsg+0xe0/0xe0 [ 325.294836][T16419] sock_sendpage+0x8b/0xc0 [ 325.299332][T16419] pipe_to_sendpage+0x296/0x360 [ 325.304164][T16419] ? kernel_sendpage+0xf0/0xf0 [ 325.308924][T16419] ? direct_splice_actor+0x190/0x190 [ 325.314190][T16419] ? __put_page+0xa7/0xe0 [ 325.318503][T16419] ? anon_pipe_buf_release+0x1c6/0x270 [ 325.323953][T16419] __splice_from_pipe+0x397/0x7d0 [ 325.328961][T16419] ? direct_splice_actor+0x190/0x190 [ 325.334233][T16419] ? direct_splice_actor+0x190/0x190 [ 325.339502][T16419] splice_from_pipe+0x108/0x170 [ 325.344340][T16419] ? splice_shrink_spd+0xd0/0xd0 [ 325.349264][T16419] ? apparmor_file_permission+0x25/0x30 [ 325.354794][T16419] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 325.361017][T16419] ? security_file_permission+0x8f/0x380 [ 325.366635][T16419] generic_splice_sendpage+0x3c/0x50 [ 325.371901][T16419] ? splice_from_pipe+0x170/0x170 [ 325.376919][T16419] do_splice+0x708/0x1410 [ 325.381240][T16419] ? opipe_prep.part.0+0x2e0/0x2e0 [ 325.386335][T16419] ? __fget_light+0x1a9/0x230 [ 325.391258][T16419] __x64_sys_splice+0x2c6/0x330 [ 325.396111][T16419] do_syscall_64+0xfa/0x760 [ 325.400602][T16419] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 325.406484][T16419] RIP: 0033:0x459a59 [ 325.410363][T16419] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 325.430034][T16419] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 325.438424][T16419] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 325.446382][T16419] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 325.454334][T16419] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 325.462283][T16419] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 325.470319][T16419] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 [ 325.479184][T16418] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock 21:14:35 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200)='IPVS\x00') sendmsg$IPVS_CMD_NEW_SERVICE(r3, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)={0x58, r4, 0x101, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x44}]}, 0x58}}, 0x0) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') sendmsg$IPVS_CMD_GET_DAEMON(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000380)={0x10c, r5, 0x10, 0x70bd28, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_SERVICE={0x44, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x53}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e22}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x1}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x20, 0x4}}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xdd3}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0xae37626a45359195}}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x60, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x90}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x8, 0x30}}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'sh\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x28}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@broadcast}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x4}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x4}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8001}, @IPVS_CMD_ATTR_SERVICE={0x3c, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x3}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x20, 0x3}}, @IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblcr\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'sed\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}]}, 0x10c}, 0x1, 0x0, 0x0, 0x40000}, 0x40040) dup2(r0, r1) 21:14:35 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab", 0x53}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 325.553299][T16418] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 325.574123][T16418] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 325.622705][T16430] input: syz1 as /devices/virtual/input/input200 [ 325.650731][T16418] EXT4-fs (loop0): corrupt root inode, run e2fsck [ 325.667174][T16418] EXT4-fs (loop0): mount failed 21:14:35 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5452) 21:14:35 executing program 3 (fault-call:11 fault-nth:22): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) [ 325.716308][T16430] netlink: 64 bytes leftover after parsing attributes in process `syz-executor.5'. [ 325.793574][T16438] XFS (loop4): unknown mount option [rootcontext=sysadm_u]. [ 325.807681][T16446] input: syz1 as /devices/virtual/input/input204 [ 325.855815][T16451] FAULT_INJECTION: forcing a failure. [ 325.855815][T16451] name failslab, interval 1, probability 0, space 0, times 0 [ 325.932136][T16451] CPU: 1 PID: 16451 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 325.940076][T16451] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 325.950135][T16451] Call Trace: [ 325.953443][T16451] dump_stack+0x172/0x1f0 [ 325.957792][T16451] should_fail.cold+0xa/0x15 [ 325.962398][T16451] ? fault_create_debugfs_attr+0x180/0x180 [ 325.968225][T16451] ? ___might_sleep+0x163/0x2c0 [ 325.973097][T16451] __should_failslab+0x121/0x190 [ 325.978040][T16451] should_failslab+0x9/0x14 [ 325.982560][T16451] kmem_cache_alloc_node+0x268/0x740 [ 325.987855][T16451] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 325.994100][T16451] ? ip_generic_getfrag+0x120/0x230 [ 325.999571][T16451] __alloc_skb+0xd5/0x5e0 [ 325.999923][T16455] input input205: cannot allocate more than FF_MAX_EFFECTS effects [ 326.003905][T16451] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 326.003924][T16451] ? raw_getfrag+0x164/0x230 [ 326.003946][T16451] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 326.003967][T16451] __ip_append_data.isra.0+0x2667/0x30d0 [ 326.003990][T16451] ? raw_destroy+0x30/0x30 [ 326.017416][T16451] ? __lock_acquire+0x16f2/0x4a00 [ 326.017444][T16451] ? __ip_flush_pending_frames.isra.0+0x2d0/0x2d0 [ 326.017463][T16451] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 326.017476][T16451] ? ip_setup_cork+0x59c/0x8e0 [ 326.017491][T16451] ? raw_destroy+0x30/0x30 [ 326.017511][T16451] ip_append_data.part.0+0xf2/0x170 [ 326.027781][T16451] ? raw_destroy+0x30/0x30 [ 326.027799][T16451] ip_append_data+0x6e/0x90 [ 326.027821][T16451] raw_sendmsg+0xba8/0x2f40 [ 326.027848][T16451] ? dst_output+0x170/0x170 [ 326.037892][T16451] ? lock_downgrade+0x920/0x920 [ 326.037910][T16451] ? __kasan_check_write+0x14/0x20 [ 326.037943][T16451] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 326.037960][T16451] ? aa_label_sk_perm+0x91/0xf0 [ 326.037978][T16451] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 326.037996][T16451] ? aa_sk_perm+0x288/0x880 [ 326.118766][T16451] ? __kasan_check_read+0x11/0x20 [ 326.123778][T16451] ? __lock_acquire+0x8a0/0x4a00 [ 326.128703][T16451] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 326.134235][T16451] inet_sendmsg+0x9e/0xe0 [ 326.138551][T16451] ? inet_sendmsg+0x9e/0xe0 [ 326.143033][T16451] ? inet_send_prepare+0x4f0/0x4f0 [ 326.148138][T16451] sock_sendmsg+0xd7/0x130 [ 326.152546][T16451] kernel_sendmsg+0x44/0x50 [ 326.157033][T16451] sock_no_sendpage+0x116/0x150 [ 326.161863][T16451] ? sock_kzfree_s+0x70/0x70 [ 326.166440][T16451] ? mark_lock+0xc2/0x1220 [ 326.170843][T16451] ? mark_held_locks+0xa4/0xf0 [ 326.175599][T16451] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 326.181386][T16451] ? debug_check_no_obj_freed+0x20a/0x43f [ 326.187095][T16451] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 326.192883][T16451] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 326.199126][T16451] inet_sendpage+0x10f/0x150 [ 326.203703][T16451] kernel_sendpage+0x92/0xf0 [ 326.210146][T16451] ? inet_sendmsg+0xe0/0xe0 [ 326.214645][T16451] sock_sendpage+0x8b/0xc0 [ 326.219052][T16451] pipe_to_sendpage+0x296/0x360 [ 326.223888][T16451] ? kernel_sendpage+0xf0/0xf0 [ 326.228644][T16451] ? direct_splice_actor+0x190/0x190 [ 326.233936][T16451] ? __put_page+0xa7/0xe0 [ 326.238256][T16451] ? anon_pipe_buf_release+0x1c6/0x270 [ 326.243697][T16451] __splice_from_pipe+0x397/0x7d0 [ 326.248705][T16451] ? direct_splice_actor+0x190/0x190 [ 326.253979][T16451] ? direct_splice_actor+0x190/0x190 [ 326.259245][T16451] splice_from_pipe+0x108/0x170 [ 326.264091][T16451] ? splice_shrink_spd+0xd0/0xd0 [ 326.269021][T16451] ? apparmor_file_permission+0x25/0x30 [ 326.274564][T16451] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 326.280785][T16451] ? security_file_permission+0x8f/0x380 [ 326.286405][T16451] generic_splice_sendpage+0x3c/0x50 [ 326.291669][T16451] ? splice_from_pipe+0x170/0x170 [ 326.296676][T16451] do_splice+0x708/0x1410 [ 326.300993][T16451] ? opipe_prep.part.0+0x2e0/0x2e0 [ 326.306089][T16451] ? __fget_light+0x1a9/0x230 [ 326.310751][T16451] __x64_sys_splice+0x2c6/0x330 [ 326.315587][T16451] do_syscall_64+0xfa/0x760 [ 326.320085][T16451] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 326.325954][T16451] RIP: 0033:0x459a59 [ 326.329832][T16451] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 326.349675][T16451] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 326.358072][T16451] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 326.366036][T16451] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 326.373987][T16451] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 21:14:36 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{0x0, 0x0, 0x8}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00', 0xffffffff}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r4, 0x0, 0x0, 0x0) ioctl$TIOCMBIS(r4, 0x5416, &(0x7f0000000140)=0x8000) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r5, 0x0, 0x0, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) ioctl$KVM_RUN(r9, 0x4004ae8b, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f00000005c0)=0x0) r11 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r11, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setreuid(0x0, r12) r13 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_cred(r13, 0x1, 0x11, &(0x7f00000014c0)={0x0, 0x0, 0x0}, &(0x7f0000001480)=0xc) setregid(0xee01, r14) r15 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r16 = ioctl$KVM_CREATE_VM(r15, 0xae01, 0x0) r17 = ioctl$KVM_CREATE_VCPU(r16, 0xae41, 0x0) ioctl$KVM_RUN(r17, 0x4004ae8b, 0x0) r18 = gettid() ptrace$setopts(0x4206, r18, 0x0, 0x0) tkill(r18, 0x3c) ptrace$cont(0x18, r18, 0x0, 0x0) ptrace$setregs(0xd, r18, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r18, 0x0, 0x0) getresuid(&(0x7f0000000600), &(0x7f0000000640)=0x0, &(0x7f0000000680)) r20 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_cred(r20, 0x1, 0x11, &(0x7f00000014c0)={0x0, 0x0, 0x0}, &(0x7f0000001480)=0xc) setregid(0xee01, r21) sendmsg$unix(r2, &(0x7f0000000740)={&(0x7f0000000180)=@abs={0x2, 0x0, 0x4e22}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000240)="181e1c72", 0x4}, {&(0x7f0000000280)="a735078248fa2d9b249e4821c4fb1937631c2661ede97f81c6488b5856aa51fcf2e618f3d75d6e26f77d46ac6f4a7efd3f36f25aea2904d1737ec23a630830e8867204cb927fb54dbd2eb82740c19c37863b6d402c3005e1ef4cb146b43dd1fec3a8ca4e3d5dcbcbdb6546a99a143f0db5d5346dac869ea525bef3c713", 0x7d}, {&(0x7f0000000300)}, {&(0x7f0000000340)="c4cdded902b8a64c89cc24dc3a2f99875b1206ed828512ea93052e04ea8d279ca2c594e1c15e391d4bdda032339738d3493ef3cade0361ffc10aa647a62727128a83a84b2e42687ff6246886dd61dce1087b7983ebf45ff91c40d2bb52ffef646011e82c7d7f7b993cae385add47456b8e5426827a86215f043afcc3610dbf03d1fa1b26c072310f9000dbd9aa821517e3325e1952b1b359de742a992d365113fade587ba47fafbed045b40eb1f816145730c5869bb58d84bf9a3a8b36a69ec7523d1aac3f5673357d056f6d790552ea9fef030c2740f19a7c9b12f360084a23bc908e81bdcdca283e80505f9aa1c314cee607c94d407bf37c5f4d18", 0xfc}, {&(0x7f0000000440)="78d59b18c17958b077075e341c0884bea075236f81b181040090295aebe11e19c93029aa2b148ec856d046b10fab90087da14057a0206741d379c06aefa9d9af2122652e9cbaa4b98d6b20485e8f4a0f6200f844b160bea123430dfcc80ac586ae03ca7a791799b90f0cff9e0b26c10ed1d020753ae7f315b0d1e44a1fd3e072391a7253d5cae4e1f6bb6fb3496ebe7061da0e305b818b43698574fb7f854cbc763a86333793b525d10a3a47fe80ed635ad7745571a4e9f0e06d2025e559d31a6ec0aa8ddcf8cac6735ebd84dcdb9fbd271a0c3a24b057758fa72c37ec14ae0cd5329a1c9f30c689125f77b449577d2fab11a51010480658227f", 0xfa}], 0x5, &(0x7f00000006c0)=[@rights={{0x28, 0x1, 0x1, [r6, r3, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9]}}, @cred={{0x1c, 0x1, 0x2, {r10, r12, r14}}}, @rights={{0x18, 0x1, 0x1, [r17, 0xffffffffffffffff]}}, @cred={{0x1c, 0x1, 0x2, {r18, r19, r21}}}], 0x80, 0x4000000}, 0x10000000) ioctl$TUNSETNOCSUM(r5, 0x400454c8, 0x0) dup2(r0, r1) 21:14:36 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05"], 0x9c}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) [ 326.381949][T16451] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 326.389902][T16451] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 [ 326.426733][T16458] input: syz1 as /devices/virtual/input/input206 21:14:36 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91", 0x54}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 21:14:36 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r1, 0x0, 0x0, 0x0) write$FUSE_POLL(r1, &(0x7f0000000100)={0x18, 0x0, 0x7, {0x8}}, 0x18) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r2 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000080)=@file={0x0, './file0\x00'}, 0x6e) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r2) 21:14:36 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5460) 21:14:36 executing program 3 (fault-call:11 fault-nth:23): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:14:36 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) bind$inet(r3, &(0x7f0000000480)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x24e23, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) write$binfmt_elf64(r3, &(0x7f00000000c0)=ANY=[@ANYRES64], 0xc63b9e35) setsockopt(r3, 0xe2d, 0x8, &(0x7f0000000240)="1cba3d19d8b8bc5e74c6bd0f39fcae1f09dcd36e85fb065cd22cd3dc87a80e6e66d55a0f2519ce2f33490e3d9b950b44abab3447afa839e08a1b5ee6d800f3dc16a59f4afdc50aeba029da733a76f6a9a8b7c872a09464dba6eec10cebb15e9236adc2f70320eccca496dfb6b88b93c8ecebb5e42137dfba5982265849aa3b2473817237e000f576cc470c75d417643aca53a4f3a5a627d76e66fb68dfda2d0f328fcf2ec27622701278a8986467bc3f25179f39e86da37e6796dfff2dd1b065e498fdb69615b10285facc5eafaf", 0xce) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x1, 0x2) r5 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self/net/pfkey\x00', 0x101002, 0x0) ioctl$IMCLEAR_L2(r5, 0x80044946, &(0x7f0000000140)=0xfffffffb) ioctl$VIDIOC_S_EXT_CTRLS(r4, 0xc0205648, &(0x7f0000000000)={0x0, 0x1, 0x0, [], &(0x7f00000001c0)={0xf0f045, 0x0, [], @ptr}}) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 326.807423][T16463] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 326.820572][T16484] FAULT_INJECTION: forcing a failure. [ 326.820572][T16484] name failslab, interval 1, probability 0, space 0, times 0 [ 326.844220][T16463] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 326.859413][T16486] input: syz1 as /devices/virtual/input/input210 [ 326.871828][T16481] input: syz1 as /devices/virtual/input/input209 [ 326.878845][T16484] CPU: 0 PID: 16484 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 326.886763][T16484] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 326.896966][T16484] Call Trace: [ 326.900270][T16484] dump_stack+0x172/0x1f0 [ 326.904618][T16484] should_fail.cold+0xa/0x15 [ 326.909226][T16484] ? fault_create_debugfs_attr+0x180/0x180 [ 326.915042][T16484] ? ___might_sleep+0x163/0x2c0 [ 326.915066][T16484] __should_failslab+0x121/0x190 [ 326.915086][T16484] should_failslab+0x9/0x14 [ 326.915103][T16484] kmem_cache_alloc_node_trace+0x274/0x750 [ 326.915123][T16484] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 326.924883][T16484] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 326.924906][T16484] __kmalloc_node_track_caller+0x3d/0x70 [ 326.924926][T16484] __kmalloc_reserve.isra.0+0x40/0xf0 [ 326.924942][T16484] __alloc_skb+0x10b/0x5e0 [ 326.924958][T16484] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 326.924977][T16484] ? raw_getfrag+0x164/0x230 [ 326.939690][T16463] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 326.941213][T16484] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 326.941240][T16484] __ip_append_data.isra.0+0x2667/0x30d0 [ 326.941264][T16484] ? raw_destroy+0x30/0x30 [ 326.941281][T16484] ? __lock_acquire+0x16f2/0x4a00 [ 326.941303][T16484] ? __ip_flush_pending_frames.isra.0+0x2d0/0x2d0 [ 326.952716][T16484] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 326.952734][T16484] ? ip_setup_cork+0x59c/0x8e0 [ 326.952751][T16484] ? raw_destroy+0x30/0x30 [ 326.952768][T16484] ip_append_data.part.0+0xf2/0x170 [ 326.952793][T16484] ? raw_destroy+0x30/0x30 [ 326.962545][T16484] ip_append_data+0x6e/0x90 [ 326.962570][T16484] raw_sendmsg+0xba8/0x2f40 [ 326.962600][T16484] ? dst_output+0x170/0x170 [ 326.962622][T16484] ? lock_downgrade+0x920/0x920 [ 326.962641][T16484] ? __kasan_check_write+0x14/0x20 [ 326.972756][T16484] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 326.972774][T16484] ? aa_label_sk_perm+0x91/0xf0 [ 326.972795][T16484] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 326.972808][T16484] ? aa_sk_perm+0x288/0x880 [ 326.972824][T16484] ? __kasan_check_read+0x11/0x20 [ 327.003152][T16484] ? __lock_acquire+0x8a0/0x4a00 [ 327.003176][T16484] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 327.003201][T16484] inet_sendmsg+0x9e/0xe0 [ 327.015820][T16484] ? inet_sendmsg+0x9e/0xe0 [ 327.015836][T16484] ? inet_send_prepare+0x4f0/0x4f0 [ 327.015856][T16484] sock_sendmsg+0xd7/0x130 [ 327.015871][T16484] kernel_sendmsg+0x44/0x50 [ 327.015889][T16484] sock_no_sendpage+0x116/0x150 [ 327.015902][T16484] ? sock_kzfree_s+0x70/0x70 [ 327.015917][T16484] ? mark_lock+0xc2/0x1220 [ 327.015937][T16484] ? mark_held_locks+0xa4/0xf0 [ 327.025086][T16484] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 327.034660][T16484] ? debug_check_no_obj_freed+0x20a/0x43f [ 327.034677][T16484] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 327.034698][T16484] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 327.034717][T16484] inet_sendpage+0x10f/0x150 [ 327.034739][T16484] kernel_sendpage+0x92/0xf0 [ 327.034751][T16484] ? inet_sendmsg+0xe0/0xe0 [ 327.034766][T16484] sock_sendpage+0x8b/0xc0 [ 327.034787][T16484] pipe_to_sendpage+0x296/0x360 [ 327.064784][T16463] EXT4-fs (loop0): corrupt root inode, run e2fsck [ 327.069249][T16484] ? kernel_sendpage+0xf0/0xf0 [ 327.069270][T16484] ? direct_splice_actor+0x190/0x190 [ 327.069287][T16484] ? __put_page+0xa7/0xe0 [ 327.069304][T16484] ? anon_pipe_buf_release+0x1c6/0x270 [ 327.083882][T16463] EXT4-fs (loop0): mount failed [ 327.084444][T16484] __splice_from_pipe+0x397/0x7d0 [ 327.084461][T16484] ? direct_splice_actor+0x190/0x190 [ 327.084483][T16484] ? direct_splice_actor+0x190/0x190 [ 327.084497][T16484] splice_from_pipe+0x108/0x170 [ 327.084515][T16484] ? splice_shrink_spd+0xd0/0xd0 [ 327.240294][T16484] ? apparmor_file_permission+0x25/0x30 [ 327.245830][T16484] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 327.252081][T16484] ? security_file_permission+0x8f/0x380 [ 327.257715][T16484] generic_splice_sendpage+0x3c/0x50 [ 327.262986][T16484] ? splice_from_pipe+0x170/0x170 [ 327.268013][T16484] do_splice+0x708/0x1410 [ 327.272344][T16484] ? opipe_prep.part.0+0x2e0/0x2e0 [ 327.277451][T16484] ? __fget_light+0x1a9/0x230 [ 327.282120][T16484] __x64_sys_splice+0x2c6/0x330 [ 327.286967][T16484] do_syscall_64+0xfa/0x760 [ 327.291896][T16484] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 327.297777][T16484] RIP: 0033:0x459a59 [ 327.301678][T16484] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 327.321272][T16484] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 327.329671][T16484] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 327.337628][T16484] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 327.345603][T16484] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 327.353571][T16484] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 327.361530][T16484] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 21:14:37 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0xe3d8a857df463cfc, 0x0) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:37 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05"], 0x9c}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:37 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91", 0x54}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 327.472807][T16481] input: syz1 as /devices/virtual/input/input212 21:14:37 executing program 3 (fault-call:11 fault-nth:24): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:14:37 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) r3 = syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0x6fe, 0x200) bind$netrom(r3, &(0x7f0000000140)={{0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x8}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) 21:14:37 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0x1, 0x2) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f00000000c0)={0x2, 0x0, @ioapic={0x1000, 0x1, 0xffffffff, 0x581, 0x0, [{0x8, 0x9, 0x0, [], 0xf8}, {0x28, 0x5, 0x41, [], 0x4}, {0x2, 0x49, 0x3, [], 0x8}, {0x11, 0x7, 0x0, [], 0x40}, {0x9, 0x7f, 0x7, [], 0xfb}, {0x2c, 0x5, 0x8, [], 0xf4}, {0x1f, 0x20, 0xff, [], 0x80}, {0x7f, 0x4, 0x2, [], 0x51}, {0x6, 0x1, 0x1f, [], 0x4e}, {0xf9, 0x3, 0x5a, [], 0x7}, {0x0, 0x3, 0x7f, [], 0x7f}, {0xfe, 0x8, 0x8, [], 0x1}, {0x3f, 0x8, 0x40, [], 0xf9}, {0x81, 0x7f, 0x40, [], 0x80}, {0x5, 0x80, 0x6, [], 0x8}, {0x57, 0x1, 0xf7, [], 0x78}, {0x8, 0x4, 0x1, [], 0x60}, {0x3, 0x1, 0x0, [], 0x1}, {0x81, 0x0, 0x8, [], 0x9}, {0x2, 0x8, 0x9d, [], 0x2}, {0x6, 0x5, 0x0, [], 0x8}, {0x6, 0xd2, 0x7f, [], 0xed}, {0x7, 0x80, 0x9, [], 0x1}, {0xb0, 0x5, 0x1, [], 0xb8}]}}) r2 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r2) 21:14:37 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5501) [ 327.746867][T16513] input: syz1 as /devices/virtual/input/input213 [ 327.818765][T16523] FAULT_INJECTION: forcing a failure. [ 327.818765][T16523] name failslab, interval 1, probability 0, space 0, times 0 [ 327.865081][T16525] input: syz1 as /devices/virtual/input/input215 [ 327.871671][T16523] CPU: 1 PID: 16523 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 327.879560][T16523] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 327.889610][T16523] Call Trace: [ 327.889635][T16523] dump_stack+0x172/0x1f0 [ 327.889658][T16523] should_fail.cold+0xa/0x15 [ 327.889678][T16523] ? fault_create_debugfs_attr+0x180/0x180 [ 327.889701][T16523] ? ___might_sleep+0x163/0x2c0 [ 327.912515][T16523] __should_failslab+0x121/0x190 [ 327.917472][T16523] should_failslab+0x9/0x14 [ 327.922339][T16504] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 327.922942][T16523] kmem_cache_alloc_node+0x268/0x740 [ 327.934990][T16504] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 327.937913][T16523] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 327.937931][T16523] ? ip_generic_getfrag+0x120/0x230 [ 327.937955][T16523] __alloc_skb+0xd5/0x5e0 [ 327.937979][T16523] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 327.947863][T16504] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 327.954957][T16523] ? raw_getfrag+0x164/0x230 [ 327.954976][T16523] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 327.954999][T16523] __ip_append_data.isra.0+0x2667/0x30d0 [ 327.955021][T16523] ? raw_destroy+0x30/0x30 [ 327.955039][T16523] ? __lock_acquire+0x16f2/0x4a00 [ 327.955062][T16523] ? __ip_flush_pending_frames.isra.0+0x2d0/0x2d0 [ 327.979728][T16523] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 327.979751][T16523] ? ip_setup_cork+0x59c/0x8e0 [ 328.011479][T16523] ? raw_destroy+0x30/0x30 [ 328.011498][T16523] ip_append_data.part.0+0xf2/0x170 [ 328.011519][T16523] ? raw_destroy+0x30/0x30 [ 328.011534][T16523] ip_append_data+0x6e/0x90 [ 328.011558][T16523] raw_sendmsg+0xba8/0x2f40 [ 328.022546][T16523] ? dst_output+0x170/0x170 [ 328.022572][T16523] ? lock_downgrade+0x920/0x920 [ 328.022591][T16523] ? __kasan_check_write+0x14/0x20 [ 328.022623][T16523] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 328.066645][T16523] ? aa_label_sk_perm+0x91/0xf0 [ 328.071595][T16523] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 328.077219][T16523] ? aa_sk_perm+0x288/0x880 [ 328.081701][T16523] ? __kasan_check_read+0x11/0x20 [ 328.086706][T16523] ? __lock_acquire+0x8a0/0x4a00 [ 328.091642][T16523] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 328.097191][T16523] inet_sendmsg+0x9e/0xe0 [ 328.101529][T16523] ? inet_sendmsg+0x9e/0xe0 [ 328.106023][T16523] ? inet_send_prepare+0x4f0/0x4f0 [ 328.111116][T16523] sock_sendmsg+0xd7/0x130 [ 328.115532][T16523] kernel_sendmsg+0x44/0x50 [ 328.120033][T16523] sock_no_sendpage+0x116/0x150 [ 328.124873][T16523] ? sock_kzfree_s+0x70/0x70 [ 328.129715][T16523] ? mark_lock+0xc2/0x1220 [ 328.134140][T16523] ? mark_held_locks+0xa4/0xf0 [ 328.138907][T16523] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 328.144699][T16523] ? debug_check_no_obj_freed+0x20a/0x43f [ 328.150397][T16523] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 328.156184][T16523] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 328.162431][T16523] inet_sendpage+0x10f/0x150 [ 328.167094][T16523] kernel_sendpage+0x92/0xf0 [ 328.171663][T16523] ? inet_sendmsg+0xe0/0xe0 [ 328.176165][T16523] sock_sendpage+0x8b/0xc0 [ 328.180569][T16523] pipe_to_sendpage+0x296/0x360 [ 328.185401][T16523] ? kernel_sendpage+0xf0/0xf0 [ 328.190146][T16523] ? direct_splice_actor+0x190/0x190 [ 328.195415][T16523] ? __put_page+0xa7/0xe0 [ 328.199760][T16523] ? anon_pipe_buf_release+0x1c6/0x270 [ 328.205207][T16523] __splice_from_pipe+0x397/0x7d0 [ 328.210227][T16523] ? direct_splice_actor+0x190/0x190 [ 328.215504][T16523] ? direct_splice_actor+0x190/0x190 [ 328.220776][T16523] splice_from_pipe+0x108/0x170 [ 328.225672][T16523] ? splice_shrink_spd+0xd0/0xd0 [ 328.230644][T16523] ? apparmor_file_permission+0x25/0x30 [ 328.236173][T16523] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 328.242399][T16523] ? security_file_permission+0x8f/0x380 [ 328.248017][T16523] generic_splice_sendpage+0x3c/0x50 [ 328.253285][T16523] ? splice_from_pipe+0x170/0x170 [ 328.258338][T16523] do_splice+0x708/0x1410 [ 328.262678][T16523] ? opipe_prep.part.0+0x2e0/0x2e0 [ 328.267773][T16523] ? __fget_light+0x1a9/0x230 [ 328.272446][T16523] __x64_sys_splice+0x2c6/0x330 [ 328.277293][T16523] do_syscall_64+0xfa/0x760 [ 328.281806][T16523] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 328.287681][T16523] RIP: 0033:0x459a59 [ 328.291561][T16523] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 21:14:38 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91", 0x54}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 328.311266][T16523] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 328.319692][T16523] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 328.327652][T16523] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 328.335604][T16523] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 328.343564][T16523] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 328.351709][T16523] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 21:14:38 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/d\t.\xfe\x06\x00\x00\x002t\x00', 0x0, 0x0) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/btrfs-control\x00', 0x440100, 0x0) write$FUSE_IOCTL(r1, &(0x7f00000000c0)={0x20, 0x0, 0x5, {0x10000, 0x0, 0x9, 0xa9}}, 0x20) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) accept$inet6(r1, &(0x7f0000000100), &(0x7f0000000140)=0x1c) r2 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r2) ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f0000000280)=0xffffffffffffffff) r3 = add_key$keyring(&(0x7f0000000980)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0x0) keyctl$get_keyring_id(0x0, r3, 0x0) keyctl$get_security(0x11, r3, &(0x7f0000000180)=""/167, 0xa7) [ 328.422937][T16504] EXT4-fs (loop0): corrupt root inode, run e2fsck [ 328.451207][T16504] EXT4-fs (loop0): mount failed 21:14:38 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r1, 0x0, 0x0, 0x0) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000080)={{0x0, 0x2}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r2, 0x0, 0x0, 0x0) ioctl$UI_SET_LEDBIT(r2, 0x40045569, 0x1) r3 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r3) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, 0x0, 0x0) connect$inet6(r5, &(0x7f0000d83fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, 0x0, &(0x7f0000000180)) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r6, 0x84, 0x1d, &(0x7f000095dff8)=ANY=[@ANYBLOB="01000000", @ANYRES32=0x0], &(0x7f0000000180)=0x8) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r5, 0x84, 0x14, &(0x7f0000000200)=@assoc_value={r7}, 0x8) getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000140)=@assoc_value={r7, 0x4}, &(0x7f0000000180)=0x8) inotify_init1(0x800) [ 328.507147][T16541] input: syz1 as /devices/virtual/input/input217 21:14:38 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05"], 0x9c}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:38 executing program 3 (fault-call:11 fault-nth:25): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:14:38 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/de/inp\x04\x00/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:38 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5503) [ 328.784173][T16564] input: syz1 as /devices/virtual/input/input220 [ 328.796603][T16566] FAULT_INJECTION: forcing a failure. [ 328.796603][T16566] name failslab, interval 1, probability 0, space 0, times 0 [ 328.818130][T16566] CPU: 1 PID: 16566 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 328.826052][T16566] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 328.836104][T16566] Call Trace: [ 328.836128][T16566] dump_stack+0x172/0x1f0 [ 328.836149][T16566] should_fail.cold+0xa/0x15 [ 328.836169][T16566] ? fault_create_debugfs_attr+0x180/0x180 [ 328.836190][T16566] ? ___might_sleep+0x163/0x2c0 [ 328.854310][T16566] __should_failslab+0x121/0x190 [ 328.864065][T16566] should_failslab+0x9/0x14 [ 328.868572][T16566] kmem_cache_alloc_node_trace+0x274/0x750 [ 328.868592][T16566] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 328.868607][T16566] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 328.868629][T16566] __kmalloc_node_track_caller+0x3d/0x70 [ 328.868653][T16566] __kmalloc_reserve.isra.0+0x40/0xf0 [ 328.886180][T16566] __alloc_skb+0x10b/0x5e0 [ 328.886200][T16566] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 328.886219][T16566] ? raw_getfrag+0x164/0x230 [ 328.886236][T16566] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 328.886257][T16566] __ip_append_data.isra.0+0x2667/0x30d0 [ 328.886277][T16566] ? raw_destroy+0x30/0x30 [ 328.897243][T16566] ? __lock_acquire+0x16f2/0x4a00 [ 328.897269][T16566] ? __ip_flush_pending_frames.isra.0+0x2d0/0x2d0 [ 328.897291][T16566] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 328.897305][T16566] ? ip_setup_cork+0x59c/0x8e0 [ 328.897320][T16566] ? raw_destroy+0x30/0x30 [ 328.897336][T16566] ip_append_data.part.0+0xf2/0x170 [ 328.897355][T16566] ? raw_destroy+0x30/0x30 [ 328.963972][T16566] ip_append_data+0x6e/0x90 [ 328.968562][T16566] raw_sendmsg+0xba8/0x2f40 [ 328.973067][T16566] ? dst_output+0x170/0x170 [ 328.977588][T16566] ? lock_downgrade+0x920/0x920 [ 328.982434][T16566] ? __kasan_check_write+0x14/0x20 [ 328.987544][T16566] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 328.993785][T16566] ? aa_label_sk_perm+0x91/0xf0 [ 328.998637][T16566] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 329.004270][T16566] ? aa_sk_perm+0x288/0x880 [ 329.008770][T16566] ? __kasan_check_read+0x11/0x20 [ 329.013795][T16566] ? __lock_acquire+0x8a0/0x4a00 [ 329.018718][T16566] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 329.024267][T16566] inet_sendmsg+0x9e/0xe0 [ 329.028581][T16566] ? inet_sendmsg+0x9e/0xe0 [ 329.033080][T16566] ? inet_send_prepare+0x4f0/0x4f0 [ 329.038178][T16566] sock_sendmsg+0xd7/0x130 [ 329.043101][T16566] kernel_sendmsg+0x44/0x50 [ 329.047621][T16566] sock_no_sendpage+0x116/0x150 [ 329.052457][T16566] ? sock_kzfree_s+0x70/0x70 [ 329.057033][T16566] ? mark_lock+0xc2/0x1220 [ 329.061457][T16566] ? mark_held_locks+0xa4/0xf0 [ 329.066210][T16566] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 329.072780][T16566] ? debug_check_no_obj_freed+0x20a/0x43f [ 329.078482][T16566] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 329.084277][T16566] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 329.090506][T16566] inet_sendpage+0x10f/0x150 [ 329.095098][T16566] kernel_sendpage+0x92/0xf0 [ 329.099674][T16566] ? inet_sendmsg+0xe0/0xe0 [ 329.104164][T16566] sock_sendpage+0x8b/0xc0 [ 329.108927][T16566] pipe_to_sendpage+0x296/0x360 [ 329.113778][T16566] ? kernel_sendpage+0xf0/0xf0 [ 329.118544][T16566] ? direct_splice_actor+0x190/0x190 [ 329.123815][T16566] ? __put_page+0xa7/0xe0 [ 329.128415][T16566] ? anon_pipe_buf_release+0x1c6/0x270 [ 329.133864][T16566] __splice_from_pipe+0x397/0x7d0 [ 329.138876][T16566] ? direct_splice_actor+0x190/0x190 [ 329.144151][T16566] ? direct_splice_actor+0x190/0x190 [ 329.150377][T16566] splice_from_pipe+0x108/0x170 [ 329.155491][T16566] ? splice_shrink_spd+0xd0/0xd0 [ 329.160431][T16566] ? apparmor_file_permission+0x25/0x30 [ 329.166768][T16566] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 329.173010][T16566] ? security_file_permission+0x8f/0x380 [ 329.178721][T16566] generic_splice_sendpage+0x3c/0x50 [ 329.183993][T16566] ? splice_from_pipe+0x170/0x170 [ 329.189004][T16566] do_splice+0x708/0x1410 [ 329.194025][T16566] ? opipe_prep.part.0+0x2e0/0x2e0 [ 329.199211][T16566] ? __fget_light+0x1a9/0x230 [ 329.203875][T16566] __x64_sys_splice+0x2c6/0x330 [ 329.208717][T16566] do_syscall_64+0xfa/0x760 [ 329.213208][T16566] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 329.219218][T16566] RIP: 0033:0x459a59 [ 329.223796][T16566] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 329.243493][T16566] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 329.251898][T16566] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 329.259861][T16566] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 329.267819][T16566] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 329.275773][T16566] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 21:14:39 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r3, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r4, 0x0, 0x0, 0x0) ioctl$UI_DEV_DESTROY(r4, 0x5502) dup2(r0, r1) 21:14:39 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 329.283826][T16566] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 [ 329.384685][T16565] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 329.404131][T16573] input: syz1 as /devices/virtual/input/input221 [ 329.435092][T16565] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 329.467922][T16584] input: syz1 as /devices/virtual/input/input225 21:14:39 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x154802) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r2, 0x0, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r2, 0x5, 0x0, 0x0) [ 329.482427][T16565] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock 21:14:39 executing program 3 (fault-call:11 fault-nth:26): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:14:39 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5504) [ 329.612556][T16565] EXT4-fs: failed to create workqueue [ 329.639977][T16565] EXT4-fs (loop0): mount failed 21:14:39 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='?d7\xce\xe5\x17Q\xb6\x02\x00', 0x1004, 0x0) kexec_load(0xa71, 0x3, &(0x7f0000000540)=[{&(0x7f0000000100)="a271938d2a9954899e1645affc3dbf737488781c5a5f4505cc0327ff19e22e541be9a8544a0366c1cbacb86534875b1cb41b57b91c4d6a93116612d70ebd014b876e6babbbf3242b7de9cbb3a9c4955a83250c8d767bc36df5b03d68bd5cf8427cd04e77aa56e381f9576ebb0cff00a7d470d3835fd80d5160b7a1e746c25ec37da3be0d56b9a3ddb24f03a75189409a05a8922d489e5e58abeb6faca79f0db8b2aeca7fb4e65ada00a1ac657078a7d4771e1e72735a58a9495f6f97eea2f751db9837372cebce6f66b0324dc6e7b33422e74c418ea48656658608315720b847c2b972fce8758b9a214d62f9fb9f68642a39da426508d1fcae42a9e5d0", 0xfd, 0xfffffffffffffffa, 0x1f}, {&(0x7f0000000480)="981b53bb7ba1976b7ae996f66e4e8cf59edb6127a269bc438bfbea94c88621fc3c55a2469aeef88f5d36a299ed04babc867a4b2d0b3b6a33d7713a5431e731ad2062623882157d7d719ab2f61b7813c6ded93725e5df4d31e5783f767a4fc76e9601009cc34cb80baff402096fd6126e818869aebbf4f443a1e6da00c3a0ea469cefaccec596f89bd0b7bf3d48b892fab71dff4a4073cdc8d3660b1f7810399ef86587e700000000f3a80ba8", 0xffffffffffffff34, 0x2, 0x100000000}, {&(0x7f0000000400)="1bf4b9af0086c8900aa3d4cd39eb4f3c1c3391e0f9f1e9afff2718f419b29ceb08a7865b4f815446dfd69d1587fc9299a2cef3c872ded58bc06bf144faa91f436bb019e824b5884577f1900975d4", 0x4e, 0x0, 0x2000400}], 0x30000) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) prctl$PR_SET_UNALIGN(0x6, 0x3) rename(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='./file0\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:39 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x87}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:39 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='*dev/input/event#\x00', 0x80, 0x107401) pread64(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/autofs\x00', 0x8000, 0x0) io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000200)=r2, 0x1) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) sendto$isdn(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="06000000ffffffff1a522765d3cbf838644f7165f2f9f1cdc513a30c527c8191974eaa3e8d5aa834614f472e569032888575da899e5b9971533024426721868766d828d01d642560c807f0a3f974a6b360b1ac0656adee3a344b301b0b2b401fc9339a56ee533aec8fa761a918f6a4e9b2b4df69897bee68743943a4c3590d24678aa35bd4475966296907bd20d8b3cb73679f4d43b96e63649e13812ea6d156a5962265b444d64ea0dc62a289d063c3a7f7dd628a97d568b0f3acb481c27210c5787f2f19786a8721caa33dbc9b7613a77484f88cdb9db3630eeda51d6acef2083f2bbc162e39cfb24a2d3639eff61036940e9ce552e1a0222ca44bb09c97047f5939"], 0xcf, 0x8010, &(0x7f0000000180)={0x22, 0x1, 0x0, 0x6, 0x42}, 0x6) [ 329.772364][T16598] FAULT_INJECTION: forcing a failure. [ 329.772364][T16598] name failslab, interval 1, probability 0, space 0, times 0 [ 329.798931][T16598] CPU: 1 PID: 16598 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 329.806856][T16598] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 329.806863][T16598] Call Trace: [ 329.806886][T16598] dump_stack+0x172/0x1f0 [ 329.806908][T16598] should_fail.cold+0xa/0x15 [ 329.806928][T16598] ? fault_create_debugfs_attr+0x180/0x180 [ 329.806955][T16598] __should_failslab+0x121/0x190 [ 329.806975][T16598] should_failslab+0x9/0x14 [ 329.844439][T16598] kmem_cache_alloc+0x47/0x710 [ 329.849220][T16598] ? lock_downgrade+0x920/0x920 [ 329.849248][T16598] skb_clone+0x154/0x3d0 [ 329.858321][T16598] ip_mc_output+0x3aa/0xf70 [ 329.858345][T16598] ? __ip_queue_xmit+0x1c10/0x1c10 [ 329.858367][T16598] ? ip_append_data.part.0+0x170/0x170 [ 329.858382][T16598] ? dst_release+0x62/0xe0 [ 329.858402][T16598] ? __ip_make_skb+0xf31/0x17b0 [ 329.863048][T16607] input: syz1 as /devices/virtual/input/input230 [ 329.868002][T16598] ip_local_out+0xbb/0x1b0 [ 329.868020][T16598] ip_send_skb+0x42/0xf0 [ 329.868037][T16598] ip_push_pending_frames+0x64/0x80 [ 329.868055][T16598] raw_sendmsg+0x13c4/0x2f40 [ 329.868082][T16598] ? dst_output+0x170/0x170 [ 329.868106][T16598] ? lock_downgrade+0x920/0x920 [ 329.868128][T16598] ? __kasan_check_write+0x14/0x20 21:14:40 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x74e83c3caff8fb50, 0x0) socket$key(0xf, 0x3, 0x2) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r1, 0xc0605345, &(0x7f00000001c0)={0x4, 0x3, {0x2, 0x2, 0x8000, 0x3, 0xd4}}) r2 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x400200, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r3, 0x28, 0x0, &(0x7f00000000c0)=0x100000000, 0x8) r4 = accept4$tipc(r3, &(0x7f0000000100)=@name, &(0x7f0000000140)=0x10, 0x800) dup2(r4, r2) [ 329.878007][T16598] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 329.878026][T16598] ? aa_label_sk_perm+0x91/0xf0 [ 329.878046][T16598] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 329.878061][T16598] ? aa_sk_perm+0x288/0x880 [ 329.878074][T16598] ? __kasan_check_read+0x11/0x20 [ 329.878092][T16598] ? __lock_acquire+0x8a0/0x4a00 [ 329.897995][T16598] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 329.898020][T16598] inet_sendmsg+0x9e/0xe0 [ 329.898034][T16598] ? inet_sendmsg+0x9e/0xe0 [ 329.898048][T16598] ? inet_send_prepare+0x4f0/0x4f0 [ 329.898066][T16598] sock_sendmsg+0xd7/0x130 [ 329.898089][T16598] kernel_sendmsg+0x44/0x50 [ 329.907880][T16598] sock_no_sendpage+0x116/0x150 [ 329.907897][T16598] ? sock_kzfree_s+0x70/0x70 [ 329.907916][T16598] ? mark_lock+0xc2/0x1220 [ 329.907938][T16598] ? mark_held_locks+0xa4/0xf0 [ 329.907961][T16598] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 329.917284][T16598] ? debug_check_no_obj_freed+0x20a/0x43f [ 329.917301][T16598] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 329.917321][T16598] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 329.917342][T16598] inet_sendpage+0x10f/0x150 [ 329.917365][T16598] kernel_sendpage+0x92/0xf0 [ 329.917376][T16598] ? inet_sendmsg+0xe0/0xe0 [ 329.917393][T16598] sock_sendpage+0x8b/0xc0 [ 329.917412][T16598] pipe_to_sendpage+0x296/0x360 [ 329.917431][T16598] ? kernel_sendpage+0xf0/0xf0 [ 329.929622][T16598] ? direct_splice_actor+0x190/0x190 [ 329.929642][T16598] ? __put_page+0xa7/0xe0 [ 329.929659][T16598] ? anon_pipe_buf_release+0x1c6/0x270 [ 329.929679][T16598] __splice_from_pipe+0x397/0x7d0 [ 329.929697][T16598] ? direct_splice_actor+0x190/0x190 [ 330.015643][T16598] ? direct_splice_actor+0x190/0x190 [ 330.015661][T16598] splice_from_pipe+0x108/0x170 [ 330.015681][T16598] ? splice_shrink_spd+0xd0/0xd0 [ 330.015703][T16598] ? apparmor_file_permission+0x25/0x30 [ 330.015726][T16598] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 330.027751][T16598] ? security_file_permission+0x8f/0x380 [ 330.027777][T16598] generic_splice_sendpage+0x3c/0x50 [ 330.027793][T16598] ? splice_from_pipe+0x170/0x170 [ 330.027808][T16598] do_splice+0x708/0x1410 [ 330.027832][T16598] ? opipe_prep.part.0+0x2e0/0x2e0 [ 330.037066][T16598] ? __fget_light+0x1a9/0x230 [ 330.037090][T16598] __x64_sys_splice+0x2c6/0x330 [ 330.037115][T16598] do_syscall_64+0xfa/0x760 [ 330.037136][T16598] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 330.037148][T16598] RIP: 0033:0x459a59 [ 330.037163][T16598] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 330.037171][T16598] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 330.037184][T16598] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 330.037198][T16598] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 330.046079][T16598] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 330.046088][T16598] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 21:14:40 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x440) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) r3 = syz_open_dev$radio(&(0x7f0000000140)='/dev/radio#\x00', 0x0, 0x2) ioctl$USBDEVFS_CONTROL(r3, 0xc0185500, &(0x7f0000000180)={0x1f, 0x16, 0x0, 0x2, 0x92, 0xff, &(0x7f0000000240)="c30925f9e79a969cd2100cdbbe537576fde544f724aa06d8ada6e03e526cabe3d4abca94cb920aa47f087aa0597405cf9adf052b272b3c0e817cec0ef37dba648ab1895ecc38327597efd012f82e37a59bf19dec138261ea9348f565863103fb984c4a78eb59c9c1c2ae422031782c99ee58bcfc35f468bced3ddcfca2e7cf3af181f511b24bc8db5e8d4ac86b8fe0f6c0a8"}) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f00000001c0)) pread64(r4, 0x0, 0x0, 0x0) syz_open_dev$mice(&(0x7f0000000300)='/dev/input/mice\x00', 0x0, 0xacc02) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) io_cancel(0x0, &(0x7f0000001340)={0x0, 0x0, 0x0, 0x3, 0xff, r5, &(0x7f0000000340)="a93c90bda82d03b5a68a5a3cd0e463bc4172b9868cad1feb131d37cc4f8ca36cf3569378e508c1e1ac5219fbb68e0d3d045a9c949f6fb40a6d290cb5f2cc714b68c6bafe7cacdbd861524ac48e4a8f74c2615f2be66cc6b117390cb55c73531aeb6e981e3c3541ae256c972d15d80b538bccf184d50d2c6a4a5a1efcd12a6c4f2977e997894cf981915fdc434a447bdf87e5e7958fe4d2c1802b98bb516d769c203d5e9384688fbdfb29d69de64484fada5e337610372386bbc839636a63d68e556bd0a28693644956af20e47199015a8c372851127bdf16399c9e7774372c217386f64a44345ea85def81d56539061d78c1edefca4db248a264553fc0f82857fc985feb45905995afb3ffce61d8581bd1d79fcdc524e77d597b57e3770b6868a53197ace720d22bf379bc0d2eaf4bef408f0ed3d424f269754d17084cbd3a2d7c0654bea780fa66ff9f2237e9f46b8091d72732aa26f744b95bd1bd9ef57a48915d544074e1f019cb6e02f60b00bfe9282a449d046f121af6b6dd290179e246e55c3c71bf56bd42293f201f4a4b56b94822b26c18f895ec031ccf91693999d34de6d0f69381c46aeb60b0c9ee826b79ebae1f2d52e0c6136df93200404a78371f13806c24f8e290cd35b676c02f5f747f849a24b70c12cd88e4899eab7f464887b8363d9bb63c1fc7caeed59c817bec4ac68fc4e6343f88817d6bd0faef57ce60aedc43d1d6041c99193f1e6dc67ef34e45eddce9d6f21e90fa73e871a4b99cf5f743cdad6c609c7d9d56e4380d9dd447df85d5c2e0af12715c277e03fb19d4db47260d12418951d5f21ff5740a790fa6275aadd05f639b9b2a8627abd77015bd2194cf60addb9dcf1497a2a201b2bbbb4ae3e0ee94cc0436023b5182af6db23fbba32aa5c650be6c0fb193b80fb7e6a182f1dbe173602b6b35f512ecbc97bf8002202e19f3d0f73e4ee05ddcf9ad5c35ac11b6635a33dca4f7150d3d429d57e883cc5b63948eeb80052648d94c9e03041198557a51622cebeb3188a12d7e88ec691b2470b08da42d6428d4e2275fcd2e6f4ec5226e78bd4a5f854043131d9b29a95a132c76f13bb2581b52147fe9322d9424ed7bf45dbfe5d37caa824355d45e1ee874704e2049cdb1dfe48173fe45d41d4955498c8299391b15cb1b642e115a3e2aca0a21890d01f3328cb709199295c837f15bc5892bb52b31dfed9d6275a70612a03d29f4134f9bf8e8ff04f342ec5cef59f4482b351926f70ead0b6a58ed52f7cb00c1bfc07ef30f6900ce9ead424d8e784e982fc60b8418fe51f23c34ecf541985cdcd960ca8e6cde07573d2896a735cb5510388952100b7f5356413fb989ed86975373fe4ba6ee210dfc2bc5822d21d1cb75ae84a25e2f28c1bc928460408257ab37938b6c0b0a7cd4f7e7c6aa9ed6331c069d90c0fcf5920e7bfaadb3fe65e147e6d9631dfb2874c2af8d084a49d7adf4f38a5f34e4595c9d8db60946ad0049e55d842af49c4a3dd9e1b7d558f943a080831ca82e574f8b63c8bb86fe0a5ae50c85ac496427f1b14c975079d8e90210ff49a90b8b6dc32c7b0fd77940710c08c85fe22345f5499fa66c91b0bb95e3fc773047850ec283698cb9a0e839302a9cc654e4a8d3700b2f1b4bdfb2387327baacb0d3301ca57112651aa279f5695ba1b9d7e904b82b798c08cb02e35b47a311f8bf77748a50b518b5776dfa4a2a76957831ae079deab2ae810612fc899c69dc1a6458aa0086f871d07baf6a802657c7971c341a9454f1e73879a23407521c64cb0b62ffc1611df6386bb767c9cbccef27edfddbdea15ad18bbcd72f5ac4b4c83c7bc27d5b320865b76006758c17a43a4183df0a645b2c33a83c91bb1bde037a9a488a6f162624eb6b576aa43e741eb4510d27490c562b31b2c395e9f64cd07c548442f6a8ea6834c46a337a2233fd2e87f1845c63a6bfd8ab6542040d655e87fc251ec7f6c19fcce3fb41efcfa409534a97791536eda605dd8bff75068286732948ee1dc4e83b27944a5d3af0623d32db35bdd4234e31291b7eac37412c5ab66743039f30ea0b672a6b40aae96de8e13bedd3c6108239b51ca8ba5a5739846bdea466c72e95f860b9ec5f004f81686a9dda24d69d10f0f93f6f28f1b80f9ea65fc7e23f9eac5243da74ad8f2a48eb7840a46b2d8d2e3f244e76944d0efe9622ff607750ebea21ae28ccfb90b8474a4c1cb0790d2349541662e22589a2ade870b0f00881699483eeef3bc0f2fb9d35afb22ed4f67a20a2f9e3521e144214a83bbaee9ee84502e83aadac7048e85b2e18632de75ff1d15f2be452727dc3fae0f2221150b840bd035c66626f88b20daf44e58150136440ff78ae9bd199e912448ad76640a76c85780acd9812fe7f616892f8d5925245b59a88bee4c33624f3723d7b85404941e77aad38f3f7eda84d35221549664894798ab1d3bb1bfc3fcc695f118372e18893ecc66ebd91f38a81d64abfc24d393839c514ac999e9773773b141b700b407b0e225513e1e81d5b14b0587e49cb9b6b18395b0edc5708d7cd5ae338b719f67d4346f59cbb70de7885940f53ae68143a9e99a2b53bc9852d222465b0745a7a941bbb2591124da6affa75808ce40b9dd55b7cbb679170c844170200bb152d95589817db659ab9e8e00f04d028b8c97d8aa0d473f685dcca0d9c236b9326aa4392fa37168bebc7ff9468352275011cb5136df0ab98f71d8a66b5874a8c6ff16639892b6ad0183f100e07c79598ffaf4cfd98b72acd6282084a50debc163bcc3a3dadea5ef2f15ee6692222fa2effe1a4ef01c025137af7055307d5314834115c0a34466dad14abeba04920b4f78a98a8cf2e98c9516d32977610f4ff93ade011217360595e0ad48ff9b1a9174ad9452f8ead373ed3bf182a4ab5ca189b82e9fc85767f63c64f874176c0af95d00b7e2978b7f8629e5615c818fcf072b3b97597aa33ff528e143b1806958dc13fd44af78a8514fa94b90406b64ea1d4476f24aa49289e563014219a112f8f42a52742bbc397bd6651f9e8c8e6763104319f09b567ab4ffd40f116941257e8401b0c34cd8de7109af8b1746aad7dd8e5127e838549975cdfe759ea18289c643a7861666c87db820fbcee2d8125b643818336e8f54fe6d265d73eab6a64796841e9fe9bbd0c9cd9ceb1656f22e04914440b7fb82161f35d26878203aa12024bbbb39847759c0aacf4087eae94fee5d4f81b3732052e47396562646bb1f8dea2edd4250025c7bbfc1f3d2240f8826cee249c8a228716085b7031cbadc1787fd8e06101ca7e761027531fe24bc60edf20c01843ed06bc647d671f2f4aa049ee47b03500f3aed06f48abec2cacaf9042aaa8324a15c606acda28dc7dd75f1a66a61f1e130a8fc28384ac33881df9686c13c7fabf1dc0ff0a8d5a22c1d8604d7b8584b299b44454004e0438097644b736bc99b47587c8e9480ca1ac4558236522fd65ca1d1b59e1c553c37158222e302a9d1f4fa5f6be049eb6e8a976d70d9029866b394db37296235ac9eab309b80788e4fb6793412db843b264ba7865048a156c8a452834cc8f519ff61ea50d695f9a4cd72ba4fe81fec8747d0d478ebc9cc57a6cf7cb84309ee67207c7e46db602d69ab828a0603dd3b11aef119c08a91ba4661d247d2e1188d72e6eeb29d000c84db12015735ed5b2bc7dd568cacdec102e93174bb1ecbc35542ecfd552c7c1b03eeedb5e1512152231c9a7b5c0bca5613959f4817779a3733eebaee8f5a72215e57e41a2070f900641e74bfbbac993b91701e4d378e99577f76c2cb13889f05d3eee383e28315f775353dc1974227dda44f8fc6efe6d114dfe43a15bb04b0e7106f645d4efc865817f1c83d893f2345ec06d42479161ba56c20508e1913ebd83c22db80b42031a1ee5209aba00481c10f0c8ff079b61ce15c8deaa162ee2128263fb7e09c9ae7e63eb31865008be3506c4d4c5389110865d81d7316c3ac9b373e046fea2dfc0d316704b4a45724ed1306a1884b6c45e6cd9ac80cb5580bfe8f32fe8729cdd9f9004e6feb6f1eed3e303130864b95de9fbdf5fb18553165fcbd1e426af4f7db61a046fba90334103c09f532cc3005e3bd9d01e5107c9f5b93e114f5ef67fa3fe90accfae1c7995b61fa1edc6e0426c8585a02d95062d4781d873dad71a27c07fa6faf45f8c5bfbd8d3dfa5ee233931d602cec0ff4009c523b2bf84ec2a4683c473be28261f1e3210667417261558de7f8ae9062b4f0cf68c5ba071886702645160c5e41c27c9baf28c390947e051c086581b6cea59a431440053cd897c758e644a1722698af06e52483480c8c69c24228f44b7afa2de7337ee60a3e4236a2f501524146981a743485addfa4b804c555257f6703935fe4f2b555915658017f8f116b08b113a44ba8549fe5fba2e9ad1a92fe1a3dd1c5bff58337d50eb3409b8dee7c354dcbecde2d3fc904c501e7ad3ad540077768174a1f806973a0b5563619c0f8beb0e62a3d29fd4e3786d8274adb58667da3d9a454a967f6c530edb54a04238411d02fdd1fb33910607f123cb137cb5fb28c334de23bc8812ce804c394b46f8339768b500c56a84ec19786ea2c02738b1a9d70e14c555254bf359c81c686f85ccd051270ad6894672a1555ce0ebf9c8583110cd5f53ab4fcb27418508821ffeab6f4903cec7ae1e444bc9f87ae2a0b2495ac3c43b3c7cc44e2bc59db56489a40e613a8735d1a795afcde62bb4cceaa7d72a1c4b13e601cc1c0ab257c35070713c170bf436476b3b4521146d1c78c607df8e36286927cc07adf9ddc3f848500d1a122a2d2519345ff7521524c61a3e3c699b8548f9969646dcd74af2fe3aa6c4c54cc1bbf4c3732870afbec219c2cd76bc0cb763e363ba9204ccea095f143eba6d65912f89192d9a9375b8c7383d9b2197f2a3561330c705762db640a1812e8124b5b9f775e2e35cdb3e9180ab75241717859e31abba047cd44a10f711a051d40760c550a4cae4f71211d49c35a2ee0fb361d77f6e8baefd204abc7c1c6091f4bdb7be6cc937278af4ba4b7bb7df84eebfabaf52c8f27a6ea331760f7c3f555eda6f79e2f74ca2f1db74401e7c35ef72aa3ab1477dc22d47063835e88f062caf8cf351e60505733ad563eb04174aa88cde2771b0257b47bf08cf9e8afc80c3de2948192696bb6f008775bf7ae81ad895c4cab509a05c089502dc758054162f6350d21d2d8c41f073402757974850929d35ff82c00b1f19cc3dd52fd6ba0bd97e01ce47fb1d68adb8f1bffa84db0943205e4a82ec2ee14cabea7ea9c27f17245f7574b17039e62c5751c64c30134ed62ff89a372d996de87b97e794f5e14784b00325e742044a8ee7f442cd84a5c727b8af45fb0b9b3a4a514a21ed283c77da2f2db65ea87aa21db504126d879099158c1d81eb9c8f86c03a59740785c6fed8b8852760b018337766881ba018d0a3780707b17e8da84c71eee5353d5d86ebbbbb43fc62bb1d07099fe95b9415d489cf85e19cc1b13ab0543e6217e9f386374853fb272a3f77d4998c0bd1c7196c9c320c38ed0d5563127fbd2c4d1375df72bfe7f6ff51eadb48f1b763e9072a4c3fbe078d6d1d30138d0e0d7ef27f1ae7b9c2cfb540f3b807775b5eee52424c4f8112b80d38f6b023ea705ab2cf82f3cd2b165e328977a706634044fd00a36fdcbd538dfbfbbcaa07cf2c082e9cb94a6bba139b7bba562bf00c96582a56aaadb8afbd40bcba88caa6bedc93b3df4c2d98e381941e40758425c8d4dd", 0x1000, 0x800}, &(0x7f0000001380)) ioctl$VIDIOC_SUBDEV_ENUM_MBUS_CODE(r4, 0xc0305602, &(0x7f0000000100)={0x0, 0x80000000, 0x2023, 0x1}) dup2(r0, r1) [ 330.046097][T16598] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 [ 330.262263][T16614] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 330.286002][T16614] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 330.304995][T16623] input: syz1 as /devices/virtual/input/input233 [ 330.324156][T16614] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock 21:14:40 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 330.363194][T16614] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated 21:14:40 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5505) [ 330.419616][T16614] EXT4-fs (loop0): get root inode failed [ 330.466447][T16614] EXT4-fs (loop0): mount failed 21:14:40 executing program 3 (fault-call:11 fault-nth:27): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:14:40 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{0x0, 0x0, 0x0, 0x9}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup2(r0, r1) [ 330.527973][T16636] input: syz1 as /devices/virtual/input/input236 21:14:40 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r1, 0x0, 0x0, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r2, 0x0, 0x0, 0x0) write$uinput_user_dev(r2, &(0x7f0000000180)={'syz0\x00', {0x0, 0x7fff, 0xfff9, 0x6}, 0x26, [0x6, 0x80000000, 0x935, 0x40, 0x3, 0x81, 0x101, 0x10001, 0x8, 0x40000, 0x7ff, 0xf8, 0x5, 0x8, 0x5, 0x2, 0x0, 0x4, 0x6, 0x401, 0x1, 0xd93, 0x2, 0x5, 0xa1dc, 0x5, 0x0, 0xc8, 0x3, 0x101, 0x7da, 0x2, 0x9, 0x1, 0x9, 0xa51, 0x3, 0xffff, 0x8, 0xba0, 0x8, 0x5, 0x4, 0x2, 0x7f, 0x1, 0x5, 0xfffffff8, 0x8, 0x39, 0x0, 0x4235, 0x5, 0x7, 0x9, 0xdd, 0x2, 0x7, 0x0, 0x80000001, 0x5, 0x40, 0x0, 0x46], [0x1, 0x5b, 0x0, 0x9, 0x3, 0x4, 0x7, 0x9, 0x0, 0x8, 0x5, 0x4, 0x3, 0x8000, 0x96, 0xfcf9, 0x3, 0x1f, 0xfc1, 0x23cf, 0x3, 0x6, 0xf92, 0x3, 0x9d9, 0x8, 0x3f, 0x5, 0x8, 0x6, 0x3d, 0x13c, 0xff, 0x40, 0xff, 0x5, 0x2, 0x1, 0xfff, 0x7, 0x40, 0x8, 0x7, 0x2, 0x4, 0x6, 0x2, 0x8001, 0x3f, 0x1, 0x7fff, 0x56, 0x2, 0x2, 0x0, 0x44c5, 0xd1, 0x7, 0x7fffffff, 0x1, 0x10000, 0x2, 0x34, 0xfff], [0x5, 0xffffffff, 0x3, 0x1400000, 0x3c, 0x2, 0xffffffff, 0x3, 0x101, 0x4, 0xfffffffa, 0xffff309d, 0x7f, 0x7, 0x1f, 0x2, 0x80000001, 0x800, 0x7, 0x2, 0x9, 0x40, 0x6, 0x20, 0x4, 0xffffffff, 0x3, 0x8, 0x1, 0x1, 0x3e, 0xffffff7f, 0xfffff85a, 0xffffff00, 0x0, 0x5, 0xe3b7, 0x20, 0x4, 0x0, 0x6, 0x55, 0xa36, 0x9, 0xfffffffb, 0x4d308649, 0x84, 0xd26b, 0x400000, 0x0, 0x3, 0xd8, 0xffff, 0xffffb0f1, 0x3, 0x8fff, 0x1, 0x2, 0xffffffff, 0x8, 0x4, 0x5, 0xfffffffe, 0x8e], [0xfff, 0x5, 0xffffffc1, 0x5, 0x80000000, 0x0, 0x1, 0x1fffe, 0xfffffa2e, 0x7e9b, 0xfffffffb, 0x8, 0x7f, 0x203, 0x0, 0x5, 0x2f4, 0x8, 0x29, 0x79f, 0x83bf, 0xf7, 0x401, 0x20, 0x7, 0x5, 0x7, 0xfffffff8, 0x80, 0x3, 0x3, 0x4, 0xa6d, 0x7, 0x8, 0x3, 0x7, 0x8, 0xdb, 0x800, 0x1, 0x6, 0x4, 0x0, 0x4, 0x6, 0x6, 0x80, 0x8000, 0x1000, 0x6, 0xfffffffd, 0x0, 0x5, 0x6778, 0xffffffe0, 0x3, 0xfffffffd, 0x101, 0xff, 0x2, 0x4, 0x0, 0x5478]}, 0x45c) ioctl$LOOP_CLR_FD(r1, 0x4c01) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r3 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xc, &(0x7f0000000080)='/dev/uinput\x00'}, 0x30) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) bind$inet(r5, &(0x7f0000000480)={0x2, 0x4e23, @broadcast}, 0x10) openat$mixer(0xffffffffffffff9c, &(0x7f0000000600)='/dev/mixer\x00', 0x42, 0x0) sendto$inet(r5, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x24e23, @local}, 0x10) setsockopt$sock_int(r5, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r5, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) write$binfmt_elf64(r5, &(0x7f00000000c0)=ANY=[@ANYRES64], 0xc63b9e35) shutdown(r5, 0x2) capset(&(0x7f0000000100)={0x20071026, r4}, &(0x7f0000000140)={0x1, 0x5, 0x9, 0x9, 0x8001, 0x3}) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) dup2(r6, r3) 21:14:40 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x87}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) [ 330.699829][T16650] FAULT_INJECTION: forcing a failure. [ 330.699829][T16650] name failslab, interval 1, probability 0, space 0, times 0 [ 330.716658][T16653] input: syz1 as /devices/virtual/input/input238 [ 330.751906][T16650] CPU: 0 PID: 16650 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 330.759842][T16650] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 330.769901][T16650] Call Trace: [ 330.773209][T16650] dump_stack+0x172/0x1f0 [ 330.777553][T16650] should_fail.cold+0xa/0x15 [ 330.782156][T16650] ? fault_create_debugfs_attr+0x180/0x180 [ 330.787975][T16650] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 330.794217][T16650] ? __kasan_check_read+0x11/0x20 [ 330.794238][T16650] __should_failslab+0x121/0x190 [ 330.794256][T16650] should_failslab+0x9/0x14 [ 330.794272][T16650] kmem_cache_alloc+0x47/0x710 [ 330.794288][T16650] ? ip_mc_output+0x584/0xf70 [ 330.794303][T16650] ? find_held_lock+0x35/0x130 [ 330.794323][T16650] dst_alloc+0x10e/0x200 [ 330.808745][T16650] rt_dst_clone+0x59/0x8c0 [ 330.808766][T16650] ip_mc_finish_output+0xb6/0x4a0 [ 330.808788][T16650] ip_mc_output+0x5dd/0xf70 [ 330.827179][T16650] ? __ip_queue_xmit+0x1c10/0x1c10 [ 330.827199][T16650] ? dst_output+0x170/0x170 [ 330.827213][T16650] ? dst_release+0x62/0xe0 [ 330.827231][T16650] ? __ip_make_skb+0xf31/0x17b0 [ 330.827250][T16650] ip_local_out+0xbb/0x1b0 [ 330.827267][T16650] ip_send_skb+0x42/0xf0 [ 330.827282][T16650] ip_push_pending_frames+0x64/0x80 [ 330.827299][T16650] raw_sendmsg+0x13c4/0x2f40 [ 330.827327][T16650] ? dst_output+0x170/0x170 [ 330.883708][T16650] ? lock_downgrade+0x920/0x920 [ 330.888578][T16650] ? __kasan_check_write+0x14/0x20 [ 330.893894][T16650] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 330.900138][T16650] ? aa_label_sk_perm+0x91/0xf0 [ 330.905004][T16650] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 330.910642][T16650] ? aa_sk_perm+0x288/0x880 [ 330.915163][T16650] ? __kasan_check_read+0x11/0x20 [ 330.920192][T16650] ? __lock_acquire+0x8a0/0x4a00 [ 330.925145][T16650] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 330.930696][T16650] inet_sendmsg+0x9e/0xe0 [ 330.935024][T16650] ? inet_sendmsg+0x9e/0xe0 [ 330.939539][T16650] ? inet_send_prepare+0x4f0/0x4f0 [ 330.944655][T16650] sock_sendmsg+0xd7/0x130 [ 330.949080][T16650] kernel_sendmsg+0x44/0x50 [ 330.953591][T16650] sock_no_sendpage+0x116/0x150 [ 330.958445][T16650] ? sock_kzfree_s+0x70/0x70 [ 330.963053][T16650] ? mark_lock+0xc2/0x1220 [ 330.967487][T16650] ? mark_held_locks+0xa4/0xf0 [ 330.972258][T16650] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 330.972382][T16658] capability: warning: `syz-executor.4' uses deprecated v2 capabilities in a way that may be insecure [ 330.978063][T16650] ? debug_check_no_obj_freed+0x20a/0x43f [ 330.978080][T16650] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 330.978100][T16650] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 330.978120][T16650] inet_sendpage+0x10f/0x150 [ 330.978141][T16650] kernel_sendpage+0x92/0xf0 [ 330.978152][T16650] ? inet_sendmsg+0xe0/0xe0 [ 330.978170][T16650] sock_sendpage+0x8b/0xc0 [ 330.978191][T16650] pipe_to_sendpage+0x296/0x360 [ 330.978205][T16650] ? kernel_sendpage+0xf0/0xf0 [ 330.978220][T16650] ? direct_splice_actor+0x190/0x190 [ 330.978241][T16650] ? __put_page+0xa7/0xe0 [ 331.044030][T16650] ? anon_pipe_buf_release+0x1c6/0x270 [ 331.049478][T16650] __splice_from_pipe+0x397/0x7d0 [ 331.054500][T16650] ? direct_splice_actor+0x190/0x190 [ 331.059775][T16650] ? direct_splice_actor+0x190/0x190 [ 331.065042][T16650] splice_from_pipe+0x108/0x170 [ 331.069881][T16650] ? splice_shrink_spd+0xd0/0xd0 [ 331.074900][T16650] ? apparmor_file_permission+0x25/0x30 [ 331.080429][T16650] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 331.086652][T16650] ? security_file_permission+0x8f/0x380 [ 331.092269][T16650] generic_splice_sendpage+0x3c/0x50 [ 331.097544][T16650] ? splice_from_pipe+0x170/0x170 [ 331.102551][T16650] do_splice+0x708/0x1410 [ 331.106872][T16650] ? opipe_prep.part.0+0x2e0/0x2e0 [ 331.111971][T16650] ? __fget_light+0x1a9/0x230 [ 331.116643][T16650] __x64_sys_splice+0x2c6/0x330 [ 331.121490][T16650] do_syscall_64+0xfa/0x760 [ 331.125983][T16650] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 331.131853][T16650] RIP: 0033:0x459a59 [ 331.135732][T16650] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 331.155314][T16650] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 331.163707][T16650] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 331.171660][T16650] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 331.179622][T16650] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 331.187573][T16650] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 331.195523][T16650] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 21:14:41 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) r1 = syz_open_dev$swradio(&(0x7f0000000100)='/dev/swradio#\x00', 0x0, 0x2) r2 = socket$caif_seqpacket(0x25, 0x5, 0x0) ioctl$sock_bt_cmtp_CMTPCONNADD(r1, 0x400443c8, &(0x7f0000000140)={r2, 0x5}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r3 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r4, 0x0, 0x0, 0x0) ioctl$VIDIOC_SUBDEV_S_SELECTION(r4, 0xc040563e, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x2, {0x3, 0x7fff, 0x401, 0x7}}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r3) 21:14:41 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 331.260123][T16661] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 331.271946][T16661] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 331.290372][T16661] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 331.340338][T16661] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated [ 331.365463][T16661] EXT4-fs (loop0): get root inode failed 21:14:41 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5506) [ 331.386461][T16661] EXT4-fs (loop0): mount failed 21:14:41 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000100)='/de\xeb/input/event\x05\x00', 0x4, 0x581a00) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = fcntl$dupfd(r2, 0x0, r2) bind$bt_rfcomm(r3, &(0x7f00000001c0)={0x1f, {0x0, 0x0, 0x2}}, 0xa) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r4, 0x0, 0x0, 0x0) ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000180)={&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, 0x2000, 0x1}) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x6800) ioctl$IOC_PR_PREEMPT(r5, 0x401870cb, &(0x7f0000000140)={0x1f, 0x4, 0x101, 0x10001}) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(0xffffffffffffffff, 0x84, 0x1e, &(0x7f0000000080), &(0x7f00000000c0)=0x4) 21:14:41 executing program 3 (fault-call:11 fault-nth:28): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) [ 331.484655][T16675] input: syz1 as /devices/virtual/input/input242 21:14:41 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x87}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) [ 331.547062][T16679] input: syz1 as /devices/virtual/input/input243 [ 331.706795][T16695] FAULT_INJECTION: forcing a failure. [ 331.706795][T16695] name failslab, interval 1, probability 0, space 0, times 0 [ 331.719957][T16695] CPU: 0 PID: 16695 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 331.727862][T16695] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 331.737923][T16695] Call Trace: [ 331.737949][T16695] dump_stack+0x172/0x1f0 [ 331.737968][T16695] should_fail.cold+0xa/0x15 [ 331.737983][T16695] ? lock_downgrade+0x920/0x920 [ 331.738000][T16695] ? fault_create_debugfs_attr+0x180/0x180 [ 331.738018][T16695] ? __kasan_check_read+0x11/0x20 [ 331.738040][T16695] __should_failslab+0x121/0x190 [ 331.738057][T16695] should_failslab+0x9/0x14 [ 331.738076][T16695] kmem_cache_alloc+0x47/0x710 [ 331.755097][T16695] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 331.755122][T16695] dst_alloc+0x10e/0x200 [ 331.755142][T16695] rt_dst_alloc+0x83/0x440 [ 331.755161][T16695] ip_route_output_key_hash_rcu+0x8d7/0x2d70 [ 331.755184][T16695] ? ip_route_input_noref+0x270/0x270 [ 331.755201][T16695] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 331.755216][T16695] ? __kasan_check_read+0x11/0x20 [ 331.755234][T16695] ip_route_output_key_hash+0x1ef/0x360 [ 331.770952][T16695] ? ip_route_output_key_hash_rcu+0x2d70/0x2d70 [ 331.770976][T16695] ? lock_downgrade+0x920/0x920 [ 331.770996][T16695] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 331.780247][T16695] ip_route_output_flow+0x28/0xc0 [ 331.780267][T16695] raw_sendmsg+0xa30/0x2f40 [ 331.780291][T16695] ? dst_output+0x170/0x170 [ 331.780312][T16695] ? lock_downgrade+0x920/0x920 [ 331.790690][T16695] ? __kasan_check_write+0x14/0x20 [ 331.865011][T16695] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 331.871235][T16695] ? aa_label_sk_perm+0x91/0xf0 [ 331.876071][T16695] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 331.881681][T16695] ? aa_sk_perm+0x288/0x880 [ 331.886164][T16695] ? __kasan_check_read+0x11/0x20 [ 331.891170][T16695] ? __lock_acquire+0x8a0/0x4a00 [ 331.896099][T16695] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 331.901641][T16695] inet_sendmsg+0x9e/0xe0 [ 331.905951][T16695] ? inet_sendmsg+0x9e/0xe0 [ 331.910433][T16695] ? inet_send_prepare+0x4f0/0x4f0 [ 331.915558][T16695] sock_sendmsg+0xd7/0x130 [ 331.919959][T16695] kernel_sendmsg+0x44/0x50 [ 331.924452][T16695] sock_no_sendpage+0x116/0x150 [ 331.929283][T16695] ? sock_kzfree_s+0x70/0x70 [ 331.933857][T16695] ? mark_lock+0xc2/0x1220 [ 331.938258][T16695] ? mark_held_locks+0xa4/0xf0 [ 331.943012][T16695] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 331.948803][T16695] ? debug_check_no_obj_freed+0x20a/0x43f [ 331.954511][T16695] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 331.960301][T16695] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 331.966529][T16695] inet_sendpage+0x10f/0x150 [ 331.971102][T16695] kernel_sendpage+0x92/0xf0 [ 331.975669][T16695] ? inet_sendmsg+0xe0/0xe0 [ 331.981195][T16695] sock_sendpage+0x8b/0xc0 [ 331.985599][T16695] pipe_to_sendpage+0x296/0x360 [ 331.990445][T16695] ? kernel_sendpage+0xf0/0xf0 [ 331.995192][T16695] ? direct_splice_actor+0x190/0x190 [ 332.000458][T16695] ? __put_page+0xa7/0xe0 [ 332.004773][T16695] ? anon_pipe_buf_release+0x1c6/0x270 [ 332.010215][T16695] __splice_from_pipe+0x397/0x7d0 [ 332.015219][T16695] ? direct_splice_actor+0x190/0x190 [ 332.020489][T16695] ? direct_splice_actor+0x190/0x190 [ 332.025770][T16695] splice_from_pipe+0x108/0x170 [ 332.030613][T16695] ? splice_shrink_spd+0xd0/0xd0 [ 332.035539][T16695] ? apparmor_file_permission+0x25/0x30 [ 332.041075][T16695] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 332.047321][T16695] ? security_file_permission+0x8f/0x380 [ 332.052946][T16695] generic_splice_sendpage+0x3c/0x50 [ 332.058216][T16695] ? splice_from_pipe+0x170/0x170 [ 332.063231][T16695] do_splice+0x708/0x1410 [ 332.067554][T16695] ? opipe_prep.part.0+0x2e0/0x2e0 [ 332.072655][T16695] ? __fget_light+0x1a9/0x230 [ 332.077320][T16695] __x64_sys_splice+0x2c6/0x330 [ 332.082166][T16695] do_syscall_64+0xfa/0x760 [ 332.086667][T16695] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 332.092537][T16695] RIP: 0033:0x459a59 [ 332.096436][T16695] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 332.116023][T16695] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 332.124419][T16695] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 332.132383][T16695] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 332.140336][T16695] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 332.148295][T16695] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 21:14:42 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) r2 = dup2(r0, r1) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000002c0)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd;\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c`5\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce\xb3\xebm\xbd\xa8F\r\xa9\r\x10\x8e\xe4uI\xe6\xaa\x00c\xbd\x05\xdb\xd9\f\xaa\xd8\x86&\xa1\x8av\xb6\x80B\x01HU\xbb\xe4\xc7\x84c\xd3|e{\xd3\xeb\b\xf8\xae\xef8y\xfc}\xcc\x04\x15\xed\xca\xfa\xe4E\xdf\x18\x85)S\xd7\xdd\xca\x9cg[\xa4\xd2\x10\r\xbfp\xc5%\x83I\xc5@9\x9c\xfcO| \xb0\xb9)+\xda\xfa\xd4\xbf\xd3\x1f\xfe\xa5n\xcb\x13\x9a\fl\x11\x15') pread64(r3, 0x0, 0x0, 0x0) ioctl$SG_GET_RESERVED_SIZE(r3, 0x2272, &(0x7f0000000080)) r4 = openat$cgroup_int(r2, &(0x7f00000000c0)='cpuacct.usage\x00', 0x2, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_RUN(r7, 0x4004ae8b, 0x0) r8 = socket(0x100000000011, 0x2, 0x0) bind(r8, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r8, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) setsockopt$packet_add_memb(r8, 0x107, 0x1, &(0x7f0000000000)={r9, 0x1, 0x6, @broadcast}, 0x10) r10 = dup(r8) setsockopt$packet_add_memb(r10, 0x107, 0x2, &(0x7f0000000080)={r9, 0x1, 0x6, @link_local}, 0x10) r11 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r11, 0x0, 0x0, 0x0) r12 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x18, 0x3, &(0x7f0000000140)=@raw=[@func={0x85, 0x0, 0x1, 0x0, 0x1}, @exit, @alu={0x4, 0x0, 0x3, 0x2, 0x1, 0x10, 0xfffffffffffffffe}], &(0x7f0000000180)='syzkaller\x00', 0x80, 0xf9, &(0x7f00000001c0)=""/249, 0x40f00, 0x5, [], r9, 0x13, r11, 0x8, &(0x7f0000000440)={0x0, 0x3}, 0x8, 0x10, &(0x7f0000000480)={0x3, 0x5, 0x80000000, 0x401}, 0x10}, 0x70) dup2(r7, r12) ioctl$FS_IOC_FSSETXATTR(r4, 0x401c5820, &(0x7f0000000100)={0x1, 0x3ff, 0x1, 0xfffffffe, 0xc0000}) [ 332.156248][T16695] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 [ 332.171255][T16694] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 332.181358][T16694] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 332.196872][T16694] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock 21:14:42 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r1, 0x0, 0x0, 0x0) write$FUSE_IOCTL(r1, &(0x7f0000000400)={0x20, 0x0, 0x5, {0x1, 0x4, 0x8, 0x3}}, 0x20) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) ioctl$PPPIOCATTACH(r1, 0x4004743d, &(0x7f0000000440)=0x1) r2 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r4, 0x0, 0x0, 0x0) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r4, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000480)={0x1a0, r5, 0x120, 0x70bd29, 0x25dfdbfb, {}, [@TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xfff}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}]}, @TIPC_NLA_MEDIA={0x28, 0x5, [@TIPC_NLA_MEDIA_PROP={0x24}]}, @TIPC_NLA_LINK={0x64, 0x4, [@TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5bd}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_LINK={0xe4, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x99a}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x401}, @TIPC_NLA_PROP_WIN={0x0, 0x3, 0x400}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x4}, @TIPC_NLA_LINK_PROP={0x4c, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_WIN={0x0, 0x3, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x40}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10001}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}]}]}, 0x1a0}, 0x1, 0x0, 0x0, 0x20000000}, 0x20) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup2(r0, r2) [ 332.219498][T16694] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated [ 332.234773][T16689] input: syz1 as /devices/virtual/input/input247 [ 332.247307][T16694] EXT4-fs (loop0): get root inode failed [ 332.253169][T16694] EXT4-fs (loop0): mount failed 21:14:42 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r1, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r1, 0x0, 0x10005, 0x0) [ 332.378762][T16705] input: syz1 as /devices/virtual/input/input249 21:14:42 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB, @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x87}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:42 executing program 3 (fault-call:11 fault-nth:29): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) [ 332.435295][T16701] device lo entered promiscuous mode 21:14:42 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5507) [ 332.543047][T16700] device lo left promiscuous mode [ 332.626787][T16726] input: syz1 as /devices/virtual/input/input250 [ 332.663081][T16730] FAULT_INJECTION: forcing a failure. [ 332.663081][T16730] name failslab, interval 1, probability 0, space 0, times 0 [ 332.690584][T16730] CPU: 1 PID: 16730 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 332.698503][T16730] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 332.708559][T16730] Call Trace: [ 332.711860][T16730] dump_stack+0x172/0x1f0 [ 332.716204][T16730] should_fail.cold+0xa/0x15 [ 332.721065][T16730] ? fault_create_debugfs_attr+0x180/0x180 [ 332.726884][T16730] ? ___might_sleep+0x163/0x2c0 [ 332.731752][T16730] __should_failslab+0x121/0x190 [ 332.736783][T16730] should_failslab+0x9/0x14 [ 332.736806][T16730] kmem_cache_alloc_node+0x268/0x740 [ 332.736823][T16730] ? rt_add_uncached_list+0x147/0x1a0 [ 332.736840][T16730] ? __local_bh_enable_ip+0x15a/0x270 [ 332.736860][T16730] __alloc_skb+0xd5/0x5e0 [ 332.736879][T16730] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 332.746802][T16730] ? dst_init+0x38e/0x4d0 [ 332.746829][T16730] __ip_append_data.isra.0+0x2667/0x30d0 [ 332.746851][T16730] ? raw_destroy+0x30/0x30 [ 332.746870][T16730] ? __lock_acquire+0x16f2/0x4a00 [ 332.786780][T16730] ? __ip_flush_pending_frames.isra.0+0x2d0/0x2d0 [ 332.793200][T16730] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 332.799422][T16730] ? ip_setup_cork+0x59c/0x8e0 [ 332.804172][T16730] ? raw_destroy+0x30/0x30 [ 332.808568][T16730] ip_append_data.part.0+0xf2/0x170 [ 332.813751][T16730] ? raw_destroy+0x30/0x30 [ 332.818149][T16730] ip_append_data+0x6e/0x90 [ 332.822640][T16730] raw_sendmsg+0xba8/0x2f40 [ 332.827132][T16730] ? dst_output+0x170/0x170 [ 332.831634][T16730] ? lock_downgrade+0x920/0x920 [ 332.836470][T16730] ? __kasan_check_write+0x14/0x20 [ 332.841576][T16730] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 332.847800][T16730] ? aa_label_sk_perm+0x91/0xf0 [ 332.852637][T16730] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 332.858251][T16730] ? aa_sk_perm+0x288/0x880 [ 332.862730][T16730] ? __kasan_check_read+0x11/0x20 [ 332.867735][T16730] ? __lock_acquire+0x8a0/0x4a00 [ 332.872656][T16730] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 332.878186][T16730] inet_sendmsg+0x9e/0xe0 [ 332.882495][T16730] ? inet_sendmsg+0x9e/0xe0 [ 332.886976][T16730] ? inet_send_prepare+0x4f0/0x4f0 [ 332.892068][T16730] sock_sendmsg+0xd7/0x130 [ 332.896466][T16730] kernel_sendmsg+0x44/0x50 [ 332.900949][T16730] sock_no_sendpage+0x116/0x150 [ 332.905784][T16730] ? sock_kzfree_s+0x70/0x70 [ 332.910363][T16730] ? mark_lock+0xc2/0x1220 [ 332.914764][T16730] ? mark_held_locks+0xa4/0xf0 [ 332.919513][T16730] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 332.925302][T16730] ? debug_check_no_obj_freed+0x20a/0x43f [ 332.931000][T16730] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 332.936872][T16730] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 332.943573][T16730] inet_sendpage+0x10f/0x150 [ 332.948168][T16730] kernel_sendpage+0x92/0xf0 [ 332.952737][T16730] ? inet_sendmsg+0xe0/0xe0 [ 332.957225][T16730] sock_sendpage+0x8b/0xc0 [ 332.961628][T16730] pipe_to_sendpage+0x296/0x360 [ 332.966461][T16730] ? kernel_sendpage+0xf0/0xf0 [ 332.971216][T16730] ? direct_splice_actor+0x190/0x190 [ 332.976485][T16730] ? __put_page+0xa7/0xe0 [ 332.980797][T16730] ? anon_pipe_buf_release+0x1c6/0x270 [ 332.986248][T16730] __splice_from_pipe+0x397/0x7d0 [ 332.991256][T16730] ? direct_splice_actor+0x190/0x190 [ 332.996528][T16730] ? direct_splice_actor+0x190/0x190 [ 333.001794][T16730] splice_from_pipe+0x108/0x170 [ 333.006655][T16730] ? splice_shrink_spd+0xd0/0xd0 [ 333.011613][T16730] ? apparmor_file_permission+0x25/0x30 [ 333.018721][T16730] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 333.024951][T16730] ? security_file_permission+0x8f/0x380 [ 333.030576][T16730] generic_splice_sendpage+0x3c/0x50 [ 333.035846][T16730] ? splice_from_pipe+0x170/0x170 [ 333.040856][T16730] do_splice+0x708/0x1410 [ 333.045175][T16730] ? opipe_prep.part.0+0x2e0/0x2e0 [ 333.050313][T16730] ? __fget_light+0x1a9/0x230 [ 333.054986][T16730] __x64_sys_splice+0x2c6/0x330 [ 333.059833][T16730] do_syscall_64+0xfa/0x760 [ 333.064339][T16730] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 333.070225][T16730] RIP: 0033:0x459a59 21:14:43 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r1, 0x0, 0x0, 0x0) ioctl$UI_SET_LEDBIT(r1, 0x40045569, 0x2) r2 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r2) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r4, 0x0, 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r4, 0x1, &(0x7f0000000100)={0x38, 0x10000, 0xfffffffe, "c2df3f8c77333796912519d115b7f5303eee83632239d5f85109d6dcf4f60a3577df00cdd181e1968987f6172a28f095f56ee3d5f5b576da"}) [ 333.074103][T16730] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 333.093685][T16730] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 333.102075][T16730] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 333.110039][T16730] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 333.117991][T16730] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 333.125941][T16730] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 333.133893][T16730] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 [ 333.187705][T16708] device lo entered promiscuous mode [ 333.193871][T16735] input: syz1 as /devices/virtual/input/input254 21:14:43 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r1, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r1, 0x0, 0x10005, 0x0) [ 333.240167][T16700] device lo left promiscuous mode [ 333.247000][T16725] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 333.257493][T16725] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 333.283941][T16725] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 333.309787][T16725] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated 21:14:43 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x4c0082) ioctl$UI_DEV_DESTROY(r0, 0x5502) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) clock_settime(0x5, &(0x7f0000000140)) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x8b045, 0x0) ioctl$KVM_RUN(r3, 0x4004ae8b, 0x0) r4 = dup2(r0, r0) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r4, 0x84, 0x21, &(0x7f0000000100)=0xffffffff, 0x4) [ 333.339854][T16725] EXT4-fs (loop0): get root inode failed 21:14:43 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5508) [ 333.403287][T16725] EXT4-fs (loop0): mount failed 21:14:43 executing program 3 (fault-call:11 fault-nth:30): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:14:43 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) setsockopt$inet6_dccp_int(r1, 0x21, 0x0, &(0x7f0000000100)=0xf9, 0x4) 21:14:43 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB, @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x87}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) [ 333.609457][T16759] input: syz1 as /devices/virtual/input/input259 [ 333.652484][T16764] input: syz1 as /devices/virtual/input/input260 21:14:43 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3c) ptrace$cont(0x18, r2, 0x0, 0x0) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r2, 0x0, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000080)=0x7f) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 333.698577][T16767] FAULT_INJECTION: forcing a failure. [ 333.698577][T16767] name failslab, interval 1, probability 0, space 0, times 0 [ 333.800953][T16767] CPU: 1 PID: 16767 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 333.808894][T16767] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 333.818955][T16767] Call Trace: [ 333.818980][T16767] dump_stack+0x172/0x1f0 [ 333.819002][T16767] should_fail.cold+0xa/0x15 [ 333.819021][T16767] ? fault_create_debugfs_attr+0x180/0x180 [ 333.819042][T16767] ? ___might_sleep+0x163/0x2c0 [ 333.819064][T16767] __should_failslab+0x121/0x190 [ 333.826656][T16767] should_failslab+0x9/0x14 [ 333.826677][T16767] kmem_cache_alloc_node_trace+0x274/0x750 [ 333.826696][T16767] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 333.826710][T16767] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 333.826734][T16767] __kmalloc_node_track_caller+0x3d/0x70 [ 333.874454][T16767] __kmalloc_reserve.isra.0+0x40/0xf0 [ 333.879812][T16767] __alloc_skb+0x10b/0x5e0 [ 333.884213][T16767] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 333.889741][T16767] ? dst_init+0x38e/0x4d0 [ 333.894070][T16767] __ip_append_data.isra.0+0x2667/0x30d0 [ 333.899690][T16767] ? raw_destroy+0x30/0x30 [ 333.904089][T16767] ? __lock_acquire+0x16f2/0x4a00 [ 333.909106][T16767] ? __ip_flush_pending_frames.isra.0+0x2d0/0x2d0 [ 333.915510][T16767] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 333.922695][T16767] ? ip_setup_cork+0x59c/0x8e0 [ 333.927535][T16767] ? raw_destroy+0x30/0x30 [ 333.931936][T16767] ip_append_data.part.0+0xf2/0x170 [ 333.937120][T16767] ? raw_destroy+0x30/0x30 [ 333.941519][T16767] ip_append_data+0x6e/0x90 [ 333.946014][T16767] raw_sendmsg+0xba8/0x2f40 [ 333.950509][T16767] ? dst_output+0x170/0x170 [ 333.954999][T16767] ? lock_downgrade+0x920/0x920 [ 333.959833][T16767] ? __kasan_check_write+0x14/0x20 [ 333.964940][T16767] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 333.971183][T16767] ? aa_label_sk_perm+0x91/0xf0 [ 333.976034][T16767] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 333.981662][T16767] ? aa_sk_perm+0x288/0x880 [ 333.986157][T16767] ? __kasan_check_read+0x11/0x20 [ 333.992393][T16767] ? __lock_acquire+0x8a0/0x4a00 [ 333.997318][T16767] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 334.002852][T16767] inet_sendmsg+0x9e/0xe0 [ 334.007164][T16767] ? inet_sendmsg+0x9e/0xe0 [ 334.011646][T16767] ? inet_send_prepare+0x4f0/0x4f0 [ 334.016748][T16767] sock_sendmsg+0xd7/0x130 [ 334.021155][T16767] kernel_sendmsg+0x44/0x50 [ 334.025641][T16767] sock_no_sendpage+0x116/0x150 [ 334.030482][T16767] ? sock_kzfree_s+0x70/0x70 [ 334.035057][T16767] ? mark_lock+0xc2/0x1220 [ 334.039471][T16767] ? mark_held_locks+0xa4/0xf0 [ 334.044237][T16767] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 334.050060][T16767] ? debug_check_no_obj_freed+0x20a/0x43f [ 334.055772][T16767] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 334.061578][T16767] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 334.067813][T16767] inet_sendpage+0x10f/0x150 [ 334.072434][T16767] kernel_sendpage+0x92/0xf0 [ 334.077015][T16767] ? inet_sendmsg+0xe0/0xe0 [ 334.081512][T16767] sock_sendpage+0x8b/0xc0 [ 334.086453][T16767] pipe_to_sendpage+0x296/0x360 [ 334.091295][T16767] ? kernel_sendpage+0xf0/0xf0 [ 334.096049][T16767] ? direct_splice_actor+0x190/0x190 [ 334.101335][T16767] ? __put_page+0xa7/0xe0 [ 334.105667][T16767] ? anon_pipe_buf_release+0x1c6/0x270 [ 334.111199][T16767] __splice_from_pipe+0x397/0x7d0 [ 334.116211][T16767] ? direct_splice_actor+0x190/0x190 [ 334.121497][T16767] ? direct_splice_actor+0x190/0x190 [ 334.126786][T16767] splice_from_pipe+0x108/0x170 [ 334.131626][T16767] ? splice_shrink_spd+0xd0/0xd0 [ 334.136562][T16767] ? apparmor_file_permission+0x25/0x30 [ 334.142098][T16767] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 334.148345][T16767] ? security_file_permission+0x8f/0x380 [ 334.153973][T16767] generic_splice_sendpage+0x3c/0x50 [ 334.159253][T16767] ? splice_from_pipe+0x170/0x170 [ 334.164266][T16767] do_splice+0x708/0x1410 [ 334.168599][T16767] ? opipe_prep.part.0+0x2e0/0x2e0 [ 334.173697][T16767] ? __fget_light+0x1a9/0x230 [ 334.178365][T16767] __x64_sys_splice+0x2c6/0x330 [ 334.183218][T16767] do_syscall_64+0xfa/0x760 [ 334.187712][T16767] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 334.193598][T16767] RIP: 0033:0x459a59 [ 334.197490][T16767] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 334.217095][T16767] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 334.225585][T16767] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 334.233545][T16767] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 334.241504][T16767] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 334.249466][T16767] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 334.257941][T16767] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 [ 334.269274][T16769] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock 21:14:44 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r1, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r1, 0x0, 0x10005, 0x0) 21:14:44 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000180)='/dev/uinput\x00', 0x2, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000001740)='/dev/vsock\x00', 0x101000, 0x0) connect$nfc_llcp(r1, &(0x7f0000001780)={0x27, 0x1, 0x0, 0x3, 0x57, 0x0, "1215f75f814f26b2067ff460ff0088c9705ae7fa2b0c947d81e0aea5d2bc4249537314a0ad4f000a900ac1b7b10afcc118840b1089c22f46d802cc917f0174", 0x1f}, 0x60) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r2, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r2, 0xc0a85320, &(0x7f00000001c0)={{0x4, 0x9}, 'port1\x00', 0x1, 0x1, 0x81, 0xedf, 0xc, 0xfecc, 0x0, 0x0, 0x2, 0x1ff}) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r3, 0x0, 0x0, 0x0) ioctl$VHOST_RESET_OWNER(r3, 0xaf02, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x300401) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 334.310232][T16764] input: syz1 as /devices/virtual/input/input262 [ 334.328547][T16777] input: syz1 as /devices/virtual/input/input263 [ 334.335748][T16769] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 334.433592][T16769] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock 21:14:44 executing program 3 (fault-call:11 fault-nth:31): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:14:44 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f0000000100)) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 334.480052][T16769] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated [ 334.504885][T16769] EXT4-fs (loop0): get root inode failed [ 334.519891][T16769] EXT4-fs (loop0): mount failed 21:14:44 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x550b) 21:14:44 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm_plock\x00', 0x20000, 0x0) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x2) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 334.605539][T16794] input: syz1 as /devices/virtual/input/input266 [ 334.669347][T16800] FAULT_INJECTION: forcing a failure. [ 334.669347][T16800] name failslab, interval 1, probability 0, space 0, times 0 21:14:44 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB, @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x87}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) [ 334.719109][T16802] input: syz1 as /devices/virtual/input/input268 [ 334.738395][T16800] CPU: 0 PID: 16800 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 334.746326][T16800] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 334.756387][T16800] Call Trace: [ 334.759699][T16800] dump_stack+0x172/0x1f0 [ 334.764041][T16800] should_fail.cold+0xa/0x15 [ 334.764060][T16800] ? fault_create_debugfs_attr+0x180/0x180 [ 334.764080][T16800] ? ___might_sleep+0x163/0x2c0 [ 334.764098][T16800] __should_failslab+0x121/0x190 [ 334.764123][T16800] should_failslab+0x9/0x14 [ 334.789383][T16800] kmem_cache_alloc_node+0x268/0x740 [ 334.794693][T16800] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 334.800936][T16800] ? ip_generic_getfrag+0x120/0x230 [ 334.806139][T16800] __alloc_skb+0xd5/0x5e0 [ 334.806158][T16800] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 334.806174][T16800] ? raw_getfrag+0x164/0x230 [ 334.806190][T16800] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 334.806209][T16800] __ip_append_data.isra.0+0x2667/0x30d0 [ 334.806229][T16800] ? raw_destroy+0x30/0x30 [ 334.826369][T16800] ? __lock_acquire+0x16f2/0x4a00 [ 334.826394][T16800] ? __ip_flush_pending_frames.isra.0+0x2d0/0x2d0 [ 334.847821][T16800] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 334.847836][T16800] ? ip_setup_cork+0x59c/0x8e0 [ 334.847852][T16800] ? raw_destroy+0x30/0x30 [ 334.847865][T16800] ip_append_data.part.0+0xf2/0x170 [ 334.847882][T16800] ? raw_destroy+0x30/0x30 [ 334.847899][T16800] ip_append_data+0x6e/0x90 [ 334.858890][T16800] raw_sendmsg+0xba8/0x2f40 [ 334.881849][T16800] ? dst_output+0x170/0x170 [ 334.881872][T16800] ? lock_downgrade+0x920/0x920 [ 334.881891][T16800] ? __kasan_check_write+0x14/0x20 [ 334.896337][T16800] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 334.902584][T16800] ? aa_label_sk_perm+0x91/0xf0 [ 334.907455][T16800] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 334.913092][T16800] ? aa_sk_perm+0x288/0x880 [ 334.917690][T16800] ? __kasan_check_read+0x11/0x20 [ 334.922720][T16800] ? __lock_acquire+0x8a0/0x4a00 [ 334.927678][T16800] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 334.933322][T16800] inet_sendmsg+0x9e/0xe0 [ 334.933336][T16800] ? inet_sendmsg+0x9e/0xe0 [ 334.933352][T16800] ? inet_send_prepare+0x4f0/0x4f0 [ 334.947279][T16800] sock_sendmsg+0xd7/0x130 [ 334.951697][T16800] kernel_sendmsg+0x44/0x50 [ 334.956210][T16800] sock_no_sendpage+0x116/0x150 [ 334.961247][T16800] ? sock_kzfree_s+0x70/0x70 [ 334.965850][T16800] ? mark_lock+0xc2/0x1220 [ 334.970257][T16800] ? mark_held_locks+0xa4/0xf0 [ 334.975019][T16800] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 334.980806][T16800] ? debug_check_no_obj_freed+0x20a/0x43f [ 334.986947][T16800] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 334.992752][T16800] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 334.998978][T16800] inet_sendpage+0x10f/0x150 [ 335.003554][T16800] kernel_sendpage+0x92/0xf0 [ 335.009000][T16800] ? inet_sendmsg+0xe0/0xe0 [ 335.013493][T16800] sock_sendpage+0x8b/0xc0 [ 335.017898][T16800] pipe_to_sendpage+0x296/0x360 [ 335.022733][T16800] ? kernel_sendpage+0xf0/0xf0 [ 335.027480][T16800] ? direct_splice_actor+0x190/0x190 [ 335.032783][T16800] ? __put_page+0xa7/0xe0 [ 335.037101][T16800] ? anon_pipe_buf_release+0x1c6/0x270 [ 335.042560][T16800] __splice_from_pipe+0x397/0x7d0 [ 335.047664][T16800] ? direct_splice_actor+0x190/0x190 [ 335.052941][T16800] ? direct_splice_actor+0x190/0x190 [ 335.058305][T16800] splice_from_pipe+0x108/0x170 [ 335.063148][T16800] ? splice_shrink_spd+0xd0/0xd0 [ 335.068094][T16800] ? apparmor_file_permission+0x25/0x30 [ 335.073636][T16800] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 335.079890][T16800] ? security_file_permission+0x8f/0x380 [ 335.085520][T16800] generic_splice_sendpage+0x3c/0x50 [ 335.090791][T16800] ? splice_from_pipe+0x170/0x170 [ 335.095801][T16800] do_splice+0x708/0x1410 [ 335.100135][T16800] ? opipe_prep.part.0+0x2e0/0x2e0 [ 335.105232][T16800] ? __fget_light+0x1a9/0x230 [ 335.109906][T16800] __x64_sys_splice+0x2c6/0x330 [ 335.114745][T16800] do_syscall_64+0xfa/0x760 [ 335.119233][T16800] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 335.125107][T16800] RIP: 0033:0x459a59 [ 335.128985][T16800] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 335.148589][T16800] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 335.156993][T16800] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 21:14:45 executing program 5: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self/net/pfkey\x00', 0x1, 0x0) ioctl$CAPI_GET_MANUFACTURER(r0, 0xc0044306, &(0x7f0000000140)=0x4) r1 = socket$inet6(0xa, 0xa, 0x46) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000280)={{{@in=@multicast1, @in6=@loopback}}, {{@in6=@empty}, 0x0, @in6=@local}}, &(0x7f0000000380)=0xe8) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r2 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000700)='/dev/sequencer\x00', 0x101, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) pipe2(&(0x7f0000000680)={0xffffffffffffffff}, 0x80800) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x200000000) ioctl$KVM_RUN(r6, 0x4004ae8b, 0x0) r7 = gettid() ptrace$setopts(0x4206, r7, 0x0, 0x0) tkill(r7, 0x3c) ptrace$cont(0x18, r7, 0x0, 0x0) ptrace$setregs(0xd, r7, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r7, 0x0, 0x0) r8 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setreuid(0x0, r9) sendmmsg$unix(r3, &(0x7f00000006c0)=[{&(0x7f00000003c0)=@abs={0x0, 0x0, 0x4e20}, 0x6e, &(0x7f0000000640)=[{&(0x7f0000000440)="1e07fd98fb4a79734b9510e7f414f3af876b58af5c711cb7e29cecdb1949dddbadceab12f5c356180bb784c5b7519287a75a225d8a2bee4b9aaed40e20e04d1e4b490d94775d7acd7586d1e0204d0e4ed950da6ff30fc839a7c09826ea9d5739c7051df19707db2ffeec3c9a9fcbe0b99c4f69170d5ae8660c2f9475250dc62ba544e744b198a783f94d6ab13d916496bc1032a7bea3b52413cac0dee980d7537294d1c8382a306c87d04e724ba8033116f8e2f3ed43ef76dccb8aaf031c791f8a20d1a43145cdf6", 0xc8}, {&(0x7f0000000540)="a84a977f43cce4ff2f5530a66a4016418d17bfaa03586dc51492349ae6b0427cb4a665603a0ae800e2769c5d168dfc17fd1cfcb275ceccb7631f81f5c03bcfcbafdbeda958efd61ea5b124ef7e8419bb669a2173b3838f49bbca1cc013d9b386a95c4181420bd2d046140969dfcaf0f0106f4dc9d6625491ca6ce2195fbefa3918aee25c646785ebee83a43b32e71dbfea2a27b4deee8fbbdb070d988c9946b27379bfcedce42026cb104a29ade0732e4e42fbcdd09364d58ebfb13d8da51c0678c107f3c67a96", 0xc7}], 0x2, &(0x7f00000007c0)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32=r6, @ANYBLOB="000004e108b438f49e54cd894fcd756a4f0000001c00001300000000010000000298dd6a380fc4a8ee271c082c5d0500000039cdb98ef12c6b314d23f0a2b337764b50142c97664db1a33f4b68aece74d097c84fbb492bc0fe37ead23383dccbbc9a4adf9748d30364b5b0140ca27441331d9fd502430db09567e77aa72051d64bc1131387e778ee55562b1a439578f68e245bd81052aecc7672c713dee9415f9733966301c96ef97987351761fe817e564dba39eea52f160434b86a60d4804e35119278810921744fd53855410999349ec5fe4061f761394ff640ba82e74ad2080c744e8e7cec1afd53a29a3decc2f968f796d8efc712545f652b1bb2c8fd", @ANYRES32=r7, @ANYRES32=r9, @ANYRES32=0xee00, @ANYBLOB], 0x38}], 0x1, 0x8000) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) open(&(0x7f0000000000)='./file0\x00', 0x2802, 0x20) dup2(0xffffffffffffffff, r2) accept4$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000001c0)=0x14, 0x0) setsockopt$packet_drop_memb(r0, 0x107, 0x2, &(0x7f0000000240)={r10, 0x1, 0x6, @broadcast}, 0x10) [ 335.164954][T16800] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 335.172919][T16800] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 335.180873][T16800] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 335.188827][T16800] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 21:14:45 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, 0x0, 0x0) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 335.288503][T16812] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 335.306425][T16802] input: syz1 as /devices/virtual/input/input271 21:14:45 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r2, 0x0, 0x0, 0x0) ioctl$VIDIOC_S_PARM(r2, 0xc0cc5616, &(0x7f0000000080)={0xa, @output={0x1000, 0x2, {0x7fff, 0x2}, 0x20, 0x8f2}}) [ 335.374769][T16812] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 335.422164][T16812] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock 21:14:45 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x550f) 21:14:45 executing program 3 (fault-call:11 fault-nth:32): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) [ 335.493904][T16812] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated [ 335.566633][T16812] EXT4-fs (loop0): get root inode failed [ 335.606168][T16812] EXT4-fs (loop0): mount failed 21:14:45 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) r3 = dup2(r0, r1) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r4, 0x0, 0x0, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, 0x0, 0x0) connect$inet6(r5, &(0x7f0000d83fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, 0x0, &(0x7f0000000180)) socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f0000000180)=0xfffffced) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r5, 0x84, 0x14, &(0x7f0000000200)=@assoc_value={r6}, 0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000100)={r6, @in={{0x2, 0x4e24, @multicast2}}, 0x800, 0x4, 0x200, 0x8001, 0x10}, &(0x7f00000001c0)=0x98) [ 335.625386][T16841] input: syz1 as /devices/virtual/input/input273 [ 335.717406][T16846] FAULT_INJECTION: forcing a failure. [ 335.717406][T16846] name failslab, interval 1, probability 0, space 0, times 0 [ 335.759255][T16852] input: syz1 as /devices/virtual/input/input275 [ 335.785503][T16853] input: syz1 as /devices/virtual/input/input276 [ 335.807038][T16846] CPU: 0 PID: 16846 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 335.814971][T16846] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 335.825030][T16846] Call Trace: [ 335.828356][T16846] dump_stack+0x172/0x1f0 [ 335.832789][T16846] should_fail.cold+0xa/0x15 [ 335.837395][T16846] ? fault_create_debugfs_attr+0x180/0x180 [ 335.843214][T16846] ? ___might_sleep+0x163/0x2c0 [ 335.848084][T16846] __should_failslab+0x121/0x190 [ 335.853117][T16846] should_failslab+0x9/0x14 [ 335.857644][T16846] kmem_cache_alloc_node_trace+0x274/0x750 [ 335.863451][T16846] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 335.869416][T16846] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 335.869437][T16846] __kmalloc_node_track_caller+0x3d/0x70 [ 335.869456][T16846] __kmalloc_reserve.isra.0+0x40/0xf0 [ 335.869472][T16846] __alloc_skb+0x10b/0x5e0 [ 335.869487][T16846] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 335.869503][T16846] ? raw_getfrag+0x164/0x230 [ 335.869522][T16846] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 335.886312][T16846] __ip_append_data.isra.0+0x2667/0x30d0 [ 335.886337][T16846] ? raw_destroy+0x30/0x30 [ 335.886357][T16846] ? __lock_acquire+0x16f2/0x4a00 [ 335.896293][T16846] ? __ip_flush_pending_frames.isra.0+0x2d0/0x2d0 [ 335.896315][T16846] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 335.896328][T16846] ? ip_setup_cork+0x59c/0x8e0 [ 335.896343][T16846] ? raw_destroy+0x30/0x30 [ 335.896358][T16846] ip_append_data.part.0+0xf2/0x170 [ 335.896376][T16846] ? raw_destroy+0x30/0x30 [ 335.896394][T16846] ip_append_data+0x6e/0x90 [ 335.921855][T16846] raw_sendmsg+0xba8/0x2f40 [ 335.921884][T16846] ? dst_output+0x170/0x170 [ 335.921906][T16846] ? lock_downgrade+0x920/0x920 [ 335.971587][T16846] ? __kasan_check_write+0x14/0x20 [ 335.976697][T16846] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 335.982920][T16846] ? aa_label_sk_perm+0x91/0xf0 [ 335.987782][T16846] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 335.993416][T16846] ? aa_sk_perm+0x288/0x880 [ 335.997913][T16846] ? __kasan_check_read+0x11/0x20 [ 336.002928][T16846] ? __lock_acquire+0x8a0/0x4a00 [ 336.007854][T16846] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 336.013416][T16846] inet_sendmsg+0x9e/0xe0 [ 336.017735][T16846] ? inet_sendmsg+0x9e/0xe0 [ 336.022236][T16846] ? inet_send_prepare+0x4f0/0x4f0 [ 336.027349][T16846] sock_sendmsg+0xd7/0x130 [ 336.031754][T16846] kernel_sendmsg+0x44/0x50 [ 336.036253][T16846] sock_no_sendpage+0x116/0x150 [ 336.041089][T16846] ? sock_kzfree_s+0x70/0x70 [ 336.045680][T16846] ? mark_lock+0xc2/0x1220 [ 336.050089][T16846] ? mark_held_locks+0xa4/0xf0 [ 336.054842][T16846] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 336.060636][T16846] ? debug_check_no_obj_freed+0x20a/0x43f [ 336.066341][T16846] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 336.072309][T16846] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 336.078542][T16846] inet_sendpage+0x10f/0x150 [ 336.083120][T16846] kernel_sendpage+0x92/0xf0 [ 336.087691][T16846] ? inet_sendmsg+0xe0/0xe0 [ 336.092179][T16846] sock_sendpage+0x8b/0xc0 [ 336.096580][T16846] pipe_to_sendpage+0x296/0x360 [ 336.101411][T16846] ? kernel_sendpage+0xf0/0xf0 [ 336.106159][T16846] ? direct_splice_actor+0x190/0x190 [ 336.111429][T16846] ? __put_page+0xa7/0xe0 [ 336.115750][T16846] ? anon_pipe_buf_release+0x1c6/0x270 [ 336.121192][T16846] __splice_from_pipe+0x397/0x7d0 [ 336.126200][T16846] ? direct_splice_actor+0x190/0x190 [ 336.131473][T16846] ? direct_splice_actor+0x190/0x190 [ 336.136751][T16846] splice_from_pipe+0x108/0x170 [ 336.141583][T16846] ? splice_shrink_spd+0xd0/0xd0 [ 336.146507][T16846] ? apparmor_file_permission+0x25/0x30 [ 336.152039][T16846] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 336.158270][T16846] ? security_file_permission+0x8f/0x380 [ 336.163897][T16846] generic_splice_sendpage+0x3c/0x50 [ 336.169165][T16846] ? splice_from_pipe+0x170/0x170 [ 336.174177][T16846] do_splice+0x708/0x1410 [ 336.178506][T16846] ? opipe_prep.part.0+0x2e0/0x2e0 [ 336.183606][T16846] ? __fget_light+0x1a9/0x230 [ 336.188268][T16846] __x64_sys_splice+0x2c6/0x330 [ 336.193106][T16846] do_syscall_64+0xfa/0x760 [ 336.197604][T16846] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 336.203476][T16846] RIP: 0033:0x459a59 [ 336.208062][T16846] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 336.227661][T16846] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 336.236061][T16846] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 336.244014][T16846] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 336.251965][T16846] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 21:14:45 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a37", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x92}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:46 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) r2 = dup2(r0, r1) sendmsg$can_raw(r2, &(0x7f0000000140)={&(0x7f0000000080), 0x10, &(0x7f0000000100)={&(0x7f00000000c0)=@can={{0x1, 0x1, 0x1, 0x1}, 0x7, 0x1, 0x0, 0x0, "866d07159504f4ad"}, 0x10}, 0x1, 0x0, 0x0, 0x1}, 0x40) [ 336.260003][T16846] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 336.267956][T16846] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 21:14:46 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, 0x0, 0x0) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 21:14:46 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{0x5, 0x0, 0x2}, 'syz1\x00', 0x4}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:46 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5510) [ 336.458893][T16863] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 336.518342][T16863] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 336.545217][T16863] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 336.568406][T16879] input: syz1 as /devices/virtual/input/input279 [ 336.607041][T16881] input: syz1 as /devices/virtual/input/input281 21:14:46 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r0, &(0x7f0000000080)={'syz0\x00', {0x6, 0xb4, 0x7, 0x732c}, 0x27, [0xffffffff, 0x7, 0x7, 0xff, 0x9, 0xfff, 0x5, 0x800, 0x6, 0x7f, 0x382fb8ca, 0x101, 0x81, 0x4e, 0x3, 0x1, 0x832c, 0x99, 0x1, 0x81, 0x7, 0x6, 0x6, 0x0, 0x3, 0x200000, 0x9, 0x9, 0x5, 0x400, 0x5, 0x2, 0x8, 0x10001, 0x67e, 0x2d, 0x1f, 0x3ff, 0x1, 0x7, 0x2d, 0x3, 0xfffffe01, 0x2, 0x81, 0x401, 0x0, 0xeaa1, 0x2, 0x0, 0x6, 0xf7, 0x2, 0x3f, 0xf6ee, 0x7, 0x1ff, 0x8000, 0x7, 0x0, 0x96, 0x4, 0x5, 0x80], [0x58, 0x20000000, 0x8000, 0x6, 0x9f, 0x5, 0x80000000, 0x1, 0xa16, 0x1, 0x9f1789b5, 0x8, 0x3, 0x6, 0x50c5169e, 0x0, 0x3, 0x2, 0x1, 0xfffffffa, 0x5, 0x1, 0x5, 0x8, 0x200, 0xfffffd62, 0x4, 0xfaa7, 0xbbda, 0x8039, 0x4, 0x9, 0x2f2, 0x8001, 0x6, 0x7fff, 0x400, 0xffffffff, 0xa7, 0x7, 0x1, 0xffffff81, 0xe00, 0x0, 0x1ff, 0x40, 0x1, 0x0, 0xfffffc00, 0x1, 0x80000001, 0x8, 0x0, 0x80000000, 0x7fff, 0x5, 0x5, 0xfffffffc, 0x9, 0x2, 0x5f90, 0x1, 0x40, 0x7], [0xfff, 0x80000001, 0x7, 0x3, 0x20, 0x9, 0x95, 0x0, 0x8, 0x9, 0x9, 0x977, 0x3, 0x7, 0x7, 0x5, 0x8, 0xa3, 0xe1, 0x1935ae30, 0x0, 0xcb6, 0x0, 0x0, 0x5830, 0x7, 0x68c, 0xfff, 0x9, 0x4, 0x1, 0xc58, 0x7fff, 0xfff, 0x0, 0x80, 0x6, 0x3f, 0xfffffffa, 0x80b, 0xc0, 0x800, 0x8, 0x7, 0x1, 0x400, 0xffffff24, 0x7f, 0x7f, 0x5, 0xfffffffd, 0x7, 0x4, 0x56, 0x0, 0xffffffff, 0x0, 0xf788, 0x9, 0x0, 0x9a41, 0x1, 0xff, 0x2], [0x81, 0x6, 0xa46, 0x4, 0x5d3, 0x9, 0x5, 0xffff, 0xffffffff, 0xffff0001, 0x677d4672, 0x8, 0x7, 0x7, 0x6, 0x3, 0x7fff, 0x0, 0x9, 0x9, 0xe05, 0x8001, 0x3, 0x5, 0x1b9, 0x7b10, 0x5, 0x0, 0x4, 0x8, 0x8, 0x2, 0x4, 0x7f, 0x8, 0x40, 0xfffffffc, 0x3, 0x9, 0x4, 0xfffffffe, 0x18, 0x7fff, 0x5, 0x4, 0x5, 0x13cf, 0x6, 0x4, 0x1, 0x200, 0x5, 0x2, 0x5, 0x400, 0x4, 0x5, 0x6, 0x5490, 0x5, 0x400, 0x18c7, 0x401, 0x6]}, 0x45c) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:46 executing program 3 (fault-call:11 fault-nth:33): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) [ 336.615905][T16863] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated [ 336.647565][T16863] EXT4-fs (loop0): get root inode failed [ 336.653328][T16863] EXT4-fs (loop0): mount failed [ 336.737110][T16883] input: syz1 as /devices/virtual/input/input283 21:14:46 executing program 5: keyctl$join(0x1, 0x0) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) r3 = dup2(r0, r1) recvfrom$llc(r3, &(0x7f0000000180)=""/57, 0x39, 0x2000, &(0x7f00000001c0)={0x1a, 0x325, 0x0, 0x7f, 0x8, 0x4, @broadcast}, 0x10) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_RUN(r6, 0x4004ae8b, 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r7, 0x0, 0x0, 0x0) ioctl$IMCLEAR_L2(r7, 0x80044946, &(0x7f0000000240)=0x2) fsetxattr$trusted_overlay_nlink(r6, &(0x7f0000000100)='trusted.overlay.nlink\x00', &(0x7f0000000140)={'L+', 0x3}, 0x28, 0x4) 21:14:46 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a37", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x92}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:47 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x6364) 21:14:47 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r3 = dup3(r2, r1, 0x80000) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r4, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r3, 0x2405, r4) dup2(r0, r1) [ 336.913446][T16900] input: syz1 as /devices/virtual/input/input286 [ 336.932803][T16901] FAULT_INJECTION: forcing a failure. [ 336.932803][T16901] name failslab, interval 1, probability 0, space 0, times 0 [ 337.013302][T16908] input: syz1 as /devices/virtual/input/input287 [ 337.079818][T16901] CPU: 1 PID: 16901 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 337.088266][T16901] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 337.088274][T16901] Call Trace: [ 337.088295][T16901] dump_stack+0x172/0x1f0 [ 337.088317][T16901] should_fail.cold+0xa/0x15 [ 337.088335][T16901] ? fault_create_debugfs_attr+0x180/0x180 [ 337.088356][T16901] ? ___might_sleep+0x163/0x2c0 [ 337.088372][T16901] __should_failslab+0x121/0x190 [ 337.088391][T16901] should_failslab+0x9/0x14 [ 337.130674][T16901] kmem_cache_alloc_node+0x268/0x740 [ 337.130695][T16901] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 337.130712][T16901] ? ip_generic_getfrag+0x120/0x230 [ 337.130740][T16901] __alloc_skb+0xd5/0x5e0 [ 337.151768][T16901] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 337.157325][T16901] ? raw_getfrag+0x164/0x230 [ 337.161912][T16901] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 337.167890][T16901] __ip_append_data.isra.0+0x2667/0x30d0 [ 337.173511][T16901] ? raw_destroy+0x30/0x30 [ 337.177944][T16901] ? __lock_acquire+0x16f2/0x4a00 [ 337.182977][T16901] ? __ip_flush_pending_frames.isra.0+0x2d0/0x2d0 [ 337.189388][T16901] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 337.195627][T16901] ? ip_setup_cork+0x59c/0x8e0 [ 337.200417][T16901] ? raw_destroy+0x30/0x30 [ 337.204819][T16901] ip_append_data.part.0+0xf2/0x170 [ 337.210157][T16901] ? raw_destroy+0x30/0x30 [ 337.214567][T16901] ip_append_data+0x6e/0x90 [ 337.219063][T16901] raw_sendmsg+0xba8/0x2f40 [ 337.223562][T16901] ? dst_output+0x170/0x170 [ 337.228057][T16901] ? lock_downgrade+0x920/0x920 [ 337.232894][T16901] ? __kasan_check_write+0x14/0x20 [ 337.238005][T16901] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 337.244230][T16901] ? aa_label_sk_perm+0x91/0xf0 [ 337.249068][T16901] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 337.254684][T16901] ? aa_sk_perm+0x288/0x880 [ 337.259167][T16901] ? __kasan_check_read+0x11/0x20 [ 337.264187][T16901] ? __lock_acquire+0x8a0/0x4a00 [ 337.269108][T16901] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 337.274649][T16901] inet_sendmsg+0x9e/0xe0 [ 337.278960][T16901] ? inet_sendmsg+0x9e/0xe0 [ 337.283443][T16901] ? inet_send_prepare+0x4f0/0x4f0 [ 337.288538][T16901] sock_sendmsg+0xd7/0x130 [ 337.292940][T16901] kernel_sendmsg+0x44/0x50 [ 337.297428][T16901] sock_no_sendpage+0x116/0x150 [ 337.302259][T16901] ? sock_kzfree_s+0x70/0x70 [ 337.306831][T16901] ? mark_lock+0xc2/0x1220 [ 337.311244][T16901] ? mark_held_locks+0xa4/0xf0 [ 337.315992][T16901] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 337.321780][T16901] ? debug_check_no_obj_freed+0x20a/0x43f [ 337.327479][T16901] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 337.333368][T16901] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 337.339597][T16901] inet_sendpage+0x10f/0x150 [ 337.344177][T16901] kernel_sendpage+0x92/0xf0 [ 337.348761][T16901] ? inet_sendmsg+0xe0/0xe0 [ 337.353258][T16901] sock_sendpage+0x8b/0xc0 [ 337.357665][T16901] pipe_to_sendpage+0x296/0x360 [ 337.362504][T16901] ? kernel_sendpage+0xf0/0xf0 [ 337.367509][T16901] ? direct_splice_actor+0x190/0x190 [ 337.372775][T16901] ? __put_page+0xa7/0xe0 [ 337.377100][T16901] ? anon_pipe_buf_release+0x1c6/0x270 [ 337.382553][T16901] __splice_from_pipe+0x397/0x7d0 [ 337.387577][T16901] ? direct_splice_actor+0x190/0x190 [ 337.392853][T16901] ? direct_splice_actor+0x190/0x190 [ 337.398124][T16901] splice_from_pipe+0x108/0x170 [ 337.402962][T16901] ? splice_shrink_spd+0xd0/0xd0 [ 337.407887][T16901] ? apparmor_file_permission+0x25/0x30 [ 337.413447][T16901] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 337.419672][T16901] ? security_file_permission+0x8f/0x380 [ 337.425293][T16901] generic_splice_sendpage+0x3c/0x50 [ 337.430570][T16901] ? splice_from_pipe+0x170/0x170 [ 337.435577][T16901] do_splice+0x708/0x1410 [ 337.439903][T16901] ? opipe_prep.part.0+0x2e0/0x2e0 [ 337.444998][T16901] ? __fget_light+0x1a9/0x230 [ 337.449664][T16901] __x64_sys_splice+0x2c6/0x330 [ 337.454508][T16901] do_syscall_64+0xfa/0x760 [ 337.458998][T16901] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 337.464871][T16901] RIP: 0033:0x459a59 [ 337.468750][T16901] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 337.488337][T16901] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 337.496731][T16901] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 337.504683][T16901] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 337.512655][T16901] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 337.520610][T16901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 337.528563][T16901] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 21:14:47 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, 0x0, 0x0) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 337.656485][T16915] input: syz1 as /devices/virtual/input/input289 21:14:47 executing program 3 (fault-call:11 fault-nth:34): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) [ 337.697862][T16914] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 337.729614][T16914] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 337.772677][T16914] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 337.794123][T16914] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated 21:14:47 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) keyctl$KEYCTL_CAPABILITIES(0x1f, &(0x7f0000000380)=""/136, 0x88) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0xf41388c7290a270e, 0x0) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f00000001c0)="08264546912efe35beb5fd33933c5d5d1914a76615d92a3631b13981eacad3c9eaf6525efbca548fff00e306c24d78864a617166fbc983e059e747a4bcf36e43eb165f8a167fb80bc258b0cc8b4cd0f8a511c0f425663751c2c3463453a292cd646a5d27387ff5cd7279a7806a9fd019073780e1a38823379c105bf7bdc294a1a3f55f39e9d39164bf7b324dca5a90fff7040b5ae23d731e780e024a7e8373296cfa02c708807351790a4fdf35a3c45fe77bccb38d9991dda2ffea2e575ae28a1220d1fafa0b89895aa4aaef6290b2475fbc6440d3c8a46f2df6bd9e9165f4d34b0f7d81a12489d47c38ac680efb98b4b5") ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x80000) ioctl$UI_DEV_CREATE(r2, 0x5501) r3 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x4, 0x2000) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r3) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000080)={0x101, {0x8e, 0x1800, 0x8001, 0x3, 0x7, 0x3}}) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PIO_UNIMAPCLR(r6, 0x4b68, &(0x7f0000000340)={0x7f, 0x8, 0x9}) pread64(r5, 0x0, 0x0, 0x0) ioctl$VIDIOC_ENUMAUDOUT(r5, 0xc0345642, &(0x7f00000002c0)={0xffffff7f, "e80b11f4ed46b819cbefc4079843f8c181caa374cc92fc9b8b2e04d9d64d0d35", 0x3, 0x1}) getsockopt$bt_BT_FLUSHABLE(r4, 0x112, 0x8, &(0x7f0000000040)=0x7b, &(0x7f0000000100)=0x4) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0x6) [ 337.836152][T16900] input: syz1 as /devices/virtual/input/input291 [ 337.856484][T16914] EXT4-fs (loop0): get root inode failed [ 337.863046][T16914] EXT4-fs (loop0): mount failed 21:14:48 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x8912) [ 337.903160][T16938] FAULT_INJECTION: forcing a failure. [ 337.903160][T16938] name failslab, interval 1, probability 0, space 0, times 0 [ 337.972556][T16938] CPU: 1 PID: 16938 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 337.980490][T16938] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 337.990765][T16938] Call Trace: [ 337.994083][T16938] dump_stack+0x172/0x1f0 [ 337.994108][T16938] should_fail.cold+0xa/0x15 [ 337.994126][T16938] ? fault_create_debugfs_attr+0x180/0x180 [ 337.994147][T16938] ? ___might_sleep+0x163/0x2c0 [ 338.003060][T16938] __should_failslab+0x121/0x190 [ 338.003080][T16938] should_failslab+0x9/0x14 [ 338.003099][T16938] kmem_cache_alloc_node_trace+0x274/0x750 [ 338.003124][T16938] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 338.013928][T16938] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 338.013955][T16938] __kmalloc_node_track_caller+0x3d/0x70 [ 338.013976][T16938] __kmalloc_reserve.isra.0+0x40/0xf0 [ 338.013994][T16938] __alloc_skb+0x10b/0x5e0 [ 338.014011][T16938] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 338.014031][T16938] ? raw_getfrag+0x164/0x230 [ 338.023507][T16938] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 338.023534][T16938] __ip_append_data.isra.0+0x2667/0x30d0 [ 338.023560][T16938] ? raw_destroy+0x30/0x30 [ 338.029848][T16942] input: syz1 as /devices/virtual/input/input292 [ 338.035349][T16938] ? __lock_acquire+0x16f2/0x4a00 [ 338.035378][T16938] ? __ip_flush_pending_frames.isra.0+0x2d0/0x2d0 [ 338.035399][T16938] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 338.035413][T16938] ? ip_setup_cork+0x59c/0x8e0 [ 338.035427][T16938] ? raw_destroy+0x30/0x30 [ 338.035445][T16938] ip_append_data.part.0+0xf2/0x170 [ 338.101367][T16938] ? raw_destroy+0x30/0x30 [ 338.101388][T16938] ip_append_data+0x6e/0x90 [ 338.101411][T16938] raw_sendmsg+0xba8/0x2f40 [ 338.101442][T16938] ? dst_output+0x170/0x170 [ 338.112450][T16938] ? lock_downgrade+0x920/0x920 [ 338.112473][T16938] ? __kasan_check_write+0x14/0x20 [ 338.112507][T16938] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 338.112526][T16938] ? aa_label_sk_perm+0x91/0xf0 [ 338.122475][T16938] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 338.122492][T16938] ? aa_sk_perm+0x288/0x880 [ 338.122506][T16938] ? __kasan_check_read+0x11/0x20 [ 338.122523][T16938] ? __lock_acquire+0x8a0/0x4a00 [ 338.122540][T16938] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 338.122561][T16938] inet_sendmsg+0x9e/0xe0 [ 338.191952][T16938] ? inet_sendmsg+0x9e/0xe0 [ 338.196965][T16938] ? inet_send_prepare+0x4f0/0x4f0 [ 338.202095][T16938] sock_sendmsg+0xd7/0x130 [ 338.206538][T16938] kernel_sendmsg+0x44/0x50 [ 338.211189][T16938] sock_no_sendpage+0x116/0x150 [ 338.216048][T16938] ? sock_kzfree_s+0x70/0x70 [ 338.220641][T16938] ? mark_lock+0xc2/0x1220 [ 338.225133][T16938] ? mark_held_locks+0xa4/0xf0 [ 338.229890][T16938] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 338.235695][T16938] ? debug_check_no_obj_freed+0x20a/0x43f [ 338.241412][T16938] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 338.247207][T16938] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 338.253474][T16938] inet_sendpage+0x10f/0x150 [ 338.258073][T16938] kernel_sendpage+0x92/0xf0 [ 338.262661][T16938] ? inet_sendmsg+0xe0/0xe0 [ 338.267256][T16938] sock_sendpage+0x8b/0xc0 [ 338.272111][T16938] pipe_to_sendpage+0x296/0x360 [ 338.276959][T16938] ? kernel_sendpage+0xf0/0xf0 [ 338.281717][T16938] ? direct_splice_actor+0x190/0x190 [ 338.286989][T16938] ? __put_page+0xa7/0xe0 [ 338.291320][T16938] ? anon_pipe_buf_release+0x1c6/0x270 [ 338.296790][T16938] __splice_from_pipe+0x397/0x7d0 [ 338.301809][T16938] ? direct_splice_actor+0x190/0x190 [ 338.307104][T16938] ? direct_splice_actor+0x190/0x190 [ 338.312385][T16938] splice_from_pipe+0x108/0x170 [ 338.318136][T16938] ? splice_shrink_spd+0xd0/0xd0 [ 338.325436][T16938] ? apparmor_file_permission+0x25/0x30 [ 338.330973][T16938] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 338.337195][T16938] ? security_file_permission+0x8f/0x380 [ 338.342813][T16938] generic_splice_sendpage+0x3c/0x50 [ 338.348081][T16938] ? splice_from_pipe+0x170/0x170 [ 338.353103][T16938] do_splice+0x708/0x1410 [ 338.358398][T16938] ? opipe_prep.part.0+0x2e0/0x2e0 [ 338.364020][T16938] ? __fget_light+0x1a9/0x230 [ 338.368819][T16938] __x64_sys_splice+0x2c6/0x330 [ 338.373674][T16938] do_syscall_64+0xfa/0x760 [ 338.378195][T16938] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 338.384224][T16938] RIP: 0033:0x459a59 [ 338.388468][T16938] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 338.408228][T16938] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 338.416741][T16938] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 21:14:48 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x0, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 338.424732][T16938] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 338.432726][T16938] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 338.441989][T16938] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 338.449958][T16938] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 21:14:48 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r3, 0x0, 0x0, 0x0) getsockname$ax25(r3, &(0x7f0000000140)={{0x3, @netrom}, [@bcast, @bcast, @default, @rose, @bcast, @remote, @bcast, @bcast]}, &(0x7f00000001c0)=0x48) dup2(r0, r1) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_RUN(r6, 0x4004ae8b, 0x0) ioctl$KVM_DIRTY_TLB(r6, 0x4010aeaa, &(0x7f0000000100)={0x8001, 0xfff}) 21:14:48 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a37", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x92}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:48 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) r1 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$setperm(0x5, r1, 0x28020804) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r2 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r2) [ 338.586263][T16943] input: syz1 as /devices/virtual/input/input296 21:14:48 executing program 3 (fault-call:11 fault-nth:35): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) [ 338.688478][T16956] input: syz1 as /devices/virtual/input/input297 21:14:48 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x8933) [ 338.938976][T16981] FAULT_INJECTION: forcing a failure. [ 338.938976][T16981] name failslab, interval 1, probability 0, space 0, times 0 [ 338.968094][T16979] input: syz1 as /devices/virtual/input/input301 [ 339.001609][T16981] CPU: 1 PID: 16981 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 339.009549][T16981] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 339.019619][T16981] Call Trace: [ 339.022945][T16981] dump_stack+0x172/0x1f0 [ 339.027321][T16981] should_fail.cold+0xa/0x15 [ 339.027343][T16981] ? fault_create_debugfs_attr+0x180/0x180 [ 339.027371][T16981] __should_failslab+0x121/0x190 [ 339.042674][T16981] should_failslab+0x9/0x14 [ 339.047190][T16981] kmem_cache_alloc+0x47/0x710 [ 339.051992][T16981] ? lock_downgrade+0x920/0x920 [ 339.056851][T16981] skb_clone+0x154/0x3d0 [ 339.061160][T16981] ip_mc_output+0x3aa/0xf70 [ 339.065660][T16981] ? __ip_queue_xmit+0x1c10/0x1c10 [ 339.065682][T16981] ? ip_append_data.part.0+0x170/0x170 [ 339.065695][T16981] ? dst_release+0x62/0xe0 [ 339.065712][T16981] ? __ip_make_skb+0xf31/0x17b0 [ 339.065730][T16981] ip_local_out+0xbb/0x1b0 [ 339.065753][T16981] ip_send_skb+0x42/0xf0 [ 339.076378][T16981] ip_push_pending_frames+0x64/0x80 21:14:49 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x6, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 339.076395][T16981] raw_sendmsg+0x13c4/0x2f40 [ 339.076422][T16981] ? dst_output+0x170/0x170 [ 339.076444][T16981] ? lock_downgrade+0x920/0x920 [ 339.076463][T16981] ? __kasan_check_write+0x14/0x20 [ 339.076495][T16981] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 339.085734][T16981] ? aa_label_sk_perm+0x91/0xf0 [ 339.085755][T16981] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 339.085770][T16981] ? aa_sk_perm+0x288/0x880 [ 339.085783][T16981] ? __kasan_check_read+0x11/0x20 [ 339.085798][T16981] ? __lock_acquire+0x8a0/0x4a00 [ 339.085815][T16981] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 339.085835][T16981] inet_sendmsg+0x9e/0xe0 [ 339.090990][T16969] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 339.094477][T16981] ? inet_sendmsg+0x9e/0xe0 [ 339.094492][T16981] ? inet_send_prepare+0x4f0/0x4f0 [ 339.094511][T16981] sock_sendmsg+0xd7/0x130 [ 339.094529][T16981] kernel_sendmsg+0x44/0x50 [ 339.094547][T16981] sock_no_sendpage+0x116/0x150 [ 339.094561][T16981] ? sock_kzfree_s+0x70/0x70 [ 339.094577][T16981] ? mark_lock+0xc2/0x1220 [ 339.094597][T16981] ? mark_held_locks+0xa4/0xf0 [ 339.113665][T16981] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 339.122521][T16969] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 339.127512][T16981] ? debug_check_no_obj_freed+0x20a/0x43f [ 339.127529][T16981] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 339.127547][T16981] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 339.127567][T16981] inet_sendpage+0x10f/0x150 [ 339.127590][T16981] kernel_sendpage+0x92/0xf0 [ 339.142637][T16981] ? inet_sendmsg+0xe0/0xe0 [ 339.142660][T16981] sock_sendpage+0x8b/0xc0 [ 339.142680][T16981] pipe_to_sendpage+0x296/0x360 [ 339.150200][T16969] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 339.153907][T16981] ? kernel_sendpage+0xf0/0xf0 [ 339.153928][T16981] ? direct_splice_actor+0x190/0x190 [ 339.153946][T16981] ? __put_page+0xa7/0xe0 [ 339.153961][T16981] ? anon_pipe_buf_release+0x1c6/0x270 [ 339.153980][T16981] __splice_from_pipe+0x397/0x7d0 21:14:49 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x0, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 339.153998][T16981] ? direct_splice_actor+0x190/0x190 [ 339.173812][T16981] ? direct_splice_actor+0x190/0x190 [ 339.173830][T16981] splice_from_pipe+0x108/0x170 [ 339.173848][T16981] ? splice_shrink_spd+0xd0/0xd0 [ 339.173867][T16981] ? apparmor_file_permission+0x25/0x30 [ 339.173889][T16981] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 339.187133][T16969] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated [ 339.187895][T16981] ? security_file_permission+0x8f/0x380 [ 339.187919][T16981] generic_splice_sendpage+0x3c/0x50 [ 339.187939][T16981] ? splice_from_pipe+0x170/0x170 [ 339.206564][T16981] do_splice+0x708/0x1410 [ 339.206594][T16981] ? opipe_prep.part.0+0x2e0/0x2e0 [ 339.206614][T16981] ? __fget_light+0x1a9/0x230 [ 339.206633][T16981] __x64_sys_splice+0x2c6/0x330 [ 339.206657][T16981] do_syscall_64+0xfa/0x760 [ 339.206682][T16981] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 339.227023][T16981] RIP: 0033:0x459a59 [ 339.245484][T16988] input: syz1 as /devices/virtual/input/input302 [ 339.249443][T16981] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 339.249452][T16981] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 339.249467][T16981] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 339.249476][T16981] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 21:14:49 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) [ 339.249484][T16981] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 339.249493][T16981] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 339.249501][T16981] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 [ 339.321415][T16969] EXT4-fs (loop0): get root inode failed [ 339.389688][T16969] EXT4-fs (loop0): mount failed 21:14:49 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb2", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x98}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) [ 339.549631][T16991] input: syz1 as /devices/virtual/input/input303 21:14:49 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x8981) 21:14:49 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r3, 0x0, 0x0, 0x0) r4 = syz_open_pts(r3, 0x4000) ioctl$KDDELIO(r4, 0x4b35, 0xfddd) ioctl$KVM_RUN(r2, 0x4004ae8b, 0x0) ioctl$KVM_INTERRUPT(r2, 0x4004ae86, &(0x7f0000000080)=0x7) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r5, 0x5501, 0x0) r6 = syz_open_dev$evdev(&(0x7f0000000140)='.\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe3\xff', 0x4000000000000004, 0xff578a749ac458d9) ioctl$UI_DEV_DESTROY(r5, 0x5502) dup2(r5, r6) 21:14:49 executing program 3 (fault-call:11 fault-nth:36): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:14:49 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) bind$inet(r3, &(0x7f0000000480)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x24e23, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) write$binfmt_elf64(r3, &(0x7f00000000c0)=ANY=[@ANYRES64], 0xc63b9e35) r4 = accept4$inet(r3, &(0x7f0000000140)={0x2, 0x0, @local}, &(0x7f0000000180)=0x10, 0x81000) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, 0x0, 0x0) connect$inet6(r5, &(0x7f0000d83fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r6 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2e0000002c0081512b4280ecdb4cb904014865160b000114000000000000e7ff000000000000a5c22cbf2a6f380b", 0x2e}], 0x1}, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, 0x0, &(0x7f0000000180)) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r7, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f0000000180)=0x8) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r5, 0x84, 0x14, &(0x7f0000000200)=@assoc_value={r8}, 0x8) setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r4, 0x84, 0x6, &(0x7f0000000240)={r8, @in={{0x2, 0x4e20, @loopback}}}, 0x84) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) setsockopt$nfc_llcp_NFC_LLCP_RW(0xffffffffffffffff, 0x118, 0x0, &(0x7f0000000100)=0x8001, 0x4) [ 339.880126][T17022] input: syz1 as /devices/virtual/input/input309 [ 339.908173][T17024] FAULT_INJECTION: forcing a failure. [ 339.908173][T17024] name failslab, interval 1, probability 0, space 0, times 0 [ 339.923503][T17010] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 339.939507][T17021] input: syz1 as /devices/virtual/input/input307 [ 339.965019][T17024] CPU: 0 PID: 17024 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 339.972951][T17024] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 339.983710][T17024] Call Trace: [ 339.987019][T17024] dump_stack+0x172/0x1f0 [ 339.991375][T17024] should_fail.cold+0xa/0x15 [ 339.995983][T17024] ? fault_create_debugfs_attr+0x180/0x180 [ 340.001808][T17024] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 340.008327][T17024] ? __kasan_check_read+0x11/0x20 [ 340.013364][T17024] __should_failslab+0x121/0x190 [ 340.018310][T17024] should_failslab+0x9/0x14 [ 340.018327][T17024] kmem_cache_alloc+0x47/0x710 [ 340.018344][T17024] ? ip_mc_output+0x584/0xf70 [ 340.018360][T17024] ? find_held_lock+0x35/0x130 [ 340.018379][T17024] dst_alloc+0x10e/0x200 [ 340.027905][T17024] rt_dst_clone+0x59/0x8c0 [ 340.027922][T17024] ip_mc_finish_output+0xb6/0x4a0 [ 340.027942][T17024] ip_mc_output+0x5dd/0xf70 [ 340.027964][T17024] ? __ip_queue_xmit+0x1c10/0x1c10 [ 340.027984][T17024] ? dst_output+0x170/0x170 [ 340.027996][T17024] ? dst_release+0x62/0xe0 [ 340.028011][T17024] ? __ip_make_skb+0xf31/0x17b0 [ 340.028028][T17024] ip_local_out+0xbb/0x1b0 [ 340.028044][T17024] ip_send_skb+0x42/0xf0 [ 340.028057][T17024] ip_push_pending_frames+0x64/0x80 [ 340.028073][T17024] raw_sendmsg+0x13c4/0x2f40 [ 340.028096][T17024] ? dst_output+0x170/0x170 [ 340.028117][T17024] ? lock_downgrade+0x920/0x920 [ 340.028137][T17024] ? __kasan_check_write+0x14/0x20 [ 340.028169][T17024] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 340.032914][T17010] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 340.037572][T17024] ? aa_label_sk_perm+0x91/0xf0 [ 340.037592][T17024] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 340.037605][T17024] ? aa_sk_perm+0x288/0x880 [ 340.037617][T17024] ? __kasan_check_read+0x11/0x20 [ 340.037632][T17024] ? __lock_acquire+0x8a0/0x4a00 [ 340.037650][T17024] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 340.037672][T17024] inet_sendmsg+0x9e/0xe0 [ 340.055400][T17010] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 340.055996][T17024] ? inet_sendmsg+0x9e/0xe0 [ 340.056017][T17024] ? inet_send_prepare+0x4f0/0x4f0 [ 340.178271][T17024] sock_sendmsg+0xd7/0x130 [ 340.182679][T17024] kernel_sendmsg+0x44/0x50 [ 340.187172][T17024] sock_no_sendpage+0x116/0x150 [ 340.192148][T17024] ? sock_kzfree_s+0x70/0x70 [ 340.196734][T17024] ? mark_lock+0xc2/0x1220 [ 340.201245][T17024] ? mark_held_locks+0xa4/0xf0 [ 340.206021][T17024] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 340.212271][T17024] ? debug_check_no_obj_freed+0x20a/0x43f [ 340.217989][T17024] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 340.223805][T17024] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 340.230035][T17024] inet_sendpage+0x10f/0x150 [ 340.234703][T17024] kernel_sendpage+0x92/0xf0 [ 340.239277][T17024] ? inet_sendmsg+0xe0/0xe0 [ 340.243767][T17024] sock_sendpage+0x8b/0xc0 [ 340.248173][T17024] pipe_to_sendpage+0x296/0x360 [ 340.253018][T17024] ? kernel_sendpage+0xf0/0xf0 [ 340.257771][T17024] ? direct_splice_actor+0x190/0x190 [ 340.263043][T17024] ? __put_page+0xa7/0xe0 [ 340.267357][T17024] ? anon_pipe_buf_release+0x1c6/0x270 [ 340.272815][T17024] __splice_from_pipe+0x397/0x7d0 [ 340.277825][T17024] ? direct_splice_actor+0x190/0x190 [ 340.283203][T17024] ? direct_splice_actor+0x190/0x190 [ 340.288487][T17024] splice_from_pipe+0x108/0x170 [ 340.293326][T17024] ? splice_shrink_spd+0xd0/0xd0 [ 340.298356][T17024] ? apparmor_file_permission+0x25/0x30 [ 340.303888][T17024] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 340.310115][T17024] ? security_file_permission+0x8f/0x380 [ 340.315746][T17024] generic_splice_sendpage+0x3c/0x50 [ 340.321019][T17024] ? splice_from_pipe+0x170/0x170 [ 340.326040][T17024] do_splice+0x708/0x1410 [ 340.330375][T17024] ? opipe_prep.part.0+0x2e0/0x2e0 [ 340.335490][T17024] ? __fget_light+0x1a9/0x230 [ 340.340156][T17024] __x64_sys_splice+0x2c6/0x330 [ 340.345001][T17024] do_syscall_64+0xfa/0x760 [ 340.349583][T17024] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 340.355459][T17024] RIP: 0033:0x459a59 [ 340.359352][T17024] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 340.378955][T17024] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 340.387354][T17024] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 340.395311][T17024] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 340.403270][T17024] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 340.411228][T17024] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 340.419192][T17024] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 21:14:50 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x0, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 340.454721][T17010] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated 21:14:50 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) r2 = creat(&(0x7f0000000080)='./file0\x00', 0x61) fstatfs(r2, &(0x7f0000000200)=""/199) r3 = dup2(r0, r1) getsockopt$EBT_SO_GET_INIT_ENTRIES(r3, 0x0, 0x83, &(0x7f0000000100)={'nat\x00', 0x0, 0x4, 0xf, [], 0x2, &(0x7f00000001c0)=[{}, {}], &(0x7f00000000c0)=""/15}, &(0x7f0000000180)=0x78) [ 340.502396][T17010] EXT4-fs (loop0): get root inode failed [ 340.540763][T17010] EXT4-fs (loop0): mount failed 21:14:50 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0xae01) 21:14:50 executing program 3 (fault-call:11 fault-nth:37): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:14:50 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb2", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x98}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) [ 340.673791][T17028] input: syz1 as /devices/virtual/input/input314 21:14:50 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0xc01, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cachefiles\x00', 0x400000, 0x0) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(r3, 0x40a85321, &(0x7f0000000140)={{0x4, 0x2}, 'port1\x00', 0xc, 0x40001, 0x4d7b, 0x8, 0x1, 0x2, 0x7ff, 0x0, 0x0, 0x3}) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:50 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0xbf, 0x240000) ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f00000000c0)) r2 = syz_open_dev$evdev(&(0x7f0000000040)='/dIv\x1dinput/event#\x00', 0x4, 0x180) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r2) [ 340.822779][T17060] input: syz1 as /devices/virtual/input/input315 [ 340.917561][T17072] input: syz1 as /devices/virtual/input/input316 [ 340.970555][T17071] FAULT_INJECTION: forcing a failure. [ 340.970555][T17071] name failslab, interval 1, probability 0, space 0, times 0 [ 341.003328][T17064] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 341.013713][T17071] CPU: 0 PID: 17071 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 341.021961][T17071] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 341.021968][T17071] Call Trace: [ 341.021990][T17071] dump_stack+0x172/0x1f0 [ 341.022014][T17071] should_fail.cold+0xa/0x15 [ 341.022031][T17071] ? lock_downgrade+0x920/0x920 [ 341.022055][T17071] ? fault_create_debugfs_attr+0x180/0x180 [ 341.034080][T17064] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 341.035405][T17071] ? __kasan_check_read+0x11/0x20 [ 341.035430][T17071] __should_failslab+0x121/0x190 [ 341.035449][T17071] should_failslab+0x9/0x14 [ 341.035469][T17071] kmem_cache_alloc+0x47/0x710 [ 341.039936][T17064] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 341.044378][T17071] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 341.044404][T17071] dst_alloc+0x10e/0x200 [ 341.044425][T17071] rt_dst_alloc+0x83/0x440 [ 341.044442][T17071] ip_route_output_key_hash_rcu+0x8d7/0x2d70 [ 341.044463][T17071] ? ip_route_input_noref+0x270/0x270 [ 341.044479][T17071] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 341.044494][T17071] ? __kasan_check_read+0x11/0x20 [ 341.044515][T17071] ip_route_output_key_hash+0x1ef/0x360 [ 341.069915][T17071] ? ip_route_output_key_hash_rcu+0x2d70/0x2d70 [ 341.069940][T17071] ? lock_downgrade+0x920/0x920 [ 341.069972][T17071] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 341.069992][T17071] ip_route_output_flow+0x28/0xc0 [ 341.159450][T17071] raw_sendmsg+0xa30/0x2f40 [ 341.163974][T17071] ? dst_output+0x170/0x170 [ 341.168495][T17071] ? lock_downgrade+0x920/0x920 [ 341.173364][T17071] ? __kasan_check_write+0x14/0x20 [ 341.178523][T17071] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 341.184776][T17071] ? aa_label_sk_perm+0x91/0xf0 [ 341.189641][T17071] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 341.195265][T17071] ? aa_sk_perm+0x288/0x880 [ 341.195278][T17071] ? __kasan_check_read+0x11/0x20 [ 341.195299][T17071] ? __lock_acquire+0x8a0/0x4a00 [ 341.195316][T17071] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 341.195336][T17071] inet_sendmsg+0x9e/0xe0 [ 341.195349][T17071] ? inet_sendmsg+0x9e/0xe0 [ 341.195362][T17071] ? inet_send_prepare+0x4f0/0x4f0 [ 341.195379][T17071] sock_sendmsg+0xd7/0x130 [ 341.195396][T17071] kernel_sendmsg+0x44/0x50 [ 341.195414][T17071] sock_no_sendpage+0x116/0x150 [ 341.243302][T17071] ? sock_kzfree_s+0x70/0x70 [ 341.247908][T17071] ? mark_lock+0xc2/0x1220 [ 341.252341][T17071] ? mark_held_locks+0xa4/0xf0 [ 341.257120][T17071] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 341.262943][T17071] ? debug_check_no_obj_freed+0x20a/0x43f [ 341.268705][T17071] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 341.274527][T17071] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 341.280792][T17071] inet_sendpage+0x10f/0x150 [ 341.285401][T17071] kernel_sendpage+0x92/0xf0 [ 341.290000][T17071] ? inet_sendmsg+0xe0/0xe0 [ 341.293103][T17064] EXT4-fs error (device loop0): ext4_fill_super:4489: inode #2: comm syz-executor.0: iget: root inode unallocated [ 341.294509][T17071] sock_sendpage+0x8b/0xc0 [ 341.294533][T17071] pipe_to_sendpage+0x296/0x360 [ 341.294549][T17071] ? kernel_sendpage+0xf0/0xf0 21:14:51 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) r2 = socket$inet(0x2, 0x2, 0x3) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) bind$inet(r2, &(0x7f0000000480)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e33, @remote}, 0x10) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r2, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) write$binfmt_elf64(r2, &(0x7f00000000c0)=ANY=[@ANYRES64], 0xc63b9e35) getsockopt$inet_sctp_SCTP_NODELAY(r2, 0x84, 0x3, &(0x7f0000000080), &(0x7f00000000c0)=0x4) [ 341.294570][T17071] ? direct_splice_actor+0x190/0x190 [ 341.294587][T17071] ? __put_page+0xa7/0xe0 [ 341.294603][T17071] ? anon_pipe_buf_release+0x1c6/0x270 [ 341.294621][T17071] __splice_from_pipe+0x397/0x7d0 [ 341.294637][T17071] ? direct_splice_actor+0x190/0x190 [ 341.294659][T17071] ? direct_splice_actor+0x190/0x190 [ 341.294677][T17071] splice_from_pipe+0x108/0x170 [ 341.320638][T17071] ? splice_shrink_spd+0xd0/0xd0 [ 341.320662][T17071] ? apparmor_file_permission+0x25/0x30 21:14:51 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x0) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 341.320682][T17071] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 341.320698][T17071] ? security_file_permission+0x8f/0x380 [ 341.320722][T17071] generic_splice_sendpage+0x3c/0x50 [ 341.329797][T17064] EXT4-fs (loop0): get root inode failed [ 341.330347][T17071] ? splice_from_pipe+0x170/0x170 [ 341.340044][T17064] EXT4-fs (loop0): mount failed [ 341.340794][T17071] do_splice+0x708/0x1410 [ 341.340824][T17071] ? opipe_prep.part.0+0x2e0/0x2e0 [ 341.340845][T17071] ? __fget_light+0x1a9/0x230 [ 341.340865][T17071] __x64_sys_splice+0x2c6/0x330 [ 341.413299][T17071] do_syscall_64+0xfa/0x760 [ 341.413320][T17071] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 341.413334][T17071] RIP: 0033:0x459a59 [ 341.428526][T17071] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 341.428536][T17071] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 341.428556][T17071] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 341.428565][T17071] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 341.428574][T17071] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 341.428583][T17071] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 341.428591][T17071] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 [ 341.518681][T17068] input: syz1 as /devices/virtual/input/input320 21:14:51 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb2", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x98}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) [ 341.544797][T17075] input: syz1 as /devices/virtual/input/input321 21:14:51 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140)='/dev/uinput\x00', 0x2, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) prctl$PR_MCE_KILL_GET(0x22) r1 = syz_open_dev$evdev(&(0x7f0000000040), 0x10001, 0x208100) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x802, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r2, 0x0, 0x0, 0x0) write$input_event(0xffffffffffffffff, &(0x7f0000000100)={{}, 0xf132ff57080202c6, 0x6, 0x2}, 0x18) dup2(r0, r1) 21:14:51 executing program 3 (fault-call:11 fault-nth:38): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:14:51 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0xae41) [ 341.869219][T17115] FAULT_INJECTION: forcing a failure. [ 341.869219][T17115] name failslab, interval 1, probability 0, space 0, times 0 [ 341.893452][T17113] input: syz1 as /devices/virtual/input/input323 [ 341.925615][T17115] CPU: 0 PID: 17115 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 341.933564][T17115] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 341.933571][T17115] Call Trace: [ 341.933603][T17115] dump_stack+0x172/0x1f0 [ 341.933626][T17115] should_fail.cold+0xa/0x15 [ 341.955858][T17115] ? fault_create_debugfs_attr+0x180/0x180 [ 341.961677][T17115] ? ___might_sleep+0x163/0x2c0 [ 341.966542][T17115] __should_failslab+0x121/0x190 [ 341.971491][T17115] should_failslab+0x9/0x14 [ 341.977140][T17115] kmem_cache_alloc_node+0x268/0x740 [ 341.982866][T17115] ? rt_add_uncached_list+0x147/0x1a0 [ 341.988253][T17115] ? __local_bh_enable_ip+0x15a/0x270 [ 341.993639][T17115] __alloc_skb+0xd5/0x5e0 [ 341.997978][T17115] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 342.003529][T17115] ? dst_init+0x38e/0x4d0 [ 342.007867][T17115] __ip_append_data.isra.0+0x2667/0x30d0 [ 342.013511][T17115] ? raw_destroy+0x30/0x30 [ 342.013530][T17115] ? __lock_acquire+0x16f2/0x4a00 [ 342.013553][T17115] ? __ip_flush_pending_frames.isra.0+0x2d0/0x2d0 [ 342.022964][T17115] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 342.035664][T17115] ? ip_setup_cork+0x59c/0x8e0 [ 342.040577][T17115] ? raw_destroy+0x30/0x30 [ 342.045012][T17115] ip_append_data.part.0+0xf2/0x170 [ 342.050228][T17115] ? raw_destroy+0x30/0x30 [ 342.054644][T17115] ip_append_data+0x6e/0x90 [ 342.059163][T17115] raw_sendmsg+0xba8/0x2f40 [ 342.063693][T17115] ? dst_output+0x170/0x170 [ 342.068342][T17115] ? lock_downgrade+0x920/0x920 [ 342.073207][T17115] ? __kasan_check_write+0x14/0x20 [ 342.078344][T17115] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 342.084592][T17115] ? aa_label_sk_perm+0x91/0xf0 [ 342.089432][T17115] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 342.095058][T17115] ? aa_sk_perm+0x288/0x880 [ 342.099550][T17115] ? __kasan_check_read+0x11/0x20 [ 342.104562][T17115] ? __lock_acquire+0x8a0/0x4a00 [ 342.109489][T17115] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 342.115024][T17115] inet_sendmsg+0x9e/0xe0 [ 342.119336][T17115] ? inet_sendmsg+0x9e/0xe0 [ 342.123820][T17115] ? inet_send_prepare+0x4f0/0x4f0 [ 342.128918][T17115] sock_sendmsg+0xd7/0x130 [ 342.133412][T17115] kernel_sendmsg+0x44/0x50 [ 342.137900][T17115] sock_no_sendpage+0x116/0x150 [ 342.143603][T17115] ? sock_kzfree_s+0x70/0x70 [ 342.148180][T17115] ? mark_lock+0xc2/0x1220 [ 342.152586][T17115] ? mark_held_locks+0xa4/0xf0 [ 342.157333][T17115] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 342.163122][T17115] ? debug_check_no_obj_freed+0x20a/0x43f [ 342.168823][T17115] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 342.174615][T17115] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 342.180846][T17115] inet_sendpage+0x10f/0x150 [ 342.185423][T17115] kernel_sendpage+0x92/0xf0 [ 342.189991][T17115] ? inet_sendmsg+0xe0/0xe0 [ 342.194478][T17115] sock_sendpage+0x8b/0xc0 [ 342.198881][T17115] pipe_to_sendpage+0x296/0x360 [ 342.203714][T17115] ? kernel_sendpage+0xf0/0xf0 [ 342.208463][T17115] ? direct_splice_actor+0x190/0x190 [ 342.213853][T17115] ? __put_page+0xa7/0xe0 [ 342.218189][T17115] ? anon_pipe_buf_release+0x1c6/0x270 [ 342.223637][T17115] __splice_from_pipe+0x397/0x7d0 [ 342.228651][T17115] ? direct_splice_actor+0x190/0x190 [ 342.233933][T17115] ? direct_splice_actor+0x190/0x190 [ 342.239217][T17115] splice_from_pipe+0x108/0x170 [ 342.244056][T17115] ? splice_shrink_spd+0xd0/0xd0 [ 342.248988][T17115] ? apparmor_file_permission+0x25/0x30 [ 342.254516][T17115] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 342.260737][T17115] ? security_file_permission+0x8f/0x380 [ 342.266355][T17115] generic_splice_sendpage+0x3c/0x50 [ 342.271623][T17115] ? splice_from_pipe+0x170/0x170 [ 342.276783][T17115] do_splice+0x708/0x1410 [ 342.281121][T17115] ? opipe_prep.part.0+0x2e0/0x2e0 [ 342.286240][T17115] ? __fget_light+0x1a9/0x230 [ 342.290924][T17115] __x64_sys_splice+0x2c6/0x330 [ 342.295770][T17115] do_syscall_64+0xfa/0x760 [ 342.300260][T17115] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 342.306136][T17115] RIP: 0033:0x459a59 [ 342.310023][T17115] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 342.329622][T17115] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 342.338025][T17115] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 342.345977][T17115] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 342.353936][T17115] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 342.361898][T17115] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 342.369857][T17115] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 21:14:52 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x0) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 342.442101][T17118] input: syz1 as /devices/virtual/input/input324 [ 342.486575][T17124] input: syz1 as /devices/virtual/input/input325 [ 342.683600][T17114] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 342.719865][T17114] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock 21:14:52 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0xae60) 21:14:52 executing program 3 (fault-call:11 fault-nth:39): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) [ 342.781791][T17114] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 342.816029][T17114] EXT4-fs: failed to create workqueue 21:14:52 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x2, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r3, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r3, 0xc02c5341, &(0x7f0000000180)) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r4, 0x0, 0x0, 0x0) ioctl$TIOCGICOUNT(r4, 0x545d, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) r5 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) write$P9_RSETATTR(r5, &(0x7f0000000140)={0x7, 0x1b, 0x1}, 0x7) [ 342.832665][T17139] input: syz1 as /devices/virtual/input/input327 [ 342.846360][T17114] EXT4-fs (loop0): mount failed [ 342.945205][T17146] input: syz1 as /devices/virtual/input/input328 21:14:53 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb2000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9b}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:53 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0xff02) [ 343.082121][T17151] FAULT_INJECTION: forcing a failure. [ 343.082121][T17151] name failslab, interval 1, probability 0, space 0, times 0 [ 343.124043][T17151] CPU: 1 PID: 17151 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 343.131989][T17151] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 343.142043][T17151] Call Trace: [ 343.142068][T17151] dump_stack+0x172/0x1f0 [ 343.142090][T17151] should_fail.cold+0xa/0x15 [ 343.154271][T17151] ? fault_create_debugfs_attr+0x180/0x180 [ 343.154294][T17151] ? ___might_sleep+0x163/0x2c0 [ 343.154314][T17151] __should_failslab+0x121/0x190 [ 343.154332][T17151] should_failslab+0x9/0x14 [ 343.154347][T17151] kmem_cache_alloc_node_trace+0x274/0x750 [ 343.154368][T17151] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 343.187375][T17151] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 343.193335][T17151] __kmalloc_node_track_caller+0x3d/0x70 [ 343.199153][T17151] __kmalloc_reserve.isra.0+0x40/0xf0 [ 343.199174][T17151] __alloc_skb+0x10b/0x5e0 [ 343.199199][T17151] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 343.199214][T17151] ? dst_init+0x38e/0x4d0 [ 343.199238][T17151] __ip_append_data.isra.0+0x2667/0x30d0 [ 343.224599][T17151] ? raw_destroy+0x30/0x30 [ 343.224620][T17151] ? __lock_acquire+0x16f2/0x4a00 [ 343.224646][T17151] ? __ip_flush_pending_frames.isra.0+0x2d0/0x2d0 [ 343.224666][T17151] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 343.224679][T17151] ? ip_setup_cork+0x59c/0x8e0 [ 343.224694][T17151] ? raw_destroy+0x30/0x30 [ 343.224713][T17151] ip_append_data.part.0+0xf2/0x170 [ 343.234143][T17151] ? raw_destroy+0x30/0x30 [ 343.234162][T17151] ip_append_data+0x6e/0x90 [ 343.234186][T17151] raw_sendmsg+0xba8/0x2f40 [ 343.234214][T17151] ? dst_output+0x170/0x170 [ 343.234236][T17151] ? lock_downgrade+0x920/0x920 [ 343.234254][T17151] ? __kasan_check_write+0x14/0x20 [ 343.234290][T17151] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 343.256055][T17151] ? aa_label_sk_perm+0x91/0xf0 [ 343.256077][T17151] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 343.256092][T17151] ? aa_sk_perm+0x288/0x880 [ 343.256105][T17151] ? __kasan_check_read+0x11/0x20 [ 343.256120][T17151] ? __lock_acquire+0x8a0/0x4a00 [ 343.256142][T17151] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 343.268019][T17156] input: syz1 as /devices/virtual/input/input331 [ 343.270222][T17151] inet_sendmsg+0x9e/0xe0 [ 343.270236][T17151] ? inet_sendmsg+0x9e/0xe0 [ 343.270251][T17151] ? inet_send_prepare+0x4f0/0x4f0 [ 343.270268][T17151] sock_sendmsg+0xd7/0x130 [ 343.270286][T17151] kernel_sendmsg+0x44/0x50 [ 343.284088][T17151] sock_no_sendpage+0x116/0x150 [ 343.284105][T17151] ? sock_kzfree_s+0x70/0x70 [ 343.284123][T17151] ? mark_lock+0xc2/0x1220 [ 343.284144][T17151] ? mark_held_locks+0xa4/0xf0 [ 343.284160][T17151] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 343.284174][T17151] ? debug_check_no_obj_freed+0x20a/0x43f [ 343.284191][T17151] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 343.300341][T17151] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 343.300363][T17151] inet_sendpage+0x10f/0x150 [ 343.300386][T17151] kernel_sendpage+0x92/0xf0 [ 343.300399][T17151] ? inet_sendmsg+0xe0/0xe0 [ 343.300418][T17151] sock_sendpage+0x8b/0xc0 [ 343.300440][T17151] pipe_to_sendpage+0x296/0x360 [ 343.310532][T17151] ? kernel_sendpage+0xf0/0xf0 [ 343.310552][T17151] ? direct_splice_actor+0x190/0x190 [ 343.310570][T17151] ? __put_page+0xa7/0xe0 [ 343.310587][T17151] ? anon_pipe_buf_release+0x1c6/0x270 [ 343.310605][T17151] __splice_from_pipe+0x397/0x7d0 [ 343.310624][T17151] ? direct_splice_actor+0x190/0x190 [ 343.332404][T17151] ? direct_splice_actor+0x190/0x190 [ 343.332422][T17151] splice_from_pipe+0x108/0x170 [ 343.332442][T17151] ? splice_shrink_spd+0xd0/0xd0 [ 343.332467][T17151] ? apparmor_file_permission+0x25/0x30 [ 343.341263][T17151] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 343.360053][T17151] ? security_file_permission+0x8f/0x380 [ 343.360078][T17151] generic_splice_sendpage+0x3c/0x50 [ 343.360097][T17151] ? splice_from_pipe+0x170/0x170 [ 343.373804][T17151] do_splice+0x708/0x1410 [ 343.373833][T17151] ? opipe_prep.part.0+0x2e0/0x2e0 [ 343.373852][T17151] ? __fget_light+0x1a9/0x230 [ 343.391126][T17151] __x64_sys_splice+0x2c6/0x330 [ 343.391150][T17151] do_syscall_64+0xfa/0x760 [ 343.401963][T17151] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 343.401979][T17151] RIP: 0033:0x459a59 [ 343.526061][T17151] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 343.545669][T17151] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 343.554088][T17151] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 343.562066][T17151] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 21:14:53 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x0) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 343.570043][T17151] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 343.578022][T17151] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 343.585999][T17151] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 21:14:53 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_RUN(r5, 0x4004ae8b, 0x0) dup2(r5, r1) [ 343.627250][T17161] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 343.668711][T17161] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 343.690504][T17161] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 343.712111][T17172] input: syz1 as /devices/virtual/input/input332 [ 343.733651][T17156] input: syz1 as /devices/virtual/input/input333 [ 343.769039][T17161] EXT4-fs (loop0): corrupt root inode, run e2fsck [ 343.812685][T17161] EXT4-fs (loop0): mount failed 21:14:54 executing program 3 (fault-call:11 fault-nth:40): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) 21:14:54 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x400454ca) 21:14:54 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb2000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9b}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:54 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_RUN(r4, 0x4004ae8b, 0x0) fsetxattr$security_evm(r4, &(0x7f0000000100)='security.evm\x00', &(0x7f0000000140)=@ng={0x4, 0x2}, 0x2, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) syz_open_dev$rtc(&(0x7f0000000180)='/dev/rtc#\x00', 0xeb, 0x2000) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r6, 0x0, 0x0, 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r7, 0x0, 0x0, 0x0) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r8, 0x84, 0x64, 0x0, 0x0) connect$inet6(r8, &(0x7f0000d83fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r8, 0x84, 0x1d, 0x0, &(0x7f0000000180)) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r9, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f0000000180)=0x8) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r8, 0x84, 0x14, &(0x7f0000000200)=@assoc_value={r10}, 0x8) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r7, 0x84, 0x73, &(0x7f0000000440)={r10, 0x800, 0x0, 0x56b4, 0x4}, &(0x7f0000000480)=0x18) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r6, 0x84, 0x72, &(0x7f00000004c0)={r11, 0x9, 0x20}, &(0x7f0000000500)=0xc) pread64(r5, 0x0, 0x0, 0x0) r12 = syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DEST(r5, &(0x7f0000000400)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0xb4, r12, 0x100, 0x70bd2a, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}, @IPVS_CMD_ATTR_SERVICE={0x4c, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0xbb}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x9}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x5e}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x20}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xfffffffc}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x401}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x80000001}, @IPVS_CMD_ATTR_SERVICE={0x4}, @IPVS_CMD_ATTR_SERVICE={0x18, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x8, 0x81f316e7b6623d9d}}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x5}]}, 0xb4}, 0x1, 0x0, 0x0, 0x9804}, 0x4005010) r13 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r13, 0xae01, 0x0) r14 = syz_open_procfs(0x0, &(0x7f00000001c0)='children\x00') r15 = fsopen(&(0x7f0000000240)='fusectl\x00', 0x2) dup2(r15, r14) [ 344.116362][T17189] input: syz1 as /devices/virtual/input/input335 [ 344.128839][T17190] FAULT_INJECTION: forcing a failure. [ 344.128839][T17190] name failslab, interval 1, probability 0, space 0, times 0 [ 344.173218][T17192] input: syz1 as /devices/virtual/input/input336 [ 344.204070][T17190] CPU: 1 PID: 17190 Comm: syz-executor.3 Not tainted 5.4.0-rc2+ #0 [ 344.212129][T17190] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 344.222404][T17190] Call Trace: [ 344.225712][T17190] dump_stack+0x172/0x1f0 [ 344.230061][T17190] should_fail.cold+0xa/0x15 [ 344.234668][T17190] ? fault_create_debugfs_attr+0x180/0x180 [ 344.240490][T17190] ? ___might_sleep+0x163/0x2c0 [ 344.245354][T17190] __should_failslab+0x121/0x190 [ 344.250301][T17190] should_failslab+0x9/0x14 [ 344.254816][T17190] kmem_cache_alloc_node+0x268/0x740 [ 344.260111][T17190] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 344.266442][T17190] ? ip_generic_getfrag+0x120/0x230 [ 344.271652][T17190] __alloc_skb+0xd5/0x5e0 [ 344.275994][T17190] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 344.281549][T17190] ? raw_getfrag+0x164/0x230 [ 344.286148][T17190] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 344.291879][T17190] __ip_append_data.isra.0+0x2667/0x30d0 [ 344.297530][T17190] ? raw_destroy+0x30/0x30 [ 344.301960][T17190] ? __lock_acquire+0x16f2/0x4a00 [ 344.306994][T17190] ? __ip_flush_pending_frames.isra.0+0x2d0/0x2d0 [ 344.313417][T17190] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 344.319657][T17190] ? ip_setup_cork+0x59c/0x8e0 [ 344.324428][T17190] ? raw_destroy+0x30/0x30 [ 344.328846][T17190] ip_append_data.part.0+0xf2/0x170 [ 344.334058][T17190] ? raw_destroy+0x30/0x30 [ 344.338485][T17190] ip_append_data+0x6e/0x90 [ 344.342990][T17190] raw_sendmsg+0xba8/0x2f40 [ 344.347506][T17190] ? dst_output+0x170/0x170 [ 344.352014][T17190] ? lock_downgrade+0x920/0x920 [ 344.356871][T17190] ? __kasan_check_write+0x14/0x20 [ 344.362002][T17190] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 344.368249][T17190] ? aa_label_sk_perm+0x91/0xf0 [ 344.373110][T17190] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 344.378744][T17190] ? aa_sk_perm+0x288/0x880 [ 344.383247][T17190] ? __kasan_check_read+0x11/0x20 [ 344.388275][T17190] ? __lock_acquire+0x8a0/0x4a00 [ 344.393218][T17190] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 344.398768][T17190] inet_sendmsg+0x9e/0xe0 [ 344.403100][T17190] ? inet_sendmsg+0x9e/0xe0 [ 344.407611][T17190] ? inet_send_prepare+0x4f0/0x4f0 [ 344.412817][T17190] sock_sendmsg+0xd7/0x130 [ 344.417240][T17190] kernel_sendmsg+0x44/0x50 [ 344.421751][T17190] sock_no_sendpage+0x116/0x150 [ 344.426609][T17190] ? sock_kzfree_s+0x70/0x70 [ 344.431202][T17190] ? mark_lock+0xc2/0x1220 [ 344.435628][T17190] ? mark_held_locks+0xa4/0xf0 [ 344.440396][T17190] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 344.446199][T17190] ? debug_check_no_obj_freed+0x20a/0x43f [ 344.451918][T17190] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 344.457728][T17190] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 344.463976][T17190] inet_sendpage+0x10f/0x150 [ 344.468574][T17190] kernel_sendpage+0x92/0xf0 [ 344.473166][T17190] ? inet_sendmsg+0xe0/0xe0 [ 344.477674][T17190] sock_sendpage+0x8b/0xc0 [ 344.482094][T17190] pipe_to_sendpage+0x296/0x360 [ 344.486948][T17190] ? kernel_sendpage+0xf0/0xf0 [ 344.491716][T17190] ? direct_splice_actor+0x190/0x190 [ 344.497006][T17190] ? __put_page+0xa7/0xe0 [ 344.501336][T17190] ? anon_pipe_buf_release+0x1c6/0x270 [ 344.506803][T17190] __splice_from_pipe+0x397/0x7d0 [ 344.511836][T17190] ? direct_splice_actor+0x190/0x190 [ 344.517147][T17190] ? direct_splice_actor+0x190/0x190 [ 344.522464][T17190] splice_from_pipe+0x108/0x170 [ 344.527325][T17190] ? splice_shrink_spd+0xd0/0xd0 [ 344.532506][T17190] ? apparmor_file_permission+0x25/0x30 [ 344.538234][T17190] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 344.544483][T17190] ? security_file_permission+0x8f/0x380 [ 344.550133][T17190] generic_splice_sendpage+0x3c/0x50 [ 344.555424][T17190] ? splice_from_pipe+0x170/0x170 [ 344.560452][T17190] do_splice+0x708/0x1410 [ 344.564798][T17190] ? opipe_prep.part.0+0x2e0/0x2e0 [ 344.569922][T17190] ? __fget_light+0x1a9/0x230 [ 344.574605][T17190] __x64_sys_splice+0x2c6/0x330 [ 344.579469][T17190] do_syscall_64+0xfa/0x760 [ 344.583980][T17190] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 344.589867][T17190] RIP: 0033:0x459a59 [ 344.593761][T17190] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 344.613362][T17190] RSP: 002b:00007f8231fc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 21:14:54 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 344.621781][T17190] RAX: ffffffffffffffda RBX: 00007f8231fc7c90 RCX: 0000000000459a59 [ 344.629783][T17190] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 [ 344.637756][T17190] RBP: 000000000075bfc8 R08: 0000000000010005 R09: 0000000000000000 [ 344.645734][T17190] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8231fc86d4 [ 344.653800][T17190] R13: 00000000004c94e7 R14: 00000000004dfe58 R15: 0000000000000009 [ 344.749898][T17191] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 344.762450][T17194] input: syz1 as /devices/virtual/input/input337 [ 344.796333][T17191] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 344.824802][T17191] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 344.887733][T17191] EXT4-fs (loop0): corrupt root inode, run e2fsck [ 344.900134][T17191] EXT4-fs (loop0): mount failed 21:14:55 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r3, 0x0, 0x0, 0x0) ioctl$UI_SET_LEDBIT(r3, 0x40045569, 0x6) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:55 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x40045564) 21:14:55 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb2000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9b}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) [ 345.012785][T17211] input: syz1 as /devices/virtual/input/input338 [ 345.072062][T17216] input: syz1 as /devices/virtual/input/input339 [ 345.171965][T17214] input: syz1 as /devices/virtual/input/input340 21:14:55 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 345.266914][T17216] input: syz1 as /devices/virtual/input/input341 21:14:55 executing program 3 (fault-call:11 fault-nth:41): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) [ 345.388694][T17223] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock 21:14:55 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) r1 = socket$rds(0x15, 0x5, 0x0) bind(r1, &(0x7f0000000100)=@ax25={{0x3, @null, 0x5}, [@bcast, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default]}, 0x80) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r2 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) r4 = dup2(r0, r2) r5 = syz_open_dev$media(&(0x7f00000001c0)='/dev/media#\x00', 0x12, 0x240000) ioctl$UI_GET_VERSION(r5, 0x8004552d, &(0x7f0000000340)) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r6, 0x84, 0x64, 0x0, 0x0) connect$inet6(r6, &(0x7f0000d83fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r6, 0x84, 0x1d, 0x0, &(0x7f0000000180)) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r7, 0x84, 0x1d, &(0x7f0000000380)=ANY=[@ANYBLOB="01000000f2655ae9f86c0f9c2250152fec90bbf7f6fae8993c8e4c9e1320035441f50532719bb13bde8ce1dcb6602554816226568cdfbd7d4f48f161d824dcd4bbe619e3a960292580a22a2ef641f395962209cca8c66639e709e7265c9c8bd39f46dcccb4a19ee7cb79020b53f91c43ed63acdc8426710b8436537e6d223778d537d7a68e3f17a7812936ad9f5a94", @ANYRES32=0x0], &(0x7f0000000180)=0x8) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r6, 0x84, 0x14, &(0x7f0000000200)=@assoc_value={r8}, 0x8) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r9, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r9, 0x84, 0x8, &(0x7f0000000440), &(0x7f0000000480)=0x4) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r4, 0x84, 0x70, &(0x7f0000000240)={r8, @in6={{0xa, 0x4e22, 0xffffffff, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x10}}, 0x80}}, [0xe00000000, 0x0, 0x3, 0x5, 0x1ff, 0x5, 0x3, 0x3ff, 0x3ff, 0x400, 0xb0c, 0x2, 0x0, 0x702f, 0x1000]}, &(0x7f0000000180)=0x100) [ 345.442413][T17223] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock 21:14:55 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x40045565) [ 345.484908][T17223] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 345.524323][T17223] EXT4-fs (loop0): corrupt root inode, run e2fsck [ 345.544495][T17223] EXT4-fs (loop0): mount failed [ 345.564601][T17238] input: syz1 as /devices/virtual/input/input342 [ 345.608887][T17244] input: syz1 as /devices/virtual/input/input343 21:14:55 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb200000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9c}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:55 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000240)={{0x0, 0x0, 0xe66}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x1ff) r3 = fanotify_init(0x2d90fe388cd86aae, 0x101000) ioctl$int_in(r3, 0x5421, &(0x7f0000000080)=0x4) dup2(r0, r1) [ 345.862680][T17255] input: syz1 as /devices/virtual/input/input345 21:14:56 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x40045566) [ 345.971612][T17253] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 346.014315][T17253] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 346.052640][T17253] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock 21:14:56 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r3, 0x0, 0x0, 0x0) ioctl$CAPI_NCCI_GETUNIT(r3, 0x80044327, &(0x7f0000000100)=0xfb2d) r4 = dup2(r0, r1) setsockopt$inet6_tcp_buf(r4, 0x6, 0x0, &(0x7f0000000240)="ce8f7e2250ef34d88338b4a4d2f5b4856fa5c71ba41106a572d9cfd208c045d7456f3044e2d78b62245621c32d6cc137519c73254bf500b8e4eee630417484f27cb10080684519f8debc6d9bedc63532293f204501fda36330253bb3303683f22165cc8a5c4d173e5916a85ce6022bf159a43b6fcf94d82cc7b0fc4c3d23f435c9980555874170fb59a62d029413a417279cee0c695cf59a5dd782d8e66f66eab5ff75418ba3b7fa5b832ce253625fcabef93466db21892495546bf9e6647fbac52460e5f3fa70b63cab14", 0xcb) [ 346.072413][T17263] input: syz1 as /devices/virtual/input/input347 [ 346.113542][T17253] EXT4-fs (loop0): corrupt root inode, run e2fsck [ 346.134208][T17253] EXT4-fs (loop0): mount failed [ 346.157853][T17268] input: syz1 as /devices/virtual/input/input348 21:14:56 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 346.236434][T17271] input: syz1 as /devices/virtual/input/input349 21:14:56 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb200000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9c}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:56 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x0) [ 346.297400][T17272] input: syz1 as /devices/virtual/input/input350 21:14:56 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r2, 0x0, 0x0, 0x0) write$P9_RUNLINKAT(r2, &(0x7f0000000140)={0x7, 0x4d, 0x2}, 0x7) dup2(r0, r1) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r3, 0x0, 0x0, 0x0) ioctl$SCSI_IOCTL_PROBE_HOST(r3, 0x5385, &(0x7f00000001c0)={0x18, ""/24}) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r4, 0x0, 0x0, 0x0) ioctl$TCSETXF(r4, 0x5434, &(0x7f0000000200)={0xfff, 0xcec, [0x3ff, 0x8, 0x4, 0x5, 0x1], 0xd7fb}) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r5, 0x0, 0x0, 0x0) ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000180)=0xfffffc01) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r6, 0x0, 0x0, 0x0) write$rfkill(r6, &(0x7f0000000080)={0x6, 0x4, 0x0, 0x1}, 0x8) ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000240)={0xfffffffffffffff7, 0x0, 0x10001}) ioctl$DRM_IOCTL_SG_ALLOC(r5, 0xc0106438, &(0x7f0000000280)={0xd9c, r7}) 21:14:56 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x40045567) 21:14:56 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{0x4000}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r1, 0x0, 0x0, 0x0) ioctl$UI_SET_SWBIT(r1, 0x4004556d, 0x0) r2 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r4, 0x0, 0x0, 0x0) ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f0000000180)=r4) ioctl$UI_DEV_DESTROY(r0, 0x5502) r5 = dup2(r0, r2) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r6, 0x0, 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(r6, 0x4008af21, &(0x7f0000000140)={0x2, r5}) [ 346.583370][T17295] input: syz1 as /devices/virtual/input/input352 [ 346.606866][T17283] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 346.647160][T17283] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 346.664532][T17283] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock 21:14:56 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000080)='/dev/input/event#\x00', 0xe3aa, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x7fff, 0x6cdbd4e4c4f384ca) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000140)='/dev/cachefiles\x00', 0x80000, 0x0) syz_open_pts(r1, 0x2) r2 = openat(r0, &(0x7f00000000c0)='./file0\x00', 0x4802c0, 0xd) ioctl$TIOCSSOFTCAR(r2, 0x541a, &(0x7f0000000100)=0x7) r3 = socket$bt_rfcomm(0x1f, 0xb7eaac75eabebd6d, 0x3) dup2(r3, r0) [ 346.692746][T17283] EXT4-fs (loop0): corrupt root inode, run e2fsck [ 346.701884][T17302] input: syz1 as /devices/virtual/input/input354 [ 346.705666][T17283] EXT4-fs (loop0): mount failed 21:14:56 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb200000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9c}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc14b63"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) [ 346.781503][T17299] input: syz1 as /devices/virtual/input/input355 [ 346.833143][T17308] input: syz1 as /devices/virtual/input/input357 21:14:57 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x40045568) 21:14:57 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r2, 0x0, 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_RUN(r5, 0x4004ae8b, 0x0) ioctl$KVM_GET_XCRS(r5, 0x8188aea6, &(0x7f0000000240)=ANY=[@ANYBLOB="050000000000000007000000000000007fefffffffffffff7b0a0000000000000300000000000000000000010000000000000000000000001f00000000000000010000000000000000000070000000000000000001000000"]) ioctl$VT_SETMODE(r2, 0x5602, &(0x7f00000001c0)={0x9, 0x0, 0x3, 0x5, 0x79}) pread64(r1, 0x0, 0x0, 0x0) ioctl$RTC_PLL_GET(r1, 0x80207011, &(0x7f0000000100)) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r6 = syz_open_dev$dmmidi(&(0x7f00000003c0)='/dev/dmmidi#\x00', 0x1000, 0x100) ioctl$KVM_GET_SUPPORTED_CPUID(r6, 0xc008ae05, &(0x7f0000000400)) r7 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) r8 = syz_open_dev$midi(&(0x7f00000002c0)='/dev/midi#\x00', 0x10001, 0x480000) accept$ax25(r8, &(0x7f0000000300)={{}, [@netrom, @rose, @default, @remote, @remote, @netrom, @rose]}, &(0x7f0000000380)=0x48) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) r10 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/sys/net/ipv4/vs/conntrack\x00', 0x2, 0x0) ioctl$SNDRV_TIMER_IOCTL_STATUS(r10, 0x80605414, &(0x7f0000000180)=""/55) dup2(r0, r7) 21:14:57 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) pread64(r3, 0x0, 0x0, 0x0) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r4 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r4) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') write$binfmt_elf64(r0, &(0x7f00000001c0)={{0x7f, 0x45, 0x4c, 0x46, 0x3f, 0x1f, 0x5, 0x56, 0x3ff, 0x3, 0x3, 0x9, 0x2b7, 0x40, 0x19, 0x6, 0x0, 0x38, 0x1, 0x9, 0x5, 0x1}, [{0x4, 0x3, 0x3, 0x8, 0x8, 0x7fffffff, 0x1, 0x9}, {0x6474e551, 0x8f86, 0x3, 0x8001, 0x8000, 0x7, 0x7, 0x80000001}], "929c005101a931dffd211e0e0f590cd608e51a950afd8afc6c62c593bb20b6e46848b57f93121a6d07ddf9c754f472b372a6ab02ad2b2389186296a5d67eb8b531ee5642c09426d47e6e178187895b6f54c7175b8441db2f", [[], []]}, 0x308) ioctl$USBDEVFS_SETCONFIGURATION(r5, 0x80045505, &(0x7f0000000080)=0x20) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$FS_IOC_FSSETXATTR(r6, 0x401c5820, &(0x7f0000000180)={0x9, 0xa6e, 0x0, 0x4662, 0x6f1f}) ioctl$PIO_SCRNMAP(r1, 0x4b41, &(0x7f0000000500)="6feff3f0b832ed83871ec87e32c91cd82460a7e45e8f0c57c880f72ea4de970d759b52d993407bf503c7f1d1c88d205b2579313d658f12ace905fd0553bd4132324ba698bd1d755700a10f578541812eae70b002b5035e0e274c2f638eebb95daa566e44102d6ab56f977cb4c8107926240adb78ec304f1da7e3a66998a64457b7b55a9aaa3e2c2a270e50b3ca2722589c51a319029c6780b68b8a626692d6c0256431baf0d510c4f312f89bace80802370328951eebeb1a700065608ada11f15d8fa7edbe1ba7aebb76e153f7c5217bbd76710be6a11b92d69a9f15406bf7bfd128086158171017c81538fce0010c545d366484415ced8861183a1350f3793a3a7e6a8d84164e59a874066ff012f8e4f3e3db0b39886dbe34a9f15db3f39fb88641e9f38918c202e823737d45cd539b70d6529370bac58f27a21fd154febcf1f39a40b6866bcac6a476d4f75ac2025360578a25380c766246ed271c4cb3300926dc4ee6e5580109e303c7b2236d74ddff44b8f83dd200fcb37fc25f5bd5c8f16373e0b8b2c79161ff5903515e5a20fff12df4ad56d299c565321f32a63d5968dc712221ff07e28d24c52a6d557d8e77e2e899ee41e2d75bff61925aa2c487547eaf125033ab643f1357eb940c5519ed574d361b3bbddfedeae2e6e2dbc8feec76389f0fab0e32a77e56cbfaec2e3ea3c22abaa561a919b948a712591bef116560333f499ed667ea135e859cd8e4ae99f11ee7b24303a96174157be368b766ec57a75582b63c3598e2bec153f459c91e713b73d849cbd95728bda2e194c654ddf7df2a19abcc3e076b565e389f34d97abb2abd1aa3ffa2323edc4f870b1fc97142544842572690fe800e6b59e5698c556acdc1ac76f1b0c98adb326c90ba7bea79511e4b38b8c804c3a4518bec7c30ee6a94b14648c5737a66fc5f560ea08d534b98c5b1cbcb2a9a677489a473276c07d88c73d7245d1609d95429b8590fda38ce502daa1cab9846f27b165a6a1cebab5e5a27fe8183c90b22b9c0833a50acd0a3b2e7e05968e806fb3a96b009fe209a3e1a51a2ab138fe83209b8318dc2ef6408f4e5ab7b726e0ccc4143be4224f2486989c95d348af1d7ea78be0f77ead50c29990ba5cdeab264d7556972a989322463c8b33b24d1ce0c3281d302bfeb189b477a9ccbef59e3a16c61b983e2a11ab2135c636b769854a020a569af2b186e13f926b84130f2584aa6454b3f990304bd541e5f82cbc4e4c4a7716c1f4d8521129754c14ac539f498edfd59773ae456ebc0cbe58e06fe47efa6e376a58aa96e2489ab4b37b1138b18f13bf4ba1910f3eeaad5befebe412d70888f91d558a43192e4277359302567fa0da1074c26ceecd97d86496a7d1da84bc6b5db7230330d4e1f3f12dac612e4c865250b1fde5a509efe97603eb3f32e4d381b6d3cee6366fd0c613b50a98ea0b3ae5d760eaf1c3ad14da2e2268d52cd6d6e5e9be683c97871f87bdafd0998c9052ed50dca6591d72c595fb44763acd89c46bd38443ba876a95c03d75f4a56784d62fe7cc030fd8fdac50120fe7509132b497ebad473f4067be653a50242dd8368fea5414293dab26032e0d8fb44d953cd602229b3f600f05b64aaa015be015dc68369c5607817a4924e0a2c0a169e901c5690deee3e8fc14ecbebe5905a4506b246051c15da64232a4f46c5ef375346caf540c3ffd9e2823642f31815244e3fad7ff3e8773ee5fa9c60a5d3ea4be1eff1d5400e9707a2b8662a9bd2812345216cf01741c7ef612178e3d0855ba03a8d4bc4c47c19bf6bad9b36c4482b09dd8e95c2c1c0e0645a6a3e8a803860aebf987a08d816d01d895509217b4cffd22699c0e984b906026f75d7cc207a5b80d2a3ebbfef59471a12627ade413f0eaf4bb3d3d7dc6e42435c42b5c3aea58372d93fab561b3009831f6297ceabac9b70e315e06d8c3dfdf9663d7005b0b0da8c34b56ee1bcb5b92c68e6dbf93e86a6e5f63d2b23c995d33d2825532418e6c5e78d0d9048576b844c90b2eb0cead61c64f940fd7d0f13c18f5942d5aa2f575c29afe52658afb4482d48771d500787f6e1909eec10407f5c03de9fd655a175e3da0913e71feb1236fc5ff891f021ef99243f7adcef2fb7497c5e8d79320f2ad8806a34c84f66bdcb715e86aa232e08366e2b527e87b97e962ab35a5871f4c3076d374d16245397198596ed4e65fed9698515b9a61c0f253c9e0a63d28f6ae5c91c7a715f76c4f7ea3a10be9416dffb406e659b0911ca0f37a26ab060123e7ff301dd98ebef44195ca5a9594f16fefe4e12138dee09cd29df25bef1b039b1d23aed3d51843f0872c1c671d735ebdfadba73553ae443ee871a4a0495403aad85e953bd9384e95b0ed17bb4d28156fc77301b5fdb708ec5189c82db6a78ed2ce94b257825897c38e486b596d4292850319a3aac17e3cc9af24822e0a9aafe2902cccf355dfe0f39f4755df3390481f5b733e438d09650e44c8a4da1f2469b1d2c0537b55cd06ccd1df6d93ead596418a0851d871d7bcd6c7c972f9588d6f1e91d3f8ab4f647be4ab85878ace99c4b890ae855ade5cc090dcad5fe7f324ef439e8254a75078fe62ba72cde56708d6e62ec080e3ee66277b78ce64c5c88a1659b3a9b7bfbb160cd8ee4cfa24f06e7255b6a89d08f725badaf257db610e8e3cf4f5ead0eaa8d96c61f9d47697ac7122b86b0a46087fe3a09f90f75303b48a456663a2e8d1741f9d39d35a22cac7f74827abb343506916a60579e512dbe69952ffb7fea0a5b0b318bbfce9bbce47339239ac7592f3b599215b936ddedf306dad9d92abdcfef1af8a081531fb109bba2e884d0e8c30d6180c8a50c329e82465d1d67bb9ec1f2c819edbc69991bff8cff31713a91ff78b2dae0808fad4f1b135788bc74c93503ae762a82b4aae0a7b2d9dd78dffecf28a106883ea7bb3618833f3ec06de5f1689405b81c43c735f610236fe4d20c64c451f6be9d74248b6ccfa29d993a6d73430636c93483fd45d306abcf6dd1a8c6ce7a38194b240e82fda877dbe862d7c01da597af44c8aa13a45f4ee1a8b8e4c3c750a9a5eb5c3b51cc4d577d104fcd1fd2e774ff00e34985eed05e8351a7a893282053c4e3d4d70cdc0c91b3016dbd11cef281af7ab444fb860d80932e4a91fd984914ffb59ef459ad94adebf5d4b59780bf989a887afc4fc528f2b987939d1309d35ee7289b9d23464af6506d6e23a656914adcd67688e670049d599498d6fe9c6257de0559eb748678792c1abd5f0a24012e13c407444324443ca7b957ae764ce77a101dcbd78a8951b003e044ae342d26b0407db305ae6f1d0435f6f4511dc1fee5e904a79168283cac409cea0ac2c194bec4dc944d6238c534ba3e1f58f491bed4a345ccb392cea9f894ecad5c5dbd153983d1a39dba6c99f401e6d0b784a6eaafa4791ac62946f25388cace0359ca5736d44d183b92c15abcb96a195d0b06345e2b8ce730a50d8f35fabdec22a44488ede1a8b2772713c332ec1d8b3d4d84299f30d4f76b54e369dccff2dc583c8b2e10339dfc086e21c0bf339c9a353d95bbc891aafdab3798697f58f4b520b45503a7fb1ccac849a3bacc700ca2a32938c1f1a27a28a34650053499d97fa3320aceed16aca115d0e8bf9b13f373ec9b63b617e849a2f4374afe1d16d177269d914588fb633c7ce0462c3934d3c908bb95aeef554daf5288f5cd3a6cf094b643e6dbeca1539dc291f4276e1e7b2ee983749c743e5389e36976904ef12f08545ca207e95757efad5a44a8867074eb7d84fec39e772b8ddab53eabd7b46eccc21f19aba2cce84150bd3a6962375bd733c8abc116d44971a4a76164f855f4d78da1123dfd93af8a2c03acb95ea2cc66b3f01f7da13906b73574d08b9f1b4ef54c5bf31bd8e4f97e0b0fb3314b8587d69f208c35d3fc90d94dd4bc783ed08269ba082409bac975f3829908f6ecd0ff9d4949d4a9c78ad0f4d7a556346eceddc9b4711bb9706b56be232953d09963e36b7d3b7c1ecea2b5a0fbc36595aa91e8a90a6c5afc519f6346f2b9603cb8a4a96f8b3071ef2cb0970060c32a3c7ca7a3f7705e4cdf8ac5ccd596c28c9227cf04c69352a63db9f2fa3e1248096e5388dbda380d85a3af394698cd07adb2370748dd7ea1431d1706222f7937acf5ab67b5221faaabaf041b2a313c49d342e0cea9bfea841eff95a77479a978fae6aaff216699f45d6985f26897d3dd6d951f36744ccc1f60e6e04360621cfbaca44e4b4f28c37006580173dda372a20dc48c86ec057af245a3c052fec0a8520207b916538b2f6978c30a2015cb6b0f2e7831a8eae075c03d833547b0a59990293df0aabd22428dd2c28a703d471cea6988208b591b17389bbbea4463c11306932f9f8b3f3ca708698c526b9fbd0f1c8425c8462b1ee6a028238dfb9c0e7d8a22e095ac5aca24e03318eb497a604a037ef7ad89494721a8203e8205ed6f1be6c8c12b014fa7f99d2193536594100ffa08a58147fbc8759cc39c8cf9dc3ad01706cbc8097f6f7b0fe6cb197a429f0fbf63e62a7f30bddeb5589a0551cb7db931170eaed1635f03d05f0ba1e845370a9ea06805252d0be90e90d2a8d87c4b00496dbb864e3ec8a96f26493e38320dbd61a33315c236ccacc134a5d02c01b758b04ee579fa52ae25939de86fa8934f7de2bc643f14ed8653da2a8e975392b973cc7326ce2580788187fe3b17e5d1dda9464a87e0bd107012610b74fc902872bbec7508a46f80a6770b54749fe3c36fd0c738dfb42761de5d343d3c89e244ec92cc95c2f54ab0e6270baae3ec03ef1fa886810fb19449a314f88afba2bb3e5105a037ecc58b53fdb93d6290aad8c311996eb761240f6dcce275bcef3609068fd37490b3366af10635d098153cef3fcef33054be7072780a9fecff137bb17ba2623afce08dcd76a01c2b94e360d126613f46c43fddb398f6b2a90d18fe9c27587f130cf4f0e10066186eb1400bee714953aefca4c3cf2cbd6aec8c3e506068ac4569564f9acbe55677587039c0fa5e3d012cf22fb422ba3c334492338fe3223cc877c96663617a877bb044b08000ea6597e062935d43724c97e26edf7e7747eed855eb98d32fe5d3e119b90ce7d9339a14c9b0018f9074fa98bcae14c69ea36bc1d2cef2f507b39147d5f8475d9eadaffbc045c66be02b25a7648ee02a9ca988b0d1c372b96eb68c31e6bb146cdf035a3b6e2958771fa66a3654f84cd50e9ad7172d9e57ec634b15d44c020e5ad5c616ac589958fa6288d8a75df32610d8febd591611e96bca3d9cebd304eb5df611c5a6e031a969d71497493d6a17e84e4142480707f0402d5b9194d33d617e92ac365388b88e3becaa7603dc0a3d39e82941615a79c4ae423ea7cc50b8a6b99200776ca85081cecb89c40bd0f2758a8b77176f193aa1001782be0d924f341bd51a2cdb68e0cf8c916c64950c82ec89fc4cebaf049ce8e29b0c1bbcbe2bac18b085054f7b88005b0afc919516be8939e9918c4a63af29fce23f9a8e36a51ebd59ee214e7d370e07e28e066c72638f9bf058207b6fe713eceb58adada59fa6c5fb7a52cffa59a32fcadfc9ed3c5ab8a59452be46b177cdc7f8c51d758ac8982f987e6b9e500c527f4e41a94912898bf19ec258e2411a8fa3aa48b0e35140df29fff8a643da26c27db56d519575cea7a69b471666ddccf734bcd4cdd4abcd15efac5fdab1ff692bffaef93e0750c2746a852180aae33beff92cf3df469bf1462d78b71d72b518e937") mbind(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0xc000, &(0x7f0000000140)=0x2, 0x7, 0x5) [ 347.071924][T17320] input: syz1 as /devices/virtual/input/input359 [ 347.093062][T17315] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 347.126546][T17315] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 347.151653][T17322] input: syz1 as /devices/virtual/input/input360 21:14:57 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, 0x0, 0x0) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 347.190018][T17315] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock 21:14:57 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10009, 0x0) [ 347.250713][T17315] EXT4-fs (loop0): corrupt root inode, run e2fsck [ 347.298991][T17315] EXT4-fs (loop0): mount failed [ 347.361619][T17322] input input363: cannot allocate more than FF_MAX_EFFECTS effects 21:14:57 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x40045569) 21:14:57 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{0xfffe, 0x2000}, 'syz0\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='net/softnet_stat\x00') ioctl$KVM_SET_XSAVE(r3, 0x5000aea5, &(0x7f0000000240)={"f4f1ad91864b903fac133e8977d4ba6d229eb02729589c24283db26a21486c21f30af7a796141f050eaf77579b5fee60ef07045e74d01feeecfe18feb40fe380a1b5d5014ac4dc4c792c3d3a7e4afb4399b1fb2364ffedf6ebcd1e12953b0d0b6ce6a01e755d3b3e13306e422a11a70b51301742160af4bac685726b89be1b26e13112493c10dbd801b3d18b144ed9ce8f21bba6ba801a74d770b3747a05c3176e685006d836f387205494319862be1a327ed1daf9de2a8f5d6d72eb98cf138ab8543da26619fbeddfbaab1bf1912e0a86b5d14e44a3d8ff4c14df74fb4bc15dd10180f51f53719331db2d676a1838f7cdb91ba05dbe8a5f18c5abcf742baef37cde7f51fc9bdf56f989a2667117932ab7b86b13dad3d72941161af290379a35d9174c30c28148462409f2f488910b88f7678e9438e9e18e0b33b470bc1dba1ae3752cc4ace5568133e4b0885677cb8911dfba3f5ff9485d90a6659515f4714ba25d77430e9033bdacd67bf92c821e2ebea8fffd7abee81962bf3a3e31fcddd86c7f4fdfaf46f79137731f4cf632e57a5c234276037be6d0c3f28cad25cc631e3c05b8fb93568a612e1bb6635beb7c9d6d448ee5be6c7441bc2ee6cdeee9bb0bba7b281572f1b7dd0f8c16d45654d52c0b72bb471e0fae8e4bd100c69feb8c98e7f675d61c9974fcf274fdfee7cf8fab3f96fa463dadf3903ecc26061d257259ad45543cdb9dff681fc03512611cc24ead581b1fc0600fc3dd83a5270a5489acb8ae8af1d8c05e82f272f41acdeb5d08db86354c4d4c8e82dd6103b733afbd691b5b8449f2894e5d05e85c4650ba0e23271823ec2a51aab4d17d18738388cabf7abe71408bef39f471ce30dc69d06194ea5284a19cabb45bfa5f409d4298a41138b65096129ac4f7c8d917d59d1f5dcddf70ddc3afce35e38f4f71d45bd9b3862f32248c3be0c760fc012d0af82010fccf38281cfb804d752f4c2d4c9e68f6e9840e630443faaa87712a7111de95f40d3cd1bd3f2067ab7d6282f79f93717ab75e1ebcf857fae8af411d5d141478ba1bb9a29d2f57370e4b6da5e97803aae7fe148f9dd27c313514e4d3febf69dc3fa5d87e204d1b052c5dd692abcde175a77ba2eafb8139bb4dee7d899e96b9385e10628afcce95b1bfab97d2e6ef658f482f0a5b7b55a0bfdfc05d0bc86ed06ba68b2236fce1087ce96623b0b7d171ffad8a01a76a1f8709a8a43d73e4898a16b38278e6d14b1462197a0a8cc0c01404063bab37824723e5f2d965ec53c92e4d219b78c64a887ff428d02b7d4ad4f3583941420c358aa9065069c740d7c74b2763c466ea728386833e5707619742fe696cb25a477c37ad2e3df94bab465acebd97b592840bdec32c130d47ac69a20dbc6d608c8bb06d8617f8e2f082ceedd278ecd7dba095c0733ecaaca2cdcb82e07796f6"}) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:57 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9d}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:57 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x104800) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, 0x0, 0x0) connect$inet6(r2, &(0x7f0000d83fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f0000000180)) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f00000001c0)={0x1, [0x0]}, &(0x7f0000000180)=0x8) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r2, 0x84, 0x14, &(0x7f0000000200)=@assoc_value={r4}, 0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f00000000c0)={r4, 0x98, "8a4958e1d052783e223df11346bf81811ea3944d4505d35d70d14162d466f51cd63acb175c16af3493f7660c1341508cf5207a9ddc4552895e1e0662e29b350f16ef1fcf2e9fafead92f4305f97ca0c04dda78000ae9bc858effc06230244c4335ad901ad65544e6f30a245b75860869e01e7cc24b43d3dabc6be60ca8ad7c253ec6180cb3ba546541d0ccceecdc62755f54f404d42fbd54"}, &(0x7f0000000180)=0xa0) r5 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r5) [ 347.561380][T17348] input: syz1 as /devices/virtual/input/input365 [ 347.661587][T17356] input: syz0 as /devices/virtual/input/input366 [ 347.774942][T17357] input: syz1 as /devices/virtual/input/input368 [ 347.814067][T17360] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock 21:14:57 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/pmtu_disc\x00', 0x2, 0x0) ioctl$KVM_GET_DIRTY_LOG(r1, 0x4010ae42, &(0x7f0000000140)={0x1fe, 0x0, &(0x7f0000fee000/0xf000)=nil}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r2 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r4, 0x0, 0x0, 0x0) ioctl$UI_DEV_DESTROY(r4, 0x5502) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r7, 0x0, 0x0, 0x0) ioctl$TUNSETVNETBE(r7, 0x400454de, &(0x7f0000000180)=0x1) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r2) 21:14:57 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r1, 0x0, 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r2 = syz_open_dev$evdev(&(0x7f0000000080)='/dev/input/event#\x00', 0x4, 0x0) dup2(r0, r2) [ 347.825717][T17360] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 347.860575][T17360] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 347.900700][T17360] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue 21:14:58 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x4004556a) 21:14:58 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9d}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) [ 348.010419][T17378] input: syz1 as /devices/virtual/input/input371 [ 348.125257][T17387] input: syz1 as /devices/virtual/input/input372 [ 348.158164][T17378] debugfs: Directory 'vcpu0' with parent '17378-10' already present! 21:14:58 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, 0x0, 0x0) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 21:14:58 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/in\x00\x00\x00\x00\x00\x00\x00\x00t#\x00', 0x2, 0x103000) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:14:58 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x100e0, 0x0) 21:14:58 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{0x0, 0x0, 0x2e1}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 348.375193][T17390] input: syz1 as /devices/virtual/input/input374 21:14:58 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r2, 0x0, 0x0, 0x0) r3 = gettid() ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x3c) ptrace$cont(0x18, r3, 0x0, 0x0) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r3, 0x0, 0x0) r4 = syz_open_procfs(r3, &(0x7f00000000c0)='attr/fscreate\x00') ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000100)={0xfc92, 0x1, 0x2e3cbd000d672742, r4}) r5 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm_plock\x00', 0xa4180, 0x0) ioctl$UI_DEV_CREATE(r5, 0x5501) dup2(r0, r1) [ 348.501236][T17393] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 348.536766][T17393] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock 21:14:58 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x4004556b) [ 348.561941][T17393] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 348.574762][T17414] input: syz1 as /devices/virtual/input/input378 [ 348.599653][T17393] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue 21:14:58 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r1, 0x0, 0x0, 0x0) write$uinput_user_dev(r1, &(0x7f0000000080)={'syz0\x00', {0xfffb, 0x0, 0x1f, 0x5}, 0x3c, [0x0, 0x5c, 0x6, 0x131, 0x1, 0x81, 0x6, 0xffffff95, 0x2, 0x3ff, 0x8, 0xffe00, 0x91, 0x6, 0x3a66, 0x5, 0x7, 0x3, 0xe3, 0x7, 0x2, 0x800, 0x8b, 0x7, 0xac, 0x1d, 0x9451, 0xbae, 0x9, 0x2, 0x8000, 0x4, 0x3, 0x5, 0x7fffffff, 0xd8dd, 0x6, 0x5, 0x80, 0x9, 0xb4, 0x8b, 0x4, 0x9, 0x8, 0x80000001, 0x80, 0x2, 0x200, 0x9, 0x5, 0xffff, 0x9, 0x2, 0x4, 0x8, 0xffffffff, 0x200, 0x6, 0x69d, 0xf6, 0x10001, 0xffff, 0x3f], [0x9, 0x1f, 0x2, 0x20000000, 0x8, 0xfffeffff, 0xffffff7f, 0xffffffff, 0x5, 0x2, 0x2, 0x20000000, 0x1f, 0x9, 0xce7f, 0x2, 0x1f, 0x0, 0x8, 0x2, 0x6, 0x3, 0xfff, 0x4, 0x7, 0x7, 0x2, 0x2, 0x5, 0x40, 0x0, 0x1, 0xcd98, 0x2c3, 0x1, 0x0, 0x8, 0x7ff, 0x1f, 0x2, 0xffffffff, 0xff, 0x9, 0x40, 0x3f000000, 0x3fc, 0x0, 0x1ab, 0x1c02, 0xfffffc00, 0x0, 0x0, 0x100, 0x3f, 0x5, 0x7, 0x4, 0x5, 0x8, 0x1, 0x1000, 0xfff, 0x80000001, 0x7], [0x3, 0x200, 0x80000000, 0x8, 0x4, 0x4, 0x80000000, 0xfffffff8, 0x52b, 0x3f, 0x80000001, 0x8001, 0x6, 0x278e, 0x7, 0x4, 0xfffffff8, 0x71, 0x7, 0x8a, 0x5, 0x3, 0x9, 0x7, 0xfffffff7, 0x3, 0x304, 0x2, 0x40, 0x3, 0x1, 0x5, 0xa1fb, 0x8, 0xc76, 0x8, 0x9, 0xfc9d, 0x7, 0x3ff, 0xb0, 0x6, 0x4, 0x7, 0x4, 0x5, 0x5, 0xab, 0x8, 0x80000001, 0x0, 0x9, 0x10001, 0x2, 0x0, 0x4, 0x1, 0x7bc6, 0xfffffffe, 0x7, 0x0, 0x401, 0x400, 0xda], [0x7fff, 0x4, 0x4, 0x240, 0xf8000000, 0x7, 0x4, 0xf21, 0x0, 0x2, 0x373, 0x4, 0x29, 0x6, 0xffff, 0x0, 0x40, 0x3f, 0x5, 0x10000, 0x3, 0x5b93, 0x668a55c7, 0x9, 0xa0, 0x7, 0x7, 0xfff, 0xd72, 0x3, 0x22ee, 0xde9, 0x100, 0xd5e4, 0x9, 0x8001, 0x5, 0x1000, 0x2, 0x3, 0xe56b, 0x0, 0x6, 0x0, 0x3, 0xfffffffb, 0x2, 0x2, 0x3ff, 0x0, 0x8, 0x80, 0x8, 0x7, 0x4, 0x5, 0x8, 0x9, 0x7864, 0x1, 0x7, 0x101, 0x5, 0x200]}, 0x45c) r2 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r2) 21:14:58 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9d}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) [ 348.712419][T17423] input: syz1 as /devices/virtual/input/input379 21:14:58 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r1, 0x0, 0x0, 0x0) ioctl$UI_DEV_DESTROY(r1, 0x5502) r2 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r2) [ 348.884784][T17428] input: syz1 as /devices/virtual/input/input382 [ 348.922355][T17437] input: syz1 as /devices/virtual/input/input384 21:14:59 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r1, 0x0, 0x0, 0x0) r2 = creat(&(0x7f0000000140)='./file0\x00', 0x1) connect$pppoe(r2, &(0x7f0000000180)={0x18, 0x0, {0x4, @empty, 'bcsh0\x00'}}, 0x1e) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r3, 0x0, 0x0, 0x0) r4 = accept$inet6(r3, &(0x7f0000000080), &(0x7f0000000200)=0x1c) listen(r4, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r5 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) ioctl$KVM_TRANSLATE(r1, 0xc018ae85, &(0x7f00000001c0)={0x2000, 0x1000, 0x9, 0x2, 0x9}) dup2(r0, r5) 21:14:59 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x4004556d) [ 349.044674][T17440] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 349.066107][T17440] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 349.106727][T17440] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock 21:14:59 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, 0x0, 0x0) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 21:14:59 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r1, 0x0, 0x0, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, 0x0, 0x0) connect$inet6(r2, &(0x7f0000d83fe4)={0xa, 0x4e23, 0x0, @loopback, 0x7}, 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f0000000180)) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f0000000180)=0x8) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r2, 0x84, 0x14, &(0x7f0000000200)=@assoc_value={r4}, 0x8) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f0000000100)={r4, 0x9}, &(0x7f0000000140)=0x8) r5 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r5) 21:14:59 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x1ffe0, 0x0) [ 349.201773][T17440] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue [ 349.235777][T17455] input: syz1 as /devices/virtual/input/input386 [ 349.272390][T17458] input: syz1 as /devices/virtual/input/input388 21:14:59 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9d}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:59 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x4004556e) [ 349.479112][T17466] input: syz1 as /devices/virtual/input/input391 21:14:59 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setreuid(0x0, r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f00000014c0)={0x0, 0x0, 0x0}, &(0x7f0000001480)=0xc) setregid(0xee01, r4) lchown(&(0x7f0000000080)='./file0\x00', r2, r4) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r5 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r5) [ 349.635547][T17478] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock 21:14:59 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180)='/dev/zero\x00', 0x40, 0x0) ioctl$EVIOCGUNIQ(r2, 0x80404508, &(0x7f00000001c0)=""/47) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) r4 = dup2(r0, r1) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r5, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r5, 0x40086408, &(0x7f0000000240)={0x83ff, 0xfffffffe}) ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000140)={&(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x6, 0x40}) [ 349.680165][T17478] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 349.692317][T17489] input: syz1 as /devices/virtual/input/input393 [ 349.699436][T17478] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 349.712399][T17478] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue 21:14:59 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9d}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:14:59 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) r2 = dup2(r0, r1) ioctl$VIDIOC_S_TUNER(r2, 0x4054561e, &(0x7f0000000080)={0x40, "55bccc25691e1aeefbed12fb93fc8561fc55e02437146725d77d4c2e14639bd9", 0x5, 0x100, 0x98, 0x80, 0x8, 0x2, 0xbdc, 0xfff}) 21:15:00 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x319000, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) fcntl$getownex(r3, 0x10, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$l2tp(0x18, 0x1, 0x1) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:15:00 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x40049409) [ 350.042128][T17514] input: syz1 as /devices/virtual/input/input400 [ 350.081592][T17508] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock 21:15:00 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_RUN(r3, 0x4004ae8b, 0x0) dup2(r3, r0) 21:15:00 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 350.164928][T17508] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 350.190427][T17522] input: syz1 as /devices/virtual/input/input401 [ 350.200367][T17508] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock 21:15:00 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x2) [ 350.269797][T17508] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue 21:15:00 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9d}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:15:00 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = add_key$keyring(&(0x7f0000000180)='keyring\x00', &(0x7f0000000200)={'\x86yz'}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000980)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, r3) r4 = add_key$user(&(0x7f0000000140)='user\x00', &(0x7f0000000180)={'syz', 0x1}, &(0x7f00000001c0)="5f7cc5048a71b0067c2d6d3c9fdf5ae2e387fa8d06512547ee16a9ab9a38a31a8b3f722bc70ffc51e15e34477fdfa3715f", 0x31, r3) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f0000000340)='rxrpc\x00', 0x0) r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0x8f0100, 0x0) ioctl$VIDIOC_ENUMINPUT(r5, 0xc050561a, &(0x7f0000000240)={0x4, "63ef02106a408c1304414354f8ace0ed949a4bdadd88d785c0a700008000", 0x1, 0x5, 0x2, 0xf900, 0x1000060, 0x8}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:15:00 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x40085203) [ 350.508347][T17545] input: syz1 as /devices/virtual/input/input406 21:15:00 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000080)='/dev/input/event#\x00', 0x3, 0x8000) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 350.665682][T17556] input: syz1 as /devices/virtual/input/input407 21:15:00 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) link(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='./file0\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 350.806083][T17565] input: syz1 as /devices/virtual/input/input410 [ 350.819939][T17552] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 350.852400][T17570] input: syz1 as /devices/virtual/input/input412 [ 350.858913][T17552] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock 21:15:01 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) syz_open_dev$media(&(0x7f0000000080)='/dev/media#\x00', 0x9, 0x101000) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x1a) r1 = syz_open_dev$swradio(&(0x7f00000000c0)='/dev/swradio#\x00', 0x1, 0x2) ioctl$UI_DEV_SETUP(r1, 0x5501, 0x0) r2 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x1, 0x30420) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r2) [ 350.893107][T17552] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 350.940266][T17552] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue 21:15:01 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x4008556c) 21:15:01 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9d}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) [ 351.001334][T17573] input: syz1 as /devices/virtual/input/input413 21:15:01 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00', 0x2}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000180)='/dev/input/event#\x00', 0x7, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_RUN(r5, 0x4004ae8b, 0x0) ioctl$EXT4_IOC_GROUP_ADD(r5, 0x40286608, &(0x7f0000000140)={0x9, 0xff, 0x0, 0x7, 0x4, 0x1}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) socketpair(0x8, 0x4, 0x8, &(0x7f0000000100)) r6 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) bind$inet(r6, &(0x7f0000000480)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r6, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x24e23, @local}, 0x10) setsockopt$sock_int(r6, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r6, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x518}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) write$binfmt_elf64(r6, &(0x7f00000000c0)=ANY=[@ANYRES64], 0xc63b9e35) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r6, 0x84, 0x7, &(0x7f00000001c0)={0xe44}, 0x4) 21:15:01 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) r2 = dup2(r0, r1) sendto$unix(r2, &(0x7f00000000c0)="47acae87e844fa1d237fe1b154d0377f580d905ad56f93", 0x2b5, 0x24008818, &(0x7f0000000100)=@abs={0x0, 0x0, 0x4e24}, 0x215) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000080)='hybla\x00', 0x6) [ 351.154589][T17585] input: syz1 as /devices/virtual/input/input416 21:15:01 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 21:15:01 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x4) [ 351.304140][T17593] input: syz1 as /devices/virtual/input/input417 [ 351.316600][T17594] input: syz1 as /devices/virtual/input/input418 [ 351.445456][T17592] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 351.492302][T17592] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock 21:15:01 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x40086602) [ 351.559032][T17592] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 351.592228][T17592] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue 21:15:01 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000014c0)={0x0, 0x0, 0x0}, &(0x7f0000001480)=0xc) setregid(0xee01, r1) r2 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000140)='/dev/video1\x00', 0x2, 0x0) ioctl$VIDIOC_ENUMINPUT(r2, 0xc050561a, &(0x7f0000000180)={0x8, "48276d1a6ce716786b62856b84a7645357078da85680c075e7e57a1bb83ac40a", 0x2, 0x5, 0x3, 0x10107, 0x1000000, 0x2}) getresgid(&(0x7f0000000000), &(0x7f00000000c0)=0x0, &(0x7f0000000100)) r4 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f00000014c0)={0x0, 0x0, 0x0}, &(0x7f0000001480)=0xc) setregid(0xee01, r5) setresgid(r5, 0x0, r3) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0) ioctl$UI_DEV_SETUP(r6, 0x5501, 0x0) r7 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r6, 0x5502) dup2(r6, r7) 21:15:01 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9d}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) [ 351.684923][T17616] input: syz1 as /devices/virtual/input/input421 [ 351.826971][T17626] input: syz1 as /devices/virtual/input/input423 21:15:02 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) syz_mount_image$hfsplus(&(0x7f0000000240)='hfsplus\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000001500)={[{@nls={'nls', 0x3d, 'cp437'}}, {@nls={'nls', 0x3d, 'macgaelic'}}]}) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:15:02 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x400c55cb) [ 352.041163][T17627] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 352.082549][T17637] input: syz1 as /devices/virtual/input/input425 [ 352.094215][T17627] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 352.134241][T17627] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 352.160312][T17643] hfsplus: unable to change nls mapping [ 352.166699][T17643] hfsplus: unable to parse mount options [ 352.184391][T17642] input: syz1 as /devices/virtual/input/input426 21:15:02 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x7) 21:15:02 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev}, 0x7b) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 352.256882][T17627] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue 21:15:02 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) r1 = syz_open_dev$cec(&(0x7f0000000100)='/dev/cec#\x00', 0x1, 0x2) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00'}) io_setup(0xffffffff, &(0x7f0000000140)) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r2 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r2) [ 352.386448][T17657] input: syz1 as /devices/virtual/input/input427 21:15:02 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) ioctl$KDGKBSENT(0xffffffffffffffff, 0x4b48, &(0x7f0000000080)={0x0, 0xa, 0x2}) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:15:02 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9d}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:15:02 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x4020940d) 21:15:02 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) r3 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm_plock\x00', 0x80, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r4, 0x0, 0x0, 0x0) ioctl$UI_SET_EVBIT(r4, 0x40045564, 0x1d) ioctl$SG_GET_KEEP_ORPHAN(r3, 0x2288, &(0x7f0000000140)) 21:15:02 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3c) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r1, 0x0, 0x0) r2 = syz_open_procfs(r1, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r2, 0x0, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, &(0x7f0000000080)={{0x2, 0x1, 0x1, 0x1, 0x7fffffff}}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r3 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r3) [ 352.738393][T17685] input: syz1 as /devices/virtual/input/input431 [ 352.788642][T17689] input: syz1 as /devices/virtual/input/input432 [ 352.823402][T17677] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 352.857458][T17677] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 352.873468][T17677] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 352.911123][T17697] input: syz1 as /devices/virtual/input/input433 [ 352.919773][T17677] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue 21:15:03 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = dup(r0) ioctl$USBDEVFS_GET_CAPABILITIES(r1, 0x8004551a, &(0x7f0000000080)) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r2, 0x5501, 0x0) r3 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x153001) fadvise64(0xffffffffffffffff, 0x0, 0x154cc02f, 0x5) ioctl$UI_DEV_DESTROY(r2, 0x5502) dup2(r2, r3) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000180)={0x5, 0x14, 0x3d41, 0x2, 0xab, 0x20000000, &(0x7f00000000c0)="8393dc20924c424a1a90f5593fe53cd2a9006b64647b124161e15e12adbc9db2eb7984f62e07c9af3f49a1412cde7508b0cccc1ae71da5e49c7c313dfccdab7bf29be25956969d342fa36b5ac94ef39c9ef588362f66751f426ab0297d2dfe61713f82b3682691bb77f2ff5badcd7df296edd3a76312216bc862015a1128ae378a7c6838c73677c837a90cb1daa58a68fb6b0f93bb3e3fa8e64916bc5c53f02c6f463e9256bcaf0d5efdc0"}) 21:15:03 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9d}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c4"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:15:03 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) sysfs$1(0x1, &(0x7f0000000300)=']\\,:\x00') fsetxattr$security_smack_entry(0xffffffffffffffff, &(0x7f00000017c0)='security.SMACK64EXEC\x00', &(0x7f0000001800)='/dev/input/event#\x00', 0x12, 0x2) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r4, 0x0, 0x0, 0x0) sendto$packet(r4, &(0x7f00000016c0)="a87148d53763665ae86d115d870acf861a2ac19306286e130b1c3dfdf4e6f1d96ddd4a7490db59dbbeebc9e69695a2b6aeee9b529c9761c4e7a351901536b2a7a4089f357b2ca636eb5973bc73902b862fd7fd500e4ed0dd4e3955e0a98fb621c74eb9a1484c5ac30f053ae9769ce52bc03010fcfa579aa501fac7bf4c4e40a44fb155f814412da82dffbe8f8fe4aad5f11badb137b2cdf497258b789a7bbbde32938369eb959d045b2c6c12e7b912cf95da3ec348f9e98907098d085ca473342808f350961580dcdb735f723b38a07973b7c3f962206257955623b0d0161bae7d0272e67db6928f813242560e817956a27e177cb54f9c26c2fd", 0xfa, 0x0, &(0x7f00000001c0)={0x11, 0x1c, 0x0, 0x1, 0x1, 0x6, @remote}, 0x14) pwritev(r4, &(0x7f0000001640)=[{&(0x7f0000000100)="4c672ccabb7e1204861c6579ae478f2533883e160d31dcea7e45a14d0db76651bd00ed29d3b9a7ab47b06a12138dd2640ab444b58473b2d9cd9007bb659b6a85f0143c143ea9279208b326d1f10080bdb68da9340e9cc5c78cb98eb3ca974f17bce1f70d390deee7c825afe3d91a59e8bf9b3df2f287f7592ada0fedbe2419ed13c5202411e84165b67059550c01508349fb13a052aecbad4f3f9536d380f26df7", 0xa1}, {&(0x7f0000000240)="8ae29fd02a9ac1709ef2f3eafd015d19a797906ed678a50f08fd68f2eeeb0d18a50e56b33b4eb26777077e3cef0616fab67cd83b0ff7d973f7ac82e711a558062415bef4b4bc70312f8985cfefa6eceb1fa077bdd696aa72c5abbbdbb504616f0a7564bb6592f363ffaf26b21fc993fbb0fcc5ce97b80a73501797911d16ce8fc51f9080f0580f0a05d4bcbe944e79ebad2ee7d65cfcac936cbed18cf009a2d61909be5df9ed772f06d40ddbc27bb06a0ab90813a16eb6ba71d0507b", 0xbc}, {&(0x7f0000000340)="b9baaa24da6c8dcdb83f9d88e12672c427dd4b5c158edf50355d381b5200c86f5539a725f1f8ad99366d0a9d727dce9b27faf5d9649fb6dc2af65822d95816811e034bf4a0b83e38e389ff70f61a088188292c9eceadbf8268d17c8866dd99e9ef53db2fdb5714d73f81796a5c9118a7213f73b0aaa20e8be7b72b4775873a7e6cc95b1312e90ff90c041397c813fbf8c16135dfc861f70362951ef3c8d1820eabdc066d10c57bf853a71db121755dbe3251c5e7b2e8bed0c9b983325c2dae906b57946ec9c1b4f1a2d88548fb2bcb38ecbaa4b2bd698b330d9f427f98d0c253c205c320c28562147d2ff1cf7d8974abee3d46d479dc0cf1fe4c6b4dbc2352a0e3f349d016447e583500131d5d32cd2f28baa8d4f89313391568a9b09b6ef9d7cfdb2200e08941b81ec664f381ed6b4d5f6975bb639b203fa1e994db8f73fd8c52b4a42ae801657d69e4840bec70a82d3d00fb592dada626000839e2491073f04124661e9156a419ac43e169468af786fcb4730041c4997a8db0dace765de29bf11d521402596dbcda264d611bf67aa77593fc239ef588e023a7c68336bb06e6f5c2bf4e8760f166dadb3a2efcc63a75fd96e91f121e1b2e33a159852929f399ae3867c09d2fc1f9e0c193f62a08b095a211b09a93de7fa9a55f49b17ac234d1325e5688d7c514bd639625116e3ebcad72637c81f65830d5da29ebcd8482ebe3b563a1003a0bcf6ff0ad731d6c86b64d51e0b91767ce4ff1a94c97a43a73015cf5474a28c450a31d3fe9256844ff4a2a2bfdc2f85ddc35d424dc97f0e48a9041676927d3b55012504576f7709e0a2368960bbdb7cb56b720ef39340072c9db61e8e825d5c6bb7b5e659e901a09bcd49bce8c807bad70a7da76e45e346a0ff94cbfa4da64f8ee5dcfe7984d4d4c45f90996e7f7b7b4b93697b2324826ba317798abc1889cdcdd2e6b692317bc9d3e3d8f0f22618dfc46e25a375663a10c95af2ac8d9c6c57727f55bafad0cb61741d015d822e81262acbaa8b00c08087e64871d5efe25c384a3d78caeb9f611c476baf633683e1fe9cfc97652818aeee3f14c678a78d18d467251837cf8db0c42e1411d347b4a53e9f8dc992974e0cf4b1a1622a5e64f82d91cc0f2c92e9592d005aced1799fa07915084b0bd8169bd3807520d2fef1d857ec0f0b30416ab157a58367e7ead3da1afc142119cb0c3b493f0ab075be0dcd3fb49afec20025792323ff8041b90bc1e69d9f590c70f4e2c880294a376f08d6105ee28c5a0dad8e022d65c59b535603d00192dffb87c74dcc049d14bbe3a11dfb81937a07c373e3497625fb599a61bb64982032e74a20661cc112f7eb47641f3e4a05f8f9d19c0aa2c031cacde3bd9078910a1830b8a7c8213faddc2332a36eb6ccf6895cefd6e23fef80cfdb15a22c3b90c83fb34753c2ccccb5cb0b8f2b6c57fdb35a3518db086b41e6649fe7498e3ab62a18525d67d0435367aef559c3be883aaf1bd5bbd6a0ad8fbb0b9345581e26158c5665112df0f5404d7df4b6e22d1cca60ee747e293d8fbf5b4c470ac7014deaf95caddefe33097653cece220ae77ad7f3033be0fce303a4a3efce714f843a24b3a5839b7a69105339ced4b66b9816e0cf7347aec77932cd32cbfa039e9ea3d3ac34ca137cbbd6bb217c3c2dd09158e13697375b0ec12e7e4b268577bf1dc35703926d9b037b1fe72c4479dbe7be171c5e169cd04bc101ea1acfe0b34f2ee638b7bd574fc4d2bb9264fdc50b9a0d1f5e7e0881b58d7c8c80d0374a92ae1eaa4a2671ac8162428557691b7bf39f7fea0e777ed1f4c31da6a095b6cd31a80b30b62356dfab52fbc1c63482f23c5390f0aa1bd5132318c9546064c53123eae9d943e52a2c963c6e96f60180eb75a19058539e5741f4724a4850ffb0a478a8d0ba1961d6069d1d076c9485d3f3d4139b7872f3212c3b8fb2612d88271672d74976f89195aa79edf194b516de4e33697d160633d0486ce497797b221b487466d4bd1f3bdb4b6e4aab09a7fe05caebebe68aa2eeec7634d4d4516a1309671007fb9d6d024052439647f0292eb0d49334fed26e45d5928314369f0f776e0d85adce5ba6755a9781b314513b24423ef9895f7dd8c501bb04ddc6f01167f0512b0f6a0ea23e79904903598129a59c2aeba099904dc42e351064bbb8bb42c2a5ddaef4081a416eb8f25adfeeb9a880fe3140d64536bf2d287bb605bbf390f276afcccc320ac24c9dbaeb4a08f23c87f7d49291a6dfcd320a03787c5e17b5dc969d91ed21109341ae95b73f06fe2bfb4fdfe4f0de7d7396fee1958849530925cb3d525e41928b558e840bd315d8dc8d70da215f7416147741712a9b815fb0aa2396418f82a26c98e1766de9e7c6f916d22a9183af2dfda059749bca5a64f4451081fd29c173ff9cbb6477de4aa528d13b71f772c380704e215f3699eca418ed2224177f139613d9611cfc3499d8de5c24692db4bf1b29bd096f0af5e184071e55dd883d332a1d9f1537b0a472219da42e31cc585b354975c49f1a21c7cc402b03ea0973f0a3d021c9489b7492e4ffccae9d9bb6105630de3f04c36cb9f98989343d50271efcf4166cfd5e61a810f165fe00bcdc1aa00344021b3767dad939771a95e33cebcd4179b37c460dc3b73321c0360d7beb989f654661b36defaca4f92ce7db15b6f1d4534251dd574e8dd5fb521ece43086d779e78a74d60337a9e0da16bb40a935930310d8ddfb18182e09c2fc53699e32109ae9d53b0a64ad7779d9f7b0b5b9d00f4044d667c086ed038e829342d65acc4a52bc84b26d90bd2dc4f5402bb7e7b65261ab81f50cb5f037257109b913d7547666c4655b475afbbe416c08b4ddac3eaf6752b440a14addf99c20a31b412d0121683c3ea0c020e853af4b4262d59c56d859bb96ad71a5ae68d14ce48d8ebd2367972b4dd7f3a841a52fd424c5be76c85b0c85ff2292497de4bb872cd9cde0fd3feaf1b3ab45e83000152810d7acb8e5919939d0574b89170655462bb3f837aaffb868a28280ec91689d90f6f3a15863cf75867a1319227883d932a7dce205c661efccef857895aef705cab1edb005dcaaa055963e14652700295e243fd6ada509b4a3485fa2dc9475f8739b1a257ba7672a8345492c79476d2b77d747be9d900a7e2f5d2fec56b67f604257b927ef8281a33afd41e4cb1d8505d1985523f948fdc679bd2bad22b0fada5fd622b23dfe1e047d2a44fac3c98d2c631620efcf8c19b4fe9c71e6479a224ba43f76b8596dfaed1f83bc846b737666676bba8f0ea35aba6fae004c3be73d3bf48d5b7ec71f61fda8fb10209035266876660011b028642ca276ae81ab89efc91860afac0081d6313e6cbef267010a42f844d65c600c7ceee32b7373c84d1ab793e7c3f20375ac1b4df259ccaf3b8d338669b254a7bc70b266d3b0dfb9ba10171d08aa4dd1d408c8bfa1d69ffaa5c457e5d67faf5a0511ebc2080dbcc2f8bf72d3bc580e9382bca4eb68a93bde4fc692fcd373d9de059dbb909f7b2727449600faf488a22dbad63fa34d33a3d4331635812f3ce9adc7fc692dafd3451c75fe601b8dd8ff598c4c0e9e57b844c551b9bcd6b23fc0e44e9907dab934a8a83a43662314ccdac0decd5e8b665cf7d34b29a4dfe715d085a3bfb671d2f14c4198376ca69223a1456005063c64bbb53c730caf44aea033d33d85256304426b1c4f7793702a44ad50608fb6e1e317f95fa425106c34a1ddae21ea1370de2ddfdbbab156855b1a72b238663885919c1822311f669b207580166a0cd86925e5020e546b62584c27281d02c8f6b28965f95d9d769843f7d58a4b11bef97c6ae6bed0fabaec68bc823895ec9f4bbc195496d3c84e069e86b58fb8923b25466ee995cc47ed5689ef74cc3cae7a2335a4b89da0aa1ec9a8d6d78d698faaa22f29c5c851cc39e1e66fdf41c6586751ff6cc3386d1c9e5c845a6486a56241ef56fef995d83b4a2c58f1d8bb674b781c4c23e5aef01666ba3d6ad2696bca5dfcbbba52b2ae53ab6bfc990e05520746fab4b3b6bc6ac79d0904fcb61cea43277ec36811de65374d6c856760de32f142024fa7fe0535a97bdbaa9119143a6a148e5252c95f9381f0ca4fe2edfa4ba90e0a962c639952522018c23fea28160df3d6e785ddd7ff606c13f4f79f3da07768b5d37945753734bce1c9585ed850812f6b6c600a10824d668ff8f3a4d60b2242fd663a5d4ec0db3db2313e19e24511da82762f8d1de3ee7fe2ed6178b80565ae8817a03b98d15a7a74c03b441b88ad61e0f6e5847258b1c13cd25224a8617158694405c9c06e15241eb7651e3947d743295a0d2886312c8e7119dc69f70962072d58003ad8e59fcd4600cccab7c0050708bcc84b0cf3871660afc50d0024410a0149ef5e27e6c5882d9a3883bbcc4f7073a987f8d2316927b897ddfb0fa93651c6d57cacd62f1ff4241fc527452ccbf91cbb8450a64078109fef776bd9f307c8a0f4af4a9daabc25d0b165b3729e0b6080dc8879a5328abec7abe5e130881b13303aa33a1a4b0c0fb1c1952b737b259ccbba16e562c5aec82d0b0d05ae38e038114e845a69b5a85dd3c399d152f7f635b2db941a38087131c30e4bb0cc1bab4a5f131247b04e02551b0363e28e23123e17adfda249ec3cbcd2c1e863611e51a3136a5cdfe10fce490533a8dc70ba206bd4d32bc499ba28028cdb3a9db325e622ff43afa3fb4e80332cf7cf6c218a44884d9c4195061fd3f65635749807653a293cad7465ecb61150bf3786537690cee4392a0fb7aff41fa66f9c797a491334a170df6dc066efd0c5ac13fb64a071ea26a8c4cf128511794c4c15f7808f91a5e84640a13340bca7334d09c2e0d6a45004845a4762f8f156282169bf6a0679e40514349344e46ccf94c3c46101cc73af9ad6984b81a0519978951822745d65bd28ec73b81c1a0c408a73be25213f194d6f8b6418e4eeeba572acb6b1941dfb0600ccdf3f2d6d8b2989f303f874c6d90e8131e5f1ea4610bb164912a3a182068bc71191f372da7ea91e852b1fc0b4e34ebc1074746c612f765d41f9d87ee892fc1dd10f30798474f8db34cbf51de2c50068992ed1cc87eace62208e7088718738cda0eed7d966619a48b692799021b4c61b1f2231e6be9d774d22115c2fb5e8e838283ff3cf25c5183e5ed4bbb3c120565efb7d08f3f2927e41de897df26d0378177ea8fea8f824dfc04c18e0ae409498ada40e8cad26c8d307e31316c20518ae514e73b86f48be7a84c35aec7a3755ea58ae9b2c66764d94882ba0c070aa03c57670534422b1bf45bd975a4067a1285fdae470c45f5c931cdf79ea2afe1447e1ed633aaeb58faa11752412692332285c86dd5458e460f749f134d9e429fce2ec3ebcd41f0c35531f6cd7df3d161ca7a25782287656388947d6299331cef9951b5f0b95cede21098c4a21dbca2b75dec7aff966296982f6a6bce9807bc1388e0f607cab76811a8a3fe9658470feab84c5507b9d9021c6a31d6d099ff5dbae7257da857c0113f68ce67d81cbedcce9d553bd0b54038d8a4ec8a51a99726fd9a74356a2aa21044272c5ab39aef59e7cb28bc6b4c03e05c8cb1a36f5c1b1e7137bbdd55a197478643718923f69668d53d3fce87c5e2b68636865e9213cd4358e6cf65a381b5b93554612419c260460e295296e3a4066c9342a0c92d38edacff94610a51b85a3051b03c669e93bcb01a3654b6648ab9da7a7e5d332dfe37d6f9d172d70ba70983c512f8c0cb596", 0x1000}, {&(0x7f0000001340)="ac7dc3d70755c05dcfcbb485fa539b7cdacf8fca3a4490627813ba954fb570e74704a7c32379bcc9c77c3900d26fe7277cdf948e389396f4ab809abfe2f4429a471041456e96bc91d5a189fc0825f204374cd7e16e0f6b9f70c1a3982960a9befc2f684efae862426dea28765949d65ee6f324cd3cce88028329fd700fb65535d910dd857376a9ee10d4e639a9366726b5802bb58b99a4666214d1c8", 0x9c}, {&(0x7f0000001400)="9bda97ddf78c003215dc853ba39b991b753c0b2527702e512e7ca7c3bedcf09656e5caf2d8400e4d25d488f1ca191971645bada81639e85eee13ea58abb33c1b6391f4b5b4a733c9cdef0ba97d00fed01952b79ad9011ae665216a968dcb5eb4c58870db0be7d60f89e6b8b7ac750685b46222ed161b2a077fa38c620fc661f4c3dbb4b4ff8f99a0237e588ca4c04ecab8c93467e271d90867da3da04b6af6a2108302bce8e71df48e3e9db573a30bf1258686cc15657acb10b14278683a1e4199a78eceff58c448f4e747ea37caf7593fda", 0xfffffffffffffdfe}, {&(0x7f00000001c0)}, {&(0x7f0000001500)="6cceb70b034185beb4", 0x9}, {&(0x7f0000001540)="8bf6a6507ea840137eecd0efe3443a8d88fbf491342dfa396aa9a8e1ecec05fbc845ac604784d01d70bd4a0145f3b41c59f89ff6bffc590606916882f1c8fa17792bfdb89ff721c15d304cc93e9a3b6c9cfa4450bfeb7fc29fc0b89524ef226169543fb02a0949e01a5d9a509621664ece291f9701e5824b13e48d52a4153b33f8046a7e4eca0a8bd36201ec20bbe3a8f7677a2c559c2855deb1d6e81bded05d2e7de55e328b365ff1ea965b3ad480cf39a394b5a4eae842c870c1f12f042f7d137f1980ee3a0d1c84c8da94ba3df3bd2c81246f231a4a524b4e54a89da24a5dd46b25d89adb66c872bbd59b", 0xec}], 0x8, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r5 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r5) 21:15:03 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x405c5503) [ 353.248981][T17707] input: syz1 as /devices/virtual/input/input436 [ 353.281879][T17715] input: syz1 as /devices/virtual/input/input438 21:15:03 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x9) 21:15:03 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 353.397337][T17712] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 353.414177][T17712] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 353.446830][T17725] input: syz1 as /devices/virtual/input/input439 [ 353.498325][T17712] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 353.545960][T17712] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue 21:15:03 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9d}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c4"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:15:03 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x406855c9) [ 353.650183][T17719] input: syz1 as /devices/virtual/input/input440 [ 353.781704][T17740] input: syz1 as /devices/virtual/input/input441 21:15:03 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x802, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:15:04 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r2, 0x0, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r4, 0x0, 0x0, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r6 = dup(r5) r7 = socket$netlink(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000000)={0x0, 0xe2, &(0x7f00000000c0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="050000000000000000000300000058000100100001007564703a73797a300000000044000400200001000a00000000000000ff00000200000000000000000000000100800000200002000a00000000000000ff0100000000006f0000000000000001000000007d0dd809309d634243c850ef1db376a7a9dabcc2b820e313a0fdc24c30c19184d6f7abad8294a66d13cb1ffd4d3f7abbd6e38fab98e24bd39a8328918793c9f0b07bacf196ff4671e24b5b76368f5d4889909988df94be031fbe0076faac6371217b9bbb7ad8ba3ea3c8aac6c133f96f98f1c55052817a88d25fd114d93a15afce13236b396cbd6369cfa9b6de7c000b228fe93c6b42dce2e604ddcf1afc3634395781fa15c354d384fcd4c083be205973d16978e7c603f64ba9434d0a2e51452d4eec85bad9f60b6609a877698e17b4328873b53a99b7289e18d283d0c0324ea04726da0e221ddd8137eb2b10ffc9b5f7cfdef9517a1fccdd5d7eb145a8c7affba8999c3f04c7ac62aa4ec1ccef88fa3c3ae5284322b2453d0108936edd8579ce71f8fc9c36b1cc28396c81bf0cdf3faa442e87f4990065e5281fab156547a164dea7e7bd90cd6106421acfaf55f00308b0e8c229313fae0b33f1f0814a9f9b4ef3eabed4f79e226571e8293eb4ce1c9d5e86ed5402454e4b0a9abee59a474444ad83922708e82e329b15cc1eb4a3aeb11725c51f036d1d1c602c637def41b7209b677425de98789614567f0400b08568ae6cd4f174ed2b8ee261effe4158e3d941c4442c33"], 0x6c}}, 0x0) sendmsg$TIPC_NL_BEARER_GET(r6, &(0x7f0000001340)={&(0x7f0000001200)={0x10, 0x0, 0x0, 0xd0400001}, 0xc, &(0x7f0000001300)={&(0x7f0000001240)={0x7c, r8, 0x8, 0x70bd2a, 0x25dfdbfc, {}, [@TIPC_NLA_NET={0x40, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x46d}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x4}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x6}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xf2}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xff}]}, @TIPC_NLA_MEDIA={0xc, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_NODE={0x1c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x8}, 0x4004c092) sendmsg$TIPC_NL_LINK_GET(r4, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x88}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x38, r8, 0x100, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x24, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x2}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xa2bc}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xe2eb}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x8081}, 0xa2960bf4764a0edc) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r9, 0x0, 0x0, 0x0) getsockopt$netrom_NETROM_N2(r9, 0x103, 0x3, &(0x7f0000000140)=0x9, &(0x7f00000001c0)=0x4) connect$inet6(r3, &(0x7f0000d83fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, 0x0, &(0x7f0000000180)) r10 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r10, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f0000000180)=0x8) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffffff, 0xc0106426, &(0x7f0000000100)={0x2, &(0x7f00000000c0)=[{0x0}, {}]}) ioctl$DRM_IOCTL_RM_CTX(0xffffffffffffffff, 0xc0086421, &(0x7f0000000240)={r12, 0x3}) ioctl$DRM_IOCTL_GET_SAREA_CTX(r2, 0xc010641d, &(0x7f0000000400)={r12, &(0x7f0000000340)=""/190}) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r3, 0x84, 0x14, &(0x7f0000000200)=@assoc_value={r11}, 0x8) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000080)={r11, 0x101}, 0x8) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 353.933004][T17748] input: syz1 as /devices/virtual/input/input442 [ 353.984631][T17756] Started in network mode [ 353.991447][T17744] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 354.007942][T17756] Own node identity ff000002000000000000000000000001, cluster identity 4711 [ 354.014551][T17744] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 354.026891][T17756] Enabling of bearer rejected, failed to enable media [ 354.028183][T17744] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 354.057603][T17744] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue 21:15:04 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x800442d2) 21:15:04 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9d}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c4"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) [ 354.092028][T17758] input: syz1 as /devices/virtual/input/input445 [ 354.150869][T17750] Enabling of bearer rejected, failed to enable media 21:15:04 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$caif_seqpacket(0x25, 0x5, 0x1) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 354.228279][T17767] input: syz1 as /devices/virtual/input/input447 21:15:04 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 21:15:04 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0xa) 21:15:04 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x14, &(0x7f0000000300)={@dev, 0x0}, &(0x7f0000000340)=0x14) sendmsg$sock(r2, &(0x7f0000001900)={&(0x7f0000000380)=@ll={0x11, 0x8, r3, 0x1, 0x9f, 0x6, @random="ae429c48d7f7"}, 0x80, &(0x7f0000001800)=[{&(0x7f0000000400)="d56bfacd02ca67ae4a8fb30a273aab427546a427e4a727b0490af4f957382d54a876ecf9d4f5bb17c024d11c8d84b04b1f8d1a18e3eaa4abbf3dc6720fe4e02ccefa62cf9255c09eb7275fd4fddbebd4a1723816d21d3c1cf432a3eda44dd5fb32699c48290a60af592b6181e28ad237b86c378199b8f5d2368bbb2f5cebce7ae62b5948fb36626cb75f3e6e18af9acddb3948d32a5ef6f625b9c6ea8873853400fc6b22", 0xa4}, {&(0x7f00000004c0)="0ab65b8c1af0f0ef76f1c973b4baa134ee5b976588248075259ff5b083c30bcf974f87f4d9153955f55c244b32f95a66d5d6eb39fbe622f762b9f5fdc2ba8101dff55bfa23128223affa549f3345e4dd3d85d424383382812b978cc73ace9c6c3c96b65e5a23849268d9a64ebe6429a4bf190c62dac6847cb2e8128d1cb5ab99823180f15b48c27bcf5d662107b7dbc2ca1b96f049025b479451c3411b3e534bd7d2297e45567cd07edcd0fc20b50b142bf5fbf1ad06bce54806f462ff5b42a88be7625b980e58bd2a447a0a21c8449928544e842cf66364c64186e5633eb82d39613743ebc09be42bc7fc310b140ec45b7bff46fba22a44846af23ab47eaec307eb854273d9811e86336b2694eac118b33c35be5b3f6acb0bb3f4ca43b2b2ded1bf55424bc0d62fd67b940ab23483189b1bb5a66bd35bd8517e56cb76ef5182b911c18f98579fa3f21ce005135efab22b70aa319cb3571d450b9cfc5999c9ade0e07895544094ee43b6feb3a86bf01b0ceb25e6955b8624dc5d6547d01823fd31973be19513012a98d6a9376909fbded958ce9867c1352a3acbb27284c605206029ade8fb87689f974b817fef5ddb9c22cfee8eb3e1e320a5e9d69effea1db95fbaa90618e8b2ff5a8faa1c47a682f2f196db5bb2d03cac66a03174df17845b594d256a12b0a7ae83535c9fc84de364ed7727a952d0a1c7b3252accc461d5ac7c83dad443d78dffe6f6a3090cd2bbcbb73a8e72e7c0ae7c51efcfb4509f4a7072de9db7a1e612a28377ea7663fba884145d7a859e368e511601d4dc06e996f0cffb5923be1b6d28b48ac62af6d5e647a873d7ac170cddd3a3ee8703ffaad5056887fdc4228ca3ce0f0f7f50b6fbcdb809784501b9d4b6b98d39678277b33a876a93dffffbceb17c8001a898402a7ff9d31cd137c8b70a63e48dd46bf2ea0bdbd33553f1abeae4e4248e6ae5b869a443a5344de51b7e0994362413bb4e8cc91733d92d48b137734cf94c389402298edcd36c1d84cc9d6464e76c1dc7d1f3400424728736a4744c0b0acdc1392bbbda4f77ef3d6f6d6df83b00469478dd1c99bb3716f56d00cea01fa383224a82d07501a2777488da00bcd505da59a2644e7a46b2199627803f7ed9c1ccfaf17d953873c5c063caae044ad8e40a5d4eb51c28e1e64ba06646391aba181333e0f114adf26bcf4154c5e95ff293a6c57aa8a499ee332db64a85992a63060f151cedc0c289429e4659048d57af8104d9c20368d99f775fba91c28f048c35224419b6faccd6a220394ad257a702fad7cd1f8891ad390a95ab698e675bfc7fc593e8caed9c374b7e66efa402072af0c18bc47f821685231dc9a226af6c4d4a35d8bb273ea7d50259c0c3a3385b50a95f9309ad2626bf740f4db297cec8fc3b91a486d0cdd1195df30beff7d99f86d6bd4046ff31db3a7824d738f7d50c8f8781c684d6b8b9bc8a25a4a94ee3ef4609792221349f89d5bc4b7d8d708dff1665b0f6a148e7416cdd8d7548f8bdece57af340da0802f091c0ea2b757b55b2ce2c41aa259b988115580ef5f236e700cedf43dff741c7c1297546a3842b53e846e836afd14c63705129c2a09d0b34167b52d6c365bb38313468e056e73f1730db266c7a3dbdabedeefdf1e458c751e11a8d0aff4a034deb9bd1fc44f86540805b8dc001c4f46fd956ade242c3756b3bffeb07c89292a0f205be4943897b47d116396f1241c04d3a20fd691e8276dd69fa86b2b74f6f62c51269e258bc9255b4dc5251f8d3342d1ffadc4546156aa131ad8a0ffd9670dca8a44eb0e4b6d9dcbec41541a3f9afa475816ec60af3b7006943b39a3d14109fd0ec96b86e55e0c22fe893410e244ac37b5d41d9cf4a2bd4f1e7838277c89488eb66df64c41abd44c8f7b33c2c6c95e2526781fd5a98e27391b214c1b987423554b82c4e7bf5c1d707a451018d61c7b7c864a1e9ce7e84e729ee2142d91420c7aa226abfe921dc8a0ed7484dc741fbf3abf6f5cbaa04eb89f014e684ba2f5ae68dd3399d572b92e20bfa2dc1eaf15fb03f566b135009e1c5321302523ba9698d5d0c84632dc75c9fce410f0023b653552935a304a24717d3f6531b133115aa99edb17fb7fbe1127a699e1dcacc6e4a3b396832a22d2b133958afb320718065e1662a9087aed47dc69eb1721ef7c8830d13f422b5a089b9e107ae85a006227bc629989e376931a3244eb4788c556452b875d245567b128d3c12d948264bbc4b7083f06c8f8b6718f3d12c782708479665a24959ea54bbf35ccb9fb4f3822c9e711cca8c5936516eef031834db458f40fbf1dfded0f7cad9b01e101e7423c201518c84af1e763e0b84fe8e9e18e321fb613487afe007e2dec97088cb8827d043eb856be1214025599e571c5590a956c8dbfce6e22e908e1292b0ea3d0db82cb921dab49c0e987c5dca0b1b4ab124880dd9de87cf240039fc721b2117d366deee848a9115f9ece15f47ae1dbf9550eec09787eaa36410c232f495f7a91c15cfbc35d70a64769a936b9495e56fb4e465ef3f37130dd24a2440b8c589b83bb08a687612d23d653f1bd18af8411d97e2c670b6e62602bdbadf0e0c1ed46630dbc5c718cadeb59e120e674219652b40fa7fe96b6b5f35b2a5f60949a15c3c76bd79243f0af1f93da02e98b220e0e158ed32d013f28a91974ded52d733b7b271ef562f10e887974c26d88c0999b1522c986d867caece5e7f68a112fc6b811015e077aae7c813ec73fac427a6c023c4f7f5bdb2955307693cba2399ea506cde0e18eb8b1c9428345e2452651a3702ecca6f7fe382857b9e6a8c1d6486b92d5d23c64450b7fb4946b845ddc40a4a636fdf1461d29a7b805cbffdd76a4f5b95a17ac4aad54d6bc188fb8fa2a53deec2b8940e7480fb8b421eb5807c589ea79738ab5e4df34c4cbc763a99a7c40ffad48adcf203e091abb6d7e0ad56efc8dd13544fac8c605d6766defd9ecc5a78ab3c9f329f25000080fd81e2c92647bff1cc859cc15f605096fbe7e48722bca7fb147a343e408637342da69ac7590fa061a581e77b68f8faac91c2fac9f011a18bab4308d6410ea5e32edd135eb4159fe2e2d79de9e4de096d1a5de9e78095e429e4a8185d77dd4c3021fe402fee21f24674174624942ecf60e0619f8d28139c038547249e58e77dfb72f92b28fd02832b55760f8c70d17006349915a897a1621457454145c1a6843fab2a4e9b24a6349315ec96b0584d57065da19de55775c26bb1254bd08d86d1334ef01889a23556282bd071c0c7955aaf2851b631de4664baf2495c336b26d2d41be077749619e03112a8f0bbe1886a23c0b0c3c10c9d9ee59da9a53e6d24e8470bcbeec0d1c1f0705458b4015b5ad80be5741c7535bbdda561816a02b09e9864a3cd3208c7db8131b34f2bbea6b699097192e6b698e408e17f3d63aeeb1edf20ae4e7cdad7fc3075f2dc1ecd9e5ad98499ccf021c6f62e040e23d11cd3504969a3cd03dff0ca3740655a669182b6e73d2a5f9e6fc8a041d327cd0478f5a7215af278ae8de0ff4653b5f7367acd69cf0493bf2004b4079c357d820f7d12ed7f3f65b402b7bb940de3256d25b8efa86e982b1f2413c2ca6658570de25363eea05f70995bc17e41c62e49bf3d375ca91afa68ac146befbc6c5814f53ff1a4491ad64e93ded39565ff9117150fa18423211c1ad4265438a16443a0f1bc518d7b03ea8080ae9a2c5bf93387176e5013bb90a9d0065a91650eafb329e966298156e61b299af598ced36374dd0ce0b7f6fdea54dade67d9ccd6d556bb90422f9e38624fe152403ca560c11c35ceeaf00e488645ffaced493550a86c15247b44ce9edbd7057b96176986e7fb8aaae4317d23e644508754259c97c54bbb9998a718b9ea15e4c426f87f6801e7540e486d71ef53b21cec419e9e818bf297bece7889724dfee2a61ed41953ea7e0c1a6bf45b1c5a9a9d4e9b824ca0bdf18c3ecb9d963cd990976c4e1234b410db709e317682324e81c00f2783d41a454b756d5e961fd9a58cf494d4126e73e8c2cf2482afc215504f70633c7674f77957d6585bd1480862cc46696f4afa6d34793037a1149ee582618b1d650510eec7aa58d3e8fbd6e5efde99e990fdc6bc36da839aa92dbfdc060f6ddfccd4df338d55be3a404bdec8d106355152fef3ac07e7feab4b23b7095b22ffa4134dda43465ec5da0c5714f7909111ed6cbe0a25c0fdc4ca26d79fa7aac04c21f1cbd2462b497df4ad94d01587891282901b001ec9799be6573f5eb1c35ca8cb7abfdc87498024b8bd338b500f020199c7199acef77dceb68b6cd363f6e6cad3c8e4ca4858f8a2de373f44a586fd67a02e8c4d83e0224cf2cf4d537e7a03f036db17b3768738a87417261ea38c41f96e9d08821a6efa42ace82b00efde384b1498881a0aa86544dfa1959c4254b504731af80a82db9fc5fc114a7ab6a18deb6a7c311561c68c87138b05023f44f2fae7dfe347d61c116a960b44a5f0e0588aae547fba33144bcfc28b4e76dab354a24bb36139dfc4a56bcedcc46f00e4ecda5ba68b9f57f0a7d8bbfdd89ebbf4dca2ad3e3fa9d476ce76332b2013a5a060976b7fd2cdb9d9eae62bf4a82e86c2d35b42babf9e35bb09555daba391bb6a6267795c5df1d6748409dd15f677c000a4aee808201f9ea37f4f0ea8cb7c12960eafefe2fd69433b0da24afa5a0bae3afc6260eb316ab244e2a3860fb4622bead785bbc6ca2313ce9cbbe599e7073d935fc8172e5b80b55ddc46f0e288157256a92e3a0c3b890e0d06b91125729e4dedc0df6ae8b2dc0489b580b0d3fdb1f7dcf204a0f56698c87467dd9199a787534738fa3a7db1e5263c362ab98a0d3751c00402226ab3fe8c22927fc82d2a1e4a7dd4ec5fc1c2f3a2f5e47052724e63c72a24b8dec12759b3369bfec69f24cdd1cd2a5549a6a0f8d4d121df7ad09cbd201c80fa08b34f2e717fcfa15e2e010503833a492869458e04935c848f59b38534952fb3281699f32c8b794496a98a6b63c1a0b4ba774f0af9bd73305500cd00d3e20048c136e36365fd685a5b66bdc20da3a7fc1cadec222a4000d7c8229901b56f861e532cbe7896fbc1d6511ae0caeab4fc5a15d7c7e8ed8c69821324f799cb993b2a43d60be2c936829403246dd925745742f553a70a818bdcbc457df9d59534b894a74eb3fb34fd2b93b7ef18a238f44492322c43ea79eac05aaddeed250157386fd55231286d5ee4ab42e0a8b1c492b9729f2aedce6d87653f68f42d19fc83c9e885e7dbcd9c0739c312e70e90b87c2e97d2d6ccaa3552fc980f1119db6f5eb995d27abb01bf6058346a7fd2db02131767d9ebfa254b82e965aca3d3f2e55b0ee99ea82378a350631f10ded08e3889377b668a4f78b7d1f648205a188a504f9bfb5a4517a6fba1962f2d2d9f89f4b085ad8701dfb7da33739c857b7962636d3b137bee7ba6fc14262bcb705020c488cbc8d813caf334a0511f82f4ac9b354d1c75b672c89d5d719647980a9cb8997048243263f5a9864985913dcfa0807034244625f2bcea458e2e27b79f88a70f9196197fd9b9653f17a0b2a36c52438c0f790059fd5056b915a6a5f495e62ab9611f4f9d30d2e6864aa4d58dcbf61a076dc0f47fdbb3fbdb73407665da927b07bd6233d137c4e0565188e9971099066daa80cf8d396e941e9c2f8d32b7986c22a859f3138460e13ef58b11be77b7249c061539d28cea8648de02b293d7c11e6fba476dab609bc56e88c0b5925f4197b85c4115", 0x1000}, {&(0x7f00000014c0)="02af53cfbde74428e9577aa4e5a1fb3eeb771c8010ffcaebc0a574aa8d60d6305037aad5d2ca86817de69eb7647cc17d7f3a5899b6857ff684b5f43cf3df7106f77faee4e7c80c600f5dd501d7ed057dc25ad1a2eb47650a709b99b90a5a16c75ba7efa3e0f7fb92ad23183140f41115e72b4665f64951a13d1796afe9453d524f6101edf2cd83373df888698fd720e63de32398bacaec2eb1c4f48b6225a9139c1c08dfa8f9fba51b8f5fb0b64726e53487b83085f35eaf28afbf510a828433f8dd82e53fd9afb2d1fab23db3fbd023e77fdef7dd6c1fdd9ac45b172e4644acce3f23", 0xe3}, {&(0x7f00000015c0)="67297bb75579b463bf5b570ead1d6aa6c0f0bea139a3cc55862d38cda74cd39ca1f0f913e7f313ec08381954abebdfce011f9748101077605dfdfd4bd051ea90d2a5edd3bcdc83795bfc7bd3201081759e7867d8f587560ca03a21d09d78aa94550d2e0eec6fa37d2eeabec876f60542e197b05ef8d15c1c04ac7863f000d019e7eeff212047400b3acda18f1a8b285c715ef61b5f2cad2f70b811fc52723167997166c6e25f88fd103186efb22170e6791f6c8a14fe1f01a0bd44af796a30c467a4c7220c18bec61b539ae5a2991d789a7b1550b3a5d5a804112bc3b5dfe7247c06bfba45d8d1e43be9730f7e3588ac2cf2", 0xf2}, {&(0x7f00000016c0)="b296b04c26ddfd2684eb72524996fbe3aab45f182a3218e4f82d99e88130e9774af88f17bb36cb4e248344393cf77b046c7404196784895591e3e335a75ea494b6814d5a9d57b584381e97676d4240a10423fbc03e3bf3d7e2106248f641f4e8f6ae1063e24559d5d2a35936bce8211f6232b6a8", 0x74}, {&(0x7f0000001740)="91530a09d6edc58b5002ac31613099129833dd4a6acaee2b03de73585bef2495e401009a05a79474cbaea8173c8a044b64ec56aedeee4594d3c3a96fadeff26a9508f7b05d1e265a02d63ef90307b034d499e97d47897c428cebeb257e6218155165b296cfd83f61db1673d48d76fa89888391180b479f2e81f39ae7beeb3c7128ac2838c6ba1d556a2f1e0e368b4a74fd70020ce369eac849038ab69789090195e04fd7a0040e8a8746", 0xaa}], 0x6, &(0x7f0000001880)=[@mark={{0x14, 0x1, 0x24, 0x800}}, @txtime={{0x18, 0x1, 0x3d, 0x100000}}, @mark={{0x14, 0x1, 0x24, 0xbb8}}], 0x48}, 0x1) dup2(r0, r1) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/expire_nodest_conn\x00', 0x2, 0x0) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r4, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000280)={&(0x7f0000000140)={0x12c, r5, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@TIPC_NLA_NET={0x20, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xac0000000000}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x6}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x29}]}, @TIPC_NLA_MEDIA={0xac, 0x5, [@TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x619}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x54, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xb2f8b37c}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffff7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}]}]}, @TIPC_NLA_MON={0x4c, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x81}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x3}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x103}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x3}]}]}, 0x12c}, 0x1, 0x0, 0x0, 0xd5599521aa0fa370}, 0x4000000) [ 354.346567][T17775] input: syz1 as /devices/virtual/input/input448 [ 354.442510][T17770] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 354.494291][T17770] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 354.526885][T17777] input: syz1 as /devices/virtual/input/input450 21:15:04 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x800454d2) [ 354.580714][T17770] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock 21:15:04 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$sndpcmp(&(0x7f0000000100)='/dev/snd/pcmC#D#p\x00', 0xa78, 0xa0000) bind$vsock_dgram(r1, &(0x7f0000000140)={0x28, 0x0, 0xffffffff, @reserved}, 0x10) r2 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r2) [ 354.645811][T17795] input: syz1 as /devices/virtual/input/input452 [ 354.673145][T17770] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue 21:15:04 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9d}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) [ 354.800449][T17806] input: syz1 as /devices/virtual/input/input454 [ 354.856586][T17801] input: syz1 as /devices/virtual/input/input455 21:15:05 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{0x0, 0x0, 0x3, 0x800}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt$ARPT_SO_GET_INFO(r3, 0x0, 0x60, &(0x7f0000000140)={'filter\x00'}, &(0x7f00000001c0)=0x44) modify_ldt$write(0x1, &(0x7f0000000100)={0x7fffffff, 0x1000, 0x1000, 0x1, 0x2, 0x0, 0x1, 0x0, 0x1, 0x1}, 0x10) dup2(r0, r1) 21:15:05 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x8004552d) [ 355.088409][T17812] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 355.114688][T17820] input: syz1 as /devices/virtual/input/input457 [ 355.124252][T17812] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 355.148427][T17812] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 355.206363][T17812] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue [ 355.231963][T17826] input: syz1 as /devices/virtual/input/input458 21:15:05 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0xe) 21:15:05 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, &(0x7f0000000100)='syz1\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r3, 0x0, 0x0, 0x0) ioctl$VIDIOC_OVERLAY(r3, 0x4004560e, &(0x7f0000000140)=0xffff8000) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) 21:15:05 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9d}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:15:05 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 21:15:05 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x80086301) [ 355.499557][T17840] input: syz1 as /devices/virtual/input/input461 [ 355.616675][T17850] input: syz1 as /devices/virtual/input/input462 [ 355.662836][T17844] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 355.688718][T17844] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 355.712378][T17844] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 355.736620][T17844] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue 21:15:05 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9d}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:15:05 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r2, 0x0, 0x0, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x12c4a0686b75d4a1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r4, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_NEW_CTX(r4, 0x40086425, &(0x7f0000000100)={0x0, 0x2}) dup2(r0, r1) [ 355.776889][T17856] input: syz1 as /devices/virtual/input/input464 21:15:06 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0xc0045878) [ 355.934821][T17861] input: syz1 as /devices/virtual/input/input465 [ 356.077739][T17868] input: syz1 as /devices/virtual/input/input466 [ 356.089294][T17864] input: syz1 as /devices/virtual/input/input467 [ 356.187093][T17865] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 356.224088][T17865] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock 21:15:06 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x11) [ 356.248827][T17865] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 356.306913][T17875] input: syz1 as /devices/virtual/input/input468 21:15:06 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, 0x0, 0x0) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 356.347958][T17865] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue 21:15:06 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9d}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:15:06 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0xc0045878) 21:15:06 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r3, 0x0, 0x0, 0x0) write$P9_RXATTRWALK(r3, &(0x7f0000000180)={0xf, 0x1f, 0x1, 0x8000}, 0xf) openat$urandom(0xffffffffffffff9c, &(0x7f0000000140)='/dev/urandom\x00', 0xd80, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) fcntl$dupfd(r5, 0x406, r2) r6 = socket$rds(0x15, 0x5, 0x0) ioctl$FS_IOC_SETFSLABEL(r6, 0x41009432, &(0x7f0000000240)="b5ba21768c2b8e33e691b0c83c4f69b3d7fb20e53273dd86539761811b653963ce6c0d8c53b3048497e28b3da4b7464dd225a86a163fb5bfbf43af254ef35be724810bbc8d3fd2ee886722b0d0d465223c4342358e9e262a7b6960ffb7eef5c0372b6e0499e325176ed3dd8aa75d2d408ec7d436cf873a99dced0dbbd87e9817979357a2a0a2b1dc01958515394f4369fc8c9dab33d8ea327a3dbc88f86b70aa0c7efffffffffffffffc82a5b2c24f1bc7e78c0080c80d237a13758b2623b2dd04d17d26d8be8f31db60c8a9ebf6fb01ce680800b329577e62f7b28edfc08a1c040043dd4b0000c233576d923ab7b9a1a8c39d1104a480e39246aaf45545c200") openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x10500, 0x0) dup2(r1, 0xffffffffffffffff) [ 356.570974][T17888] input: syz1 as /devices/virtual/input/input469 [ 356.658005][T17895] input: syz1 as /devices/virtual/input/input470 [ 356.751903][T17898] input: syz1 as /devices/virtual/input/input471 [ 356.783844][T17893] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 356.862195][T17893] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 356.891639][T17893] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock 21:15:07 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x101000, 0x0) ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f0000000140)=0x4) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r2 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) fchdir(r0) dup2(r0, r2) [ 356.909634][T17893] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue 21:15:07 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0xc00c55ca) 21:15:07 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9d}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) [ 357.062676][T17907] input: syz1 as /devices/virtual/input/input473 [ 357.089329][T17910] input: syz1 as /devices/virtual/input/input474 21:15:07 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x12) [ 357.199061][T17917] input: syz1 as /devices/virtual/input/input475 21:15:07 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, 0x0, 0x0) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 357.289549][T17914] input: syz1 as /devices/virtual/input/input476 21:15:07 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000240)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00 \x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) chmod(&(0x7f0000000100)='./file0\x00', 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) bind$inet(r3, &(0x7f0000000480)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x24e23, @local}, 0x10) r4 = socket$inet(0x2, 0x4, 0x20) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) socket$nl_crypto(0x10, 0x3, 0x15) bind$inet(r4, &(0x7f0000000480)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r4, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x24e23, @local}, 0x10) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r4, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) write$binfmt_elf64(r4, &(0x7f00000000c0)=ANY=[@ANYRES64], 0xc63b9e35) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$sock_int(r5, 0x1, 0x1e, &(0x7f0000000300), 0x4) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) write$binfmt_elf64(r3, &(0x7f00000000c0)=ANY=[@ANYRES64], 0xc63b9e35) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000140)={0x0}, &(0x7f0000000180)=0xc) r7 = syz_open_procfs(r6, &(0x7f00000002c0)='net/r\xe1w\x00') pread64(r7, 0x0, 0x0, 0x0) ioctl$ASHMEM_GET_PIN_STATUS(r7, 0x7709, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) [ 357.422715][T17919] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 357.456457][T17919] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock 21:15:07 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0xc00c642e) [ 357.486943][T17919] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 357.501458][T17934] input: syz1 as /devices/virtual/input/input477 [ 357.554963][T17919] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue 21:15:07 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9d}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) [ 357.649756][T17943] input: syz1 as /devices/virtual/input/input478 21:15:08 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0xc0189436) [ 357.852956][T17949] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 357.881205][T17949] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 357.904084][T17949] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 357.944883][T17949] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue 21:15:08 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9d}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b54"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) [ 358.032156][T17956] input: syz1 as /devices/virtual/input/input480 21:15:08 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x16) [ 358.168536][T17960] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 358.179448][T17960] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 358.208110][T17963] input: syz1 as /devices/virtual/input/input481 [ 358.224252][T17960] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock 21:15:08 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r2, 0x0, 0x0) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 21:15:08 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) r3 = dup2(r0, r1) ioctl$CAPI_GET_MANUFACTURER(r3, 0xc0044306, &(0x7f0000000100)=0x800) 21:15:08 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0xc020660b) [ 358.373559][T17960] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue [ 358.507359][T17980] input: syz1 as /devices/virtual/input/input483 [ 358.552476][T17982] input: syz1 as /devices/virtual/input/input484 21:15:08 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9d}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b54"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:15:08 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0xc06855c8) 21:15:09 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r3, 0x0, 0x0, 0x0) ioctl$MON_IOCG_STATS(r3, 0x80089203, &(0x7f0000000100)) [ 358.875336][T17992] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 358.900578][T17998] input: syz1 as /devices/virtual/input/input487 [ 358.930930][T17992] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 358.962423][T18001] input: syz1 as /devices/virtual/input/input488 21:15:09 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) r2 = dup(r1) r3 = syz_genetlink_get_family_id$net_dm(&(0x7f00000000c0)='NET_DM\x00') sendmsg$NET_DM_CMD_STOP(r2, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r3, 0x69ea60866a57905, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40054}, 0x2a004000) dup2(r0, r1) [ 358.990664][T17992] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 359.069261][T17992] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue [ 359.083586][T18007] input: syz1 as /devices/virtual/input/input490 21:15:09 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x17) [ 359.115422][T18008] input: syz1 as /devices/virtual/input/input491 21:15:09 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9d}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b54"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:15:09 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) syz_open_dev$video4linux(&(0x7f0000000100)='/dev/v4l-subdev#\x00', 0x0, 0x80000) openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000140)='/dev/video37\x00', 0x2, 0x0) r2 = syz_open_dev$radio(&(0x7f0000000180)='/dev/radio#\x00', 0x1, 0x2) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) dup2(r2, r3) 21:15:09 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, 0xffffffffffffffff) 21:15:09 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r1, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x10005, 0x0) 21:15:09 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0xc08c5332) [ 359.404163][T18030] input: syz1 as /devices/virtual/input/input493 [ 359.461362][T18036] input: syz1 as /devices/virtual/input/input496 21:15:09 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x800, 0x0) write$uinput_user_dev(r1, &(0x7f0000000180)={'syz0\x00', {0x9, 0x1ff, 0x7, 0xd5e5}, 0x3, [0x80, 0x100, 0x5, 0x3, 0x9, 0x5, 0x2, 0x10000, 0x9, 0xdd95, 0x8001, 0x4, 0x57d19acc, 0x3098, 0x3, 0xc7d, 0x5, 0x2, 0x6, 0x9, 0x3, 0x8a, 0x0, 0x3, 0xffffffff, 0x1, 0x2, 0x8, 0xfff, 0x101, 0x6, 0x480000, 0x8, 0x3, 0x1f, 0x6, 0x6623, 0x0, 0x9, 0x5, 0x8, 0x6, 0x40, 0x40, 0x7, 0x83, 0x3ff, 0x8001, 0x9, 0x40, 0xfffffff9, 0x9b9, 0x0, 0x81, 0x4, 0x80000000, 0x3ff, 0x5, 0xd8ba, 0x7fffffff, 0x0, 0x5, 0x401, 0xa8], [0x879, 0x1, 0xffffffff, 0x2, 0x3, 0x9, 0x1, 0x800000, 0x1, 0x1000, 0x2, 0xfffffff8, 0x7c, 0x10001, 0x1, 0x8a, 0x5, 0x3, 0xb11, 0xffffd9a8, 0x6d0, 0x5, 0x7ff, 0x5, 0x9, 0x3, 0x9, 0x7, 0x0, 0x3f, 0x5, 0x8, 0x7, 0x20, 0x9, 0x823, 0x6, 0x2, 0xff, 0x7ff, 0x9, 0xd8, 0x90, 0x7, 0x3, 0x8000, 0x1ff, 0xfac, 0x3a7, 0x70cf0e68, 0x3, 0x5, 0x2, 0x3, 0x0, 0x8000, 0x6, 0x14, 0x80000001, 0x248, 0x8, 0x5, 0x8, 0x9], [0x80, 0x7, 0x2, 0x6, 0x200, 0x4, 0x5, 0x8, 0x7492, 0x37, 0x1, 0xed, 0x1, 0x20, 0x73, 0x2, 0x1, 0x2, 0x8, 0x0, 0xfffffeff, 0x7, 0x0, 0x5, 0x8, 0x5, 0x3, 0x2, 0x1, 0xffff, 0x40000000, 0x10001, 0x0, 0x1000, 0x530c92eb, 0x7f, 0xfffff000, 0xfffffffa, 0x2, 0x2, 0x8, 0x0, 0x0, 0x80000000, 0x400, 0x8, 0x1, 0x4, 0x6, 0xf0, 0x3, 0x8f, 0x9, 0x10000, 0x5, 0x9, 0xf4b4, 0x3, 0x199, 0x3, 0xc0000, 0x4, 0x4, 0x2], [0x1, 0x8, 0x5, 0xbc, 0x8, 0x7f, 0x9, 0x81, 0x401, 0x4, 0x2, 0x1, 0xffffffff, 0x3, 0x5, 0x8001, 0x80000001, 0x6, 0x7f, 0xa482, 0x7f000, 0xff, 0x401, 0x1, 0x6, 0x4, 0x5, 0x4, 0x4, 0x10000, 0x80, 0x7, 0x1, 0x7, 0x4, 0x1, 0xffff, 0x0, 0x401, 0x1f, 0x1, 0x13, 0x8001, 0x1, 0x0, 0x6, 0x8, 0x8, 0x7, 0xfffffff7, 0x2, 0x6, 0x0, 0x1, 0x15f, 0x6, 0x7, 0x3, 0x1, 0x1, 0xdef, 0x301, 0x401, 0x5]}, 0x45c) r2 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r3, 0x0, 0x0, 0x0) ioctl$UI_SET_SNDBIT(r3, 0x4004556a, 0x1) ioctl$UI_DEV_DESTROY(r0, 0x5502) r4 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0x10000, 0x0) connect$bt_sco(r4, &(0x7f00000000c0)={0x1f, {0x9, 0x2, 0x0, 0x0, 0x81, 0x8}}, 0x8) dup2(r0, r2) [ 359.517872][T18032] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 359.530801][T18032] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 359.543806][T18032] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 359.577388][T18032] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue 21:15:09 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9d}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc1"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:15:09 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{0x1000, 0xfff8, 0x7ff}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00', 0x2a}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0xffffffffffffffe0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r3, 0x0, 0x0, 0x0) ioctl$EVIOCREVOKE(r3, 0x40044591, &(0x7f0000000100)=0x1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) close(r3) 21:15:09 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0xc08c5334) 21:15:09 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) pipe2(&(0x7f0000000080)={0xffffffffffffffff}, 0x4000) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000180)={r1, &(0x7f00000000c0)="94154f0096cbe0530cf60cea459d39d013ecf6edc174476a75e60a8e07ecfb79c79cc045079378b86974cc42e8e15d1db0522ec6af5f0397921e5986555a93ed26139a88b541e9834d5c225ae295ffe6239d8fcd51f29ba2e6d0935f2c18ec7078d72688f2c99a2bdb46aa34f24c31482e873c1e1269ee9970", &(0x7f0000000140)="2a2fc8b7df571e03af40a23db6759180006def5e6cc220dd16f9960f7d33"}, 0x20) r2 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0xffffffffffffffff, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/hwrng\x00', 0x4000, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r2) ioctl$BLKTRACETEARDOWN(r2, 0x1276, 0x0) socket$unix(0x1, 0x5, 0x0) [ 359.756803][T18058] input: syz1 as /devices/virtual/input/input500 [ 359.858847][T18053] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 359.876491][T18053] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock 21:15:10 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz0\x00', 0x1ff) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r3, 0x0, 0x0, 0x0) getsockopt$bt_BT_SNDMTU(r3, 0x112, 0xc, &(0x7f0000000140), &(0x7f0000000180)=0x2) [ 359.930646][T18070] input: syz1 as /devices/virtual/input/input502 [ 359.950248][T18053] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 359.996155][T18053] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue 21:15:10 executing program 3: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r4, 0x0, 0x10005, 0x22) 21:15:10 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) r1 = socket$inet(0x2, 0x5, 0x6) getsockopt$SO_TIMESTAMPING(r1, 0x1, 0x41, &(0x7f0000000080), &(0x7f00000000c0)=0x4) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r2 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x5, 0x2840) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r2) [ 360.079908][T18078] input: syz1 as /devices/virtual/input/input505 21:15:10 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9d}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc1"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) [ 360.166844][T18074] input: syz1 as /devices/virtual/input/input506 21:15:10 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5f00fe01b2a4a280930206000100000001000000003900090035000c03110000001900154001000000000022dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x4240a61c) socket$inet(0x2, 0x3, 0x2) bind$inet(r1, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x7b) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x10005, 0x0) [ 360.248646][T18082] input: syz1 as /devices/virtual/input/input507 21:15:10 executing program 1: ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x800c6613, &(0x7f0000000100)=@v1={0x0, @aes128, 0x1, "df46f3e817cac38f"}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x40600, 0x0) ioctl$KDSIGACCEPT(r0, 0x4b4e, 0x38) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) 21:15:10 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='environ\x00') pread64(r3, 0x0, 0x0, 0x0) r4 = socket(0x100000000011, 0x2, 0x0) bind(r4, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r4, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) setsockopt$packet_add_memb(r4, 0x107, 0x1, &(0x7f0000000000)={r5, 0x1, 0x6, @broadcast}, 0x10) r6 = dup(r4) setsockopt$packet_add_memb(r6, 0x107, 0x2, &(0x7f0000000080)={r5, 0x1, 0x6, @link_local}, 0x10) setsockopt$inet6_IPV6_PKTINFO(r3, 0x29, 0x32, &(0x7f0000000100)={@empty, r5}, 0x14) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r1) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r3, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x5}, 0x8) 21:15:10 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r1, 0x0, 0x0, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') openat$vcs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vcs\x00', 0x2001, 0x0) pread64(r2, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(r2, 0x540f, &(0x7f0000000640)) clone3(&(0x7f0000000ac0)={0x200000, &(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980), 0x1e, 0x0, &(0x7f00000009c0)=""/123, 0x7b, &(0x7f0000000a40)=""/117}, 0x40) r3 = gettid() ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x3c) ptrace$cont(0x9, r3, 0x0, 0x0) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r3, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000dc0)={r3, 0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000d80)='vmnet1{vmnet0#]\x00'}, 0x30) r5 = syz_open_procfs(r4, &(0x7f0000000e00)='f\x90f\xea\xa5\tdinfo\x00\xa2\xbd)F\xb9\xad*\xc9_z+|:-dl\xf4\xb1\f?=\xd1{\x92K\x1c\xc26\xf5\xa3\xed\x04\x9e\xfe5\x16\xa7\xa8\xf1\n)!\xb0\x13u9\xfa\x9d\xa2+p\x0e\x04\xde\xdf\xefD\xb0\x85t\xe2z4\x17\xce:\xa5\xd1|\xc0a\x87\xa1w\xd5m\xb7\xb5Y\xec\xa9\xc3\xd8\xac[\xee\x8e\xad\xc1Q87%_\x93\xb7\\\xa8\a=\xb8%\xa5\x96>Q\xeb\xf0HO\x87\xf3\'\xa8\x80\xd5\x82J\xca\xc2?n\xf20\xb19\xd2f\xed\x85O\xef\x85\x9e\b\xf4\xa8\x04\x93z6\xcc;kG\x16w\xda\xbd.\xca?\xbfVq\n\vr($5\xe7A3\xb6+P\xfa\x10\xa1\x84-\xab\xe6\xec\x8b]\xa6\xfa\xaf`1Z\x99\xfb\x8e\xce\n\xd5\xec\xf2JT\x04\x19\x8c\xd7\xbdZG \xea\x97\xeb^\xcf\x84\x8ce\x1d\x9d!\rR\tt\xa9Y\xbe\xf2\xdf\xb1') pread64(r5, 0x0, 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r6 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) dup2(r0, r6) [ 360.515112][T18112] input: syz1 as /devices/virtual/input/input510 [ 360.547814][T18100] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 360.578364][T18100] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 360.608983][T18112] device lo entered promiscuous mode [ 360.631727][T18100] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 360.659627][T18100] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue 21:15:10 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000340)='/dev/uinput\x00', 0x3, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r1, 0x0, 0x0, 0x0) ioctl$VIDIOC_TRY_DECODER_CMD(r1, 0xc0485661, &(0x7f0000000380)={0x1, 0x1, @raw_data=[0x9, 0x80, 0xa26, 0x100, 0x20, 0x607c, 0x3f, 0xa88, 0x62ba, 0x3, 0x6, 0x0, 0x1, 0xe4fd, 0x9, 0x6]}) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/capi/capi20\x00', 0x202000, 0x0) ioctl$UI_DEV_SETUP(r2, 0x405c5503, &(0x7f0000000080)={{0x0, 0x3}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x1e\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) lremovexattr(&(0x7f0000000100)='./file0\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="62747266732e232b766d6e65743100174049225bcb3bc12706d4bd25b57c6dec48ed22e8a34bb59f1a4b5f46b6435f1e416f813aa4d422fa27c008a0b3b2377acfab9238658313482bd85ccbda7d91809ea0f1959d84b4d24d5a954d165363c83822344667f8f743f3e0ceca4a9726fe9fd41a1d6795bbe1cbf3683dbad1aec41f74f28c4f273e0ec0331ca142de501868471e4f1021b1a0b18286004f8d5d25e13047a9d6ce9ae0b8488a3e78a7090fd22e4c9457eb7fc6e9bfe0ec57cabd1fb39f0ebbc435cb50343d9174d6806997678db4cf4cac3d5c62daf718bd53fcef7470328ad0e33142098ac782d8a9185823036c26d5e1be8936b29dcbc503a86bb76b31482db3d7d6e125091904a64efbf862a047a33c5a1746b82be9d6061612c8bc9cff200dc77652cede37ac65589a506d4a4b6496532802"]) setsockopt$inet_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000580)={@in={{0x2, 0x4e23, @empty}}, 0x0, 0x2f0, 0x0, "0d29cffa54912b7f1427089b5baf1b9096bd7cc8f042fe9db816d13d68417184f9e378b93b602972fa2621efc11f95e84efb7a8e4aec9ed5165754664063270f97a00e16c047ffe785ea1dd7b70e6c5c"}, 0xd8) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r3, 0x0, 0x0, 0x0) ioctl$PIO_FONTX(r3, 0x4b6c, &(0x7f0000000680)="ec278a55407dbefa0a5e215defb94c1ab1c1d65bef0b63f2ceff44a7f2f779f53e5d81c6a3a0f82d45302023f631ce6ecd18c00f4c47da8517df15712d459387759c410fea642bd39746818be381f9e8405fab3e96cdaec516be4a7fe9d4090632c16e55da9f0c7d3c99fa5ac4b38ff1c56f43310995293b05ae729a1681287847c964287806610880846a40e68b983698b37c9b7ab077d34b66538a8f1ccc38b66564aedf63621e9477f003006fb23526fa2fad231c8099163bfc32d4af6d9764c02bd739850088d798a926bd39d23fae12acf3babb66b7d661769986e81c37292d8a") syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') r5 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_GET_RESERVED_SIZE(r5, 0x227a, &(0x7f00000016c0)) getsockopt$bt_BT_DEFER_SETUP(r4, 0x112, 0x7, &(0x7f0000000140), &(0x7f0000000180)=0x4) ioctl$UI_DEV_DESTROY(r0, 0x5502) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r6, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_AGP_RELEASE(r1, 0x6431) r7 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000400)='/dev/vsock\x00', 0x80000, 0x0) r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r8, 0x0, 0x0, 0x0) bind$netlink(r8, &(0x7f0000000240)={0x10, 0x0, 0x25dfdbfd, 0x121002a}, 0xc) setsockopt$netlink_NETLINK_RX_RING(r7, 0x10e, 0x6, &(0x7f0000000200)={0x100, 0x7fff, 0x3ff, 0x100}, 0x10) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1b) [ 360.730720][T18110] device lo left promiscuous mode 21:15:10 executing program 4: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x20000, 0x0) ioctl$USBDEVFS_CLAIM_PORT(r0, 0x80045518, &(0x7f00000001c0)) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r1, 0x5501, 0x0) r2 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r1, 0x5502) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') pread64(r3, 0x0, 0x0, 0x0) ioctl$SIOCX25GSUBSCRIP(r3, 0x89e0, &(0x7f0000000080)={'caif0\x00', 0x1}) dup2(r1, r2) 21:15:10 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001280)=ANY=[@ANYBLOB="1204007606e1deeb422a373a2166421cb20000000000", @ANYBLOB="740081008ca31de4df3b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b9d0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1678c06eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9d}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000d000000c44fd092322122db6f9c592da5716773a4b84f32cddf74db78766f0a999b9c0b547cc1"], 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 21:15:10 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xee\xff\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_DEV_DESTROY(r0, 0x5502) ioctl$TUNGETFILTER(0xffffffffffffffff, 0x801054db, &(0x7f0000000100)=""/64) dup2(r0, r1) [ 360.965761][T18139] input: syz1 as /devices/virtual/input/input516 [ 361.009231][T18132] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 361.044104][T18132] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 361.070884][T18132] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 361.087899][T18143] ------------[ cut here ]------------ [ 361.093665][T18143] refcount_t: increment on 0; use-after-free.