, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
syz_open_dev$binder(&(0x7f0000000240)='/dev/binder#\x00', 0x0, 0x800)

[  808.149833] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  808.196342] binder: 2284:2288 ioctl 2270 200001c0 returned -22
[  808.205788] binder: 2280:2290 ioctl 2270 200001c0 returned -22
16:08:09 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

16:08:09 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  808.514907] binder: 2271:2278 ioctl 2270 200001c0 returned -22
16:08:09 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x800000000000000}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:09 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x4000, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:09 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

16:08:09 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x700}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:09 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  808.823345] binder: 2300:2308 ioctl 2270 200001c0 returned -22
[  808.894122] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  808.911718] binder: 2280:2315 ioctl 2270 200001c0 returned -22
[  808.960970] binder: 2284:2320 ioctl 2270 200001c0 returned -22
16:08:10 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

16:08:10 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff})
r1 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x802)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r1, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:10 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x2a})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  809.163575] binder: 2324:2325 ioctl 2270 200001c0 returned -22
[  809.173590] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:08:10 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  809.253508] binder: 2328:2330 ioctl 2270 200001c0 returned -22
16:08:10 executing program 2:
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  809.346650] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:08:10 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  809.538221] overlayfs: missing 'lowerdir'
16:08:10 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  809.564764] binder: 2300:2338 ioctl 2270 200001c0 returned -22
[  809.702477] overlayfs: missing 'lowerdir'
16:08:10 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x8701, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:10 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x5802}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:10 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x3f00}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:10 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

16:08:10 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  809.865966] binder: 2342:2350 ioctl 2270 200001c0 returned -22
[  809.890026] overlayfs: missing 'lowerdir'
[  809.964633] binder: 2324:2360 ioctl 2270 200001c0 returned -22
[  810.018928] binder: 2328:2364 ioctl 2270 200001c0 returned -22
[  810.032652] overlayfs: missing 'lowerdir'
16:08:11 executing program 0:
r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$TIOCPKT(r1, 0x5420, &(0x7f0000000180)=0xc1)
r3 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x41)
ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000000440)=<r4=>0x0)
getresuid(&(0x7f0000000480), &(0x7f0000000640)=<r5=>0x0, &(0x7f0000000680))
lstat(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0})
r7 = gettid()
lstat(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0, <r8=>0x0})
stat(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0, 0x0, <r9=>0x0})
sendmsg$netlink(r2, &(0x7f0000000980)={&(0x7f0000000240)=@proc={0x10, 0x0, 0x25dfdbfd, 0x4080000}, 0xc, &(0x7f0000000280)=[{&(0x7f0000000500)={0x110, 0x3f, 0x100, 0x70bd27, 0x25dfdbff, "", [@generic="87b258a94323e112235e", @typed={0x80, 0x28, @binary="1330d55b020788fa5c70e96c22a38f3c8dcf770b1b4fedc02c04bee9e23e751e15e02d4dfdb6027a235d4302f740931c37aa9b96b28f63fde15a0326c132d59e262119a9ee942c8aebe1b84d0de5ce88a54e922762b88b0d58771cdb322987c13d1e7f96f2f55ccb99f11353ed82bf47f1b2b99197c7ac815f42"}, @nested={0x74, 0x3d, [@generic="1bdbfd74e68880f3f07a39ca47206a133fc3780beb7fa5afa2645a986b992a6fec3e049094d3e6b5d53dc93033400080c323d183b6553d4d538f41ef38162fb4ebde7f8154f3fcfff41aea5063d46f035bf650575ddc2cb6b99acf6288b0bcf86bec605f64", @typed={0x8, 0x1e, @u32=0x4c93ca4b}]}]}, 0x110}, {&(0x7f0000000340)={0xc0, 0x31, 0x1, 0x70bd25, 0x25dfdbff, "", [@generic="08d4e0d08a1d8f6a2152329d97932a196c632fae3661ae939f8f9db073c6e2957b", @generic="9ff3b679785d28d9b83d282b5bb1520b0ca37ea58c6b9e334f64cad3b4ee710aa9ef37f528582ee117436dcc2a1e4dfe79e4ea8c94ba9a3e66e96f5fd29a037d8ca2002f7b4ddad12e1686b9dfd34b9dd4d79104218903a5d29ca056e70c2b2a6e9f81e61ae07474f91cbab19bc77e74a6a5af54d903d85220807d4b20d264", @generic="dadfc302253459850835320e3f4eaaed"]}, 0xc0}], 0x2, &(0x7f0000000900)=[@cred={0x20, 0x1, 0x2, r4, r5, r6}, @cred={0x20, 0x1, 0x2, r7, r8, r9}, @rights={0x28, 0x1, 0x1, [r0, r3, r0, r2, r2]}], 0x68, 0x80}, 0x4000040)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:11 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

16:08:11 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x200000c8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  810.180538] binder: 2367:2368 ioctl 2270 200001c0 returned -22
[  810.205910] overlayfs: missing 'lowerdir'
16:08:11 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

16:08:11 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:fi'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  810.338015] binder: 2373:2375 ioctl 2270 200001c0 returned -22
[  810.364467] overlayfs: missing 'lowerdir'
[  810.476791] overlayfs: failed to resolve 'fi': -2
16:08:11 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:fi'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

16:08:11 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:fi'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  810.585625] overlayfs: failed to resolve 'fi': -2
[  810.613543] binder: 2342:2382 ioctl 2270 200001c0 returned -22
16:08:11 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x8, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:11 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x7}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:11 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x1000000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  810.734766] overlayfs: failed to resolve 'fi': -2
16:08:11 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,wor'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  810.791298] binder: 2387:2397 ioctl 2270 200001c0 returned -22
16:08:11 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,wor'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  810.855539] overlayfs: unrecognized mount option "wor" or missing value
[  810.971553] overlayfs: unrecognized mount option "wor" or missing value
[  810.976268] binder: 2367:2368 ioctl 2270 200001c0 returned -22
16:08:12 executing program 0:
r0 = openat$cgroup_procs(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f0000000240)='trusted.overlay.origin\x00', &(0x7f0000000280)='y\x00', 0x2, 0x1)
r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r2=>0xffffffffffffffff})
getsockopt$inet_sctp_SCTP_RECVNXTINFO(r2, 0x84, 0x21, &(0x7f0000000340), &(0x7f0000000380)=0x4)
r3 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:12 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,wor'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  811.091710] binder: 2373:2410 ioctl 2270 200001c0 returned -22
16:08:12 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000003c0)={0x0, <r3=>0x0}, &(0x7f0000000440)=0xc)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, <r4=>0x0})
getresuid(&(0x7f0000000580), &(0x7f00000005c0), &(0x7f0000000600)=<r5=>0x0)
getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000640)={{{@in=@multicast1, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0}}, {{@in=@multicast2}, 0x0, @in=@multicast2}}, &(0x7f0000000740)=0xe8)
r7 = getuid()
r8 = getegid()
r9 = getgid()
getgroups(0x1, &(0x7f0000000780)=[<r10=>0xee01])
setxattr$system_posix_acl(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380)='system.posix_acl_access\x00', &(0x7f00000007c0)={{}, {0x1, 0x6}, [{0x2, 0x5, r3}, {0x2, 0x1, r4}, {0x2, 0x3, r5}, {0x2, 0x6, r6}, {0x2, 0x6, r7}], {0x4, 0x1}, [{0x8, 0x0, r8}, {0x8, 0x1, r9}, {0x8, 0x0, r10}], {0x10, 0x2}, {0x20, 0x4}}, 0x64, 0x2)
epoll_create(0x1)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r11=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r11+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000280)={0x7, &(0x7f0000000180)=[{0x7, 0x6, 0x6, 0x6}, {0x10000, 0x101, 0x541, 0x3}, {0x2, 0x2a, 0x6, 0x9}, {0xff, 0x2, 0x6, 0x8}, {0x9, 0x8000, 0x3, 0x65}, {0x80, 0xfffffffffffff24a, 0x5, 0x8}, {0x7fe6a663, 0x80000001, 0x219, 0x9}]}, 0x10)

[  811.187449] binder: 2411:2412 ioctl 2270 200001c0 returned -22
[  811.224261] overlayfs: unrecognized mount option "wor" or missing value
16:08:12 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdi'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

16:08:12 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdi'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  811.358973] binder: 2417:2419 ioctl 2270 200001c0 returned -22
[  811.374084] overlayfs: unrecognized mount option "workdi" or missing value
16:08:12 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdi'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  811.451746] overlayfs: unrecognized mount option "workdi" or missing value
16:08:12 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir='])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  811.536118] overlayfs: unrecognized mount option "workdi" or missing value
[  811.547239] binder: 2387:2430 ioctl 2270 200001c0 returned -22
16:08:12 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x87010000, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:12 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x258}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  811.627187] overlayfs: unrecognized mount option "workdir=" or missing value
16:08:12 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x700000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:12 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir='])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

16:08:12 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir='])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  811.716153] binder: 2435:2445 ioctl 2270 200001c0 returned -22
[  811.737047] overlayfs: unrecognized mount option "workdir=" or missing value
[  811.810019] binder: 2417:2419 ioctl 2270 200001c0 returned -22
[  811.829820] overlayfs: unrecognized mount option "workdir=" or missing value
[  811.972002] binder: 2411:2457 ioctl 2270 200001c0 returned -22
16:08:13 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000240)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:13 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(0xffffffffffffffff, &(0x7f0000000140)=""/65, 0x506)

16:08:13 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000280)="a91de88b4fda3f7c4aaa650dba1804fdc30ab3da8e38a105c29084bf1fe6e27c149b18e6ad631f900dffd39ee5", 0x2d)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000003c0)={r1, &(0x7f0000000500)="ffca1569dc5f95669b06537c37f88ae265a736bb064b46f3f33159f4dba42464437840d668c40048148e22447105386733be189b0f22352dfc7fa067e45a8b50cc0b55ec6856dcb4e29ae99748f052a15fef4d8b9b99eaf1247991fda100441d3a6f4c24340fc75f26054cdbfc99f2c013f93abe5b9722f23c28a31ca51f9f27481dc99758c725f9bff4b621089853b1", &(0x7f0000000180), 0x3}, 0x20)
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
r4 = getpid()
perf_event_open(&(0x7f0000000340)={0x7, 0x70, 0x2, 0x80, 0x8, 0x2, 0x0, 0x9, 0x1000, 0x8, 0x58e, 0x6, 0x9, 0x7f, 0x6, 0x3, 0x9, 0x7, 0x1, 0x84e, 0x8, 0x7, 0x4, 0x200, 0x7f, 0x2, 0x5, 0x6, 0x5, 0x7, 0x4, 0x7, 0x3, 0xffffffffffff7fff, 0x9, 0xb622, 0x3, 0x90c3, 0x0, 0x1, 0x0, @perf_config_ext={0x800, 0x7}, 0x0, 0x7fff, 0x20, 0x7, 0x0, 0x400, 0x7}, r4, 0x6, r0, 0xa)
openat$pfkey(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/net/pfkey\x00', 0x181000, 0x0)
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  812.086300] binder: 2459:2460 ioctl 2270 200001c0 returned -22
[  812.091575] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:08:13 executing program 2:
r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x0, 0x0)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0)
read(r1, &(0x7f0000000600)=""/11, 0x232)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000140))
r2 = dup2(r1, r0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4)
connect$inet6(r3, &(0x7f0000000080), 0x1c)
r4 = dup2(r3, r3)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000440), 0x131f64)
clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, &(0x7f0000000140), 0xffffffffffffffff)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000100)={@dev, 0x0, 0x2}, 0x20)
ioctl$RNDCLEARPOOL(r2, 0x5206, &(0x7f00000000c0))

[  812.196811] binder: 2463:2467 ioctl 2270 200001c0 returned -22
[  812.276231] binder: 2459:2466 ioctl 2270 200001c0 returned -22
16:08:13 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000280)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f0000000480)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000440)={&(0x7f0000000340)={0xac, r2, 0x10, 0x70bd2c, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x400000}]}, @IPVS_CMD_ATTR_DEST={0x44, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e21}, @IPVS_DEST_ATTR_L_THRESH={0x8}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x81}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x4}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x800000000000000}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e24}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x10000}, @IPVS_DEST_ATTR_WEIGHT={0x8}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0xfffffffffffffffd}]}]}, 0xac}, 0x1, 0x0, 0x0, 0x80}, 0x80)
r3 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r4=>0x0})
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r4+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  812.469770] binder: 2435:2477 ioctl 2270 200001c0 returned -22
16:08:13 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x10000000, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  812.526689] binder: 2476:2480 ioctl 2270 200001c0 returned -22
16:08:13 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:13 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x7000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  812.632859] binder: 2482:2485 ioctl 2270 200001c0 returned -22
[  812.982697] binder: 2463:2498 ioctl 2270 200001c0 returned -22
[  813.179085] binder: 2476:2484 ioctl 2270 200001c0 returned -22
16:08:14 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
ioctl$UI_SET_PROPBIT(r1, 0x4004556e, 0x1d)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000180)={0x40000000})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
ioctl$TIOCCBRK(r1, 0x5428)
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:14 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x1a, &(0x7f00000000c0)={0x0, 0xfffffffffffffffe, 0x4}, &(0x7f0000000340)={0xfffffffffffffffd, 0x7}, &(0x7f0000000180)={0xffffffff, 0x0, 0x9, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x2}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  813.409458] binder: 2503:2508 ioctl 2270 200001c0 returned -22
[  813.446797] binder: 2482:2510 ioctl 2270 200001c0 returned -22
[  813.468693] binder: 2506:2511 ioctl 2270 200001c0 returned -22
16:08:14 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:14 executing program 2:
r0 = socket(0x10, 0x803, 0x0)
sendto(r0, &(0x7f0000000000)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x630}, {&(0x7f00000000c0)=""/85, 0xfb}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000140)=""/60, 0xf0}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0xffffffffffffff54}, {&(0x7f0000000340)=""/22, 0x16}], 0x6, &(0x7f0000002400)=""/191, 0xbf}}], 0x4000000000000f0, 0x0, &(0x7f0000003700)={0x77359400})

16:08:14 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x700000000000000, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  813.778950] binder: 2518:2521 ioctl 2270 200001c0 returned -22
16:08:14 executing program 2:

16:08:14 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x8000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:15 executing program 2:

16:08:15 executing program 2:

[  814.203862] binder: 2503:2538 ioctl 2270 200001c0 returned -22
16:08:15 executing program 2:

[  814.286796] binder: 2506:2542 ioctl 2270 200001c0 returned -22
16:08:15 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
syz_open_dev$sndpcmc(&(0x7f0000000180)='/dev/snd/pcmC#D#c\x00', 0x810e, 0x1)
r3 = gettid()
ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000240)={[], 0x9, 0xff2, 0xeb3, 0xd72d, 0x2, r3})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:15 executing program 2:

16:08:15 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000280)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$RTC_AIE_OFF(r0, 0x7002)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
ioctl$KDGETMODE(r0, 0x4b3b, &(0x7f0000000180))
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:15 executing program 2:

[  814.467348] binder: 2545:2549 ioctl 2270 200001c0 returned -22
[  814.533405] binder: 2550:2552 ioctl 2270 200001c0 returned -22
[  814.547654] binder: 2518:2556 ioctl 2270 200001c0 returned -22
16:08:15 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x700000000000000}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:15 executing program 2:

16:08:15 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x3f000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:15 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x3f00, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:15 executing program 2:

[  814.782586] binder: 2560:2570 ioctl 2270 200001c0 returned -22
16:08:15 executing program 2:

16:08:16 executing program 2:

16:08:16 executing program 2:

[  815.163506] binder: 2550:2552 ioctl 2270 200001c0 returned -22
[  815.237188] binder: 2545:2580 ioctl 2270 200001c0 returned -22
16:08:16 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
semget$private(0x0, 0x0, 0x400)
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
syz_extract_tcp_res$synack(&(0x7f0000000380), 0x1, 0x0)
r3 = request_key(&(0x7f00000003c0)='rxrpc\x00', &(0x7f0000000440)={'syz', 0x1}, &(0x7f0000000480)='/dev/userio\x00', 0xfffffffffffffffe)
r4 = add_key(&(0x7f0000000500)='logon\x00', &(0x7f0000000540)={'syz', 0x0}, &(0x7f0000000580)="7e5b39af093ebb8c47d6320cf8980a0f90878f3691b67d8a1e176d3f4942c41b54e66d73159314efcf9a3cb8bff85128963588097d15af03125f405017980f4d38a919d746546154fd7fe4626683035f7527bbfc04458ad26e2b1830a22b5cda42bd2fb94a6c4a5b0152181bbc627de8c0ce10f0510b40d5949e7f22ca4e3c4ada58f8b1b68c4d80656697db1ff20072280cdce5", 0x94, 0xfffffffffffffffa)
keyctl$link(0x8, r3, r4)
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000180)={<r5=>0x0}, &(0x7f0000000240)=0xc)
capset(&(0x7f0000000280)={0x399f1336, r5}, &(0x7f0000000340)={0x9, 0x7fffffff, 0x5cb, 0x100000001, 0x6, 0x7f})

16:08:16 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000380)='/dev/loop-control\x00', 0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = socket(0x0, 0x80a, 0x81)
getsockopt$inet6_dccp_int(r3, 0x21, 0x10, &(0x7f0000000280), &(0x7f0000000440)=0xffa5)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200), &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000180), &(0x7f0000000240)=0x4)

16:08:16 executing program 2:

[  815.463573] binder: 2586:2592 ioctl 2270 200001c0 returned -22
16:08:16 executing program 2:

[  815.512088] binder: 2587:2596 ioctl 2270 200001c0 returned -22
[  815.577116] binder: 2560:2603 ioctl 2270 200001c0 returned -22
16:08:16 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000000}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:16 executing program 2:

16:08:16 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x3f00}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:16 executing program 2:

16:08:16 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x7, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:16 executing program 2:

[  815.860815] binder: 2617:2621 ioctl 2270 200001c0 returned -22
16:08:17 executing program 2:

16:08:17 executing program 2:

[  816.260560] binder: 2586:2626 ioctl 2270 200001c0 returned -22
[  816.293568] binder: 2587:2632 ioctl 2270 200001c0 returned -22
16:08:17 executing program 0:
r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/qat_adf_ctl\x00', 0x420000, 0x0)
getsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000440), &(0x7f0000000480)=0x4)
openat$userio(0xffffffffffffff9c, &(0x7f0000000240)='/dev/userio\x00', 0x2, 0x0)
socket$inet_udp(0x2, 0x2, 0x0)
pipe(&(0x7f0000000400)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r2, &(0x7f0000000340), 0x0)
perf_event_open(&(0x7f0000000040)={0xfffffffffffffffe, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000180)=0x1c)
vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:17 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r4, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x34000, 0x9effffff00000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000140)={0x20, 0x29, 0x82d, 0x0, 0x0, {0x1}, [@typed={0xc, 0x0, @u64}]}, 0x20}}, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(r0, 0x0, 0x2d, &(0x7f0000000340)={0x1f, {{0x2, 0x4e21, @multicast2}}}, 0x88)

16:08:17 executing program 2:
r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/user\x00')
setns(r0, 0x0)

16:08:17 executing program 2:
sync_file_range(0xffffffffffffffff, 0x0, 0x0, 0x0)
r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000580)={0x8, 0x0, 0x8200, 0x0, 0x1000}, 0x20)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
unshare(0x8020000)
r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000640)='ns/mnt\x00')
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x20, 0x0, &(0x7f00000000c0)=[@enter_looper, @decrefs, @dead_binder_done, @increfs], 0xffffffffffffff95, 0x0, &(0x7f0000000380)})
setns(r1, 0x0)
clone(0x0, &(0x7f0000000040), &(0x7f0000000200), &(0x7f00000001c0), &(0x7f00000000c0))
socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000180))
ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'team0\x00'})
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'team_slave_0\x00'})
r2 = dup2(r0, 0xffffffffffffffff)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000003c0)={{{@in6=@local, @in=@broadcast}}, {{}, 0x0, @in6=@dev}}, &(0x7f0000000300)=0xe8)
r3 = socket$alg(0x26, 0x5, 0x0)
perf_event_open(&(0x7f0000000100)={0x0, 0x201, 0xffffffff, 0x5, 0x5, 0xc385, 0x0, 0x8, 0x0, 0x0, 0x0, 0x7, 0x0, 0xfffffffffffffffe, 0x2, 0x1, 0x6, 0x9, 0x1f, 0x9, 0x1000, 0x6, 0x0, 0x6, 0x8a, 0x3, 0x0, 0x5, 0xc00000000000000, 0x3dc, 0x3f, 0x0, 0xfffffffffffffff7, 0x0, 0x1, 0x8, 0x0, 0x80000001, 0x0, 0x100000001, 0x0, @perf_config_ext={0x80000001, 0xe6}, 0x4, 0x3, 0x1ff, 0x0, 0x5, 0x4, 0x6}, 0x0, 0x3, 0xffffffffffffffff, 0x9)
ioctl$RTC_IRQP_READ(r2, 0x8008700b, &(0x7f0000000240))
fremovexattr(r3, &(0x7f0000000080)=@known='system.sockprotoname\x00')

[  816.524608] binder: 2636:2637 ioctl 2270 200001c0 returned -22
16:08:17 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x1400000000000000}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  816.605692] binder: 2641:2651 ioctl 2270 200001c0 returned -22
[  816.609291] binder: 2617:2652 ioctl 2270 200001c0 returned -22
16:08:17 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x6400}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:17 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x3f00000000000000, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  816.903798] binder: 2667:2672 ioctl 2270 200001c0 returned -22
16:08:18 executing program 2:
mkdir(&(0x7f0000002a80)='./file0\x00', 0x0)
clone(0x2102001ffb, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff)
mount(&(0x7f0000000180)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)='hfsplus\x00', 0x0, &(0x7f0000000280)="24e47e5c34381b56a7214a78be16faded8a2b94e78ce6903d4cfd88928f55c69004af966ab74f576d22f6185bcd8c4066c7f37a9550ffefc975c8fde405db7bab19bb567b88bbf9af88debff5e28dd4dad838aac54f86fb3f7bca77c75576a0b5a61520b82a6ab784cf9829651fa81032874bc34b1ebe1fd76f2c269ed0221c85d960037fe495390cd40bc06a21eb8e8c17ab59d726f54643e67c1023e8c1dfe4f16ffb1f3d9950e917f2b68add94b4f8efdb6be61764ae544e1ace1ea0cc4d2318645cfa484ca12bf67a9d1b1cbeb250a464b708cc7cd9abef735f09fe8c210c353b8f8167e5de88562a57e391ae7")
fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240))
dup(0xffffffffffffffff)
syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x0, 0x0)

[  817.058074] hfsplus: unable to parse mount options
16:08:18 executing program 2:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0xb, 0x7f, 0x7, 0x5, 0x1}, 0x2c)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000002c0)={r0, &(0x7f00000000c0), &(0x7f00000001c0)=""/221}, 0x18)

[  817.081362] hfsplus: unable to parse mount options
16:08:18 executing program 2:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f00000001c0)="153f6234488dd25d766070")
syz_emit_ethernet(0x1, &(0x7f00000000c0)=ANY=[@ANYBLOB="abaaaaaaaaaaaaaaaaaaaaaa86dd60d4b30200181100fe8000009a47e2bf6163875d81f9ef000000aa00000000000000000000ff08000000000000007800190000ff01000000000008000000000000000100000000000000000000000000000000"], &(0x7f0000000000))

16:08:18 executing program 2:
r0 = socket$inet6(0xa, 0x1, 0x8010000000000084)
bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23}, 0x1c)
setsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x14)
listen(r0, 0x800000002)
r1 = socket$inet6_sctp(0xa, 0x1, 0x84)
r2 = socket(0x840000000015, 0x805, 0x0)
ioctl(r2, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
sendto$inet6(r1, &(0x7f0000000080)='X', 0x1, 0x0, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)

16:08:18 executing program 0:
r0 = openat$userio(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/userio\x00', 0x2000004, 0x0)
pipe(&(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r2, &(0x7f0000000340), 0x10000014c)
getsockopt$IP_VS_SO_GET_SERVICES(r1, 0x0, 0x482, &(0x7f0000000400)=""/81, &(0x7f0000000380)=0x51)
recvmsg$kcm(r1, &(0x7f0000000880)={&(0x7f0000000640)=@pptp={0x18, 0x2, {0x0, @multicast2}}, 0x80, &(0x7f0000000800)=[{&(0x7f00000006c0)=""/105, 0x69}, {&(0x7f0000000740)=""/178, 0xb2}], 0x2, &(0x7f0000000840)=""/45, 0x2d, 0x1}, 0x42)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fanotify_mark(r2, 0x30, 0x10000, r1, &(0x7f0000000340)='./file0\x00')
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f00000001c0))
pselect6(0xfffffffffffffc8e, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
ioctl$SG_IO(r1, 0x2285, &(0x7f00000005c0)={0x53, 0xffffffffffffffff, 0x24, 0x30, @buffer={0x0, 0x2f, &(0x7f0000000480)=""/47}, &(0x7f0000000500)="dfc1a60ea5bc81cd8dc9b91cefd8ae87db21743621ff9f1013daf6c99697c70eccaf38c7", &(0x7f0000000540)=""/14, 0x8, 0x10, 0x3, &(0x7f0000000580)})
openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x80040, 0x0)
ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000240)=<r4=>0x0)
write$cgroup_pid(r1, &(0x7f0000000280)=r4, 0x12)
vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
ftruncate(r0, 0x2000000000000)

[  817.289217] binder: 2636:2685 ioctl 2270 200001c0 returned -22
[  817.312817] binder: 2641:2654 ioctl 2270 200001c0 returned -22
16:08:18 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000280)={r1, &(0x7f0000000500)="b10244598c219704adc56de1cd4ae2cab612657fa38d725d953e242dc03a43d99249b94e654a94a0c2e2e7d81db43881337236ab41e798dec595f1d064f7f9f3784abbafe232e3c7b9abcc41f1d5292616ae31ea1525fdc66b78931d9a0cc73127342eb51a57d128167a7580d0985755d17b1a63163a64097ea2b776b32cdd09685bfb8caf2e82f9d104150c0a803a36164e18d605eb7f0ea89f2a8b48d7e828b1e64c586053b1706f567f871f3f8e05dfa3f8344a2c733cba3fdbba32cdaedcdd87cc686df8d3b2803b5c78d1f35f8b6b5a5841bed2b8bf265d4f9250f1a8e9b41e7a87254d9738ed7dd8139bef75229d8f", &(0x7f0000000180)=""/16}, 0x18)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
r4 = semget$private(0x0, 0x2, 0x300)
semctl$IPC_STAT(r4, 0x0, 0x2, &(0x7f0000000340)=""/26)
ioctl$sock_inet6_tcp_SIOCATMARK(r0, 0x8905, &(0x7f0000000380))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
ioctl$sock_SIOCINQ(r1, 0x541b, &(0x7f00000003c0))

16:08:18 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
fstat(0xffffffffffffffff, &(0x7f00000001c0))
getresuid(&(0x7f0000000100), &(0x7f0000000240), &(0x7f0000000400))
r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000340)='/dev/sequencer2\x00', 0x10900, 0x0)
ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000500))
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x70001, 0x0)
write$P9_RLOPEN(r1, &(0x7f00000002c0)={0x18, 0xd, 0x0, {{0x4, 0x2, 0x4}}}, 0x18)
write$binfmt_misc(r0, &(0x7f0000000440)=ANY=[@ANYBLOB='Ra'], 0x2)
ioctl$sock_bt_bnep_BNEPCONNDEL(0xffffffffffffffff, 0x400442c9, &(0x7f0000000300)={0x8, @remote})
io_setup(0x0, &(0x7f0000000040)=<r2=>0x0)
io_submit(r2, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x6000000, 0x30770900000000, 0xd, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0xfffffce4}])

[  817.421091] binder: 2688:2691 ioctl 2270 200001c0 returned -22
[  817.521692] binder: 2694:2699 ioctl 2270 200001c0 returned -22
16:08:18 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x5802000000000000}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:18 executing program 2:
mkdir(&(0x7f0000000100)='./file0\x00', 0x0)
mount(&(0x7f0000000180)=ANY=[], &(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)='bpf\x00', 0x2100c0, 0x0)
r0 = socket(0x10, 0x2, 0x0)
chdir(&(0x7f0000000000)='./file0\x00')
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r1=>0x0}, &(0x7f0000cab000)=0xc)
ioctl$DRM_IOCTL_SWITCH_CTX(0xffffffffffffffff, 0x40086424, &(0x7f0000000200))
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
syz_mount_image$nfs4(&(0x7f0000000040)='nfs4\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001640), 0x0, &(0x7f0000001700)='\x00')
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
setresuid(0x0, r1, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0)

16:08:18 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  817.653910] binder: 2667:2673 ioctl 2270 200001c0 returned -22
16:08:18 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x1000000000000000, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:18 executing program 2:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)={0x9, 0x1d, 0x6, 0x4}, 0x2c)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001400)={r0, &(0x7f0000000000), &(0x7f0000000400)=""/4096}, 0x18)

16:08:18 executing program 2:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000580)={0x2, 0x4e20, @dev}, 0x10)
connect$inet(r0, &(0x7f0000ccb000)={0x2, 0x4e20}, 0x10)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000300000000000000000000009500020000000000"], &(0x7f00002bf000)='syzkaller\x00', 0x1, 0xb7, &(0x7f0000000440)=""/183}, 0x48)
r2 = socket$kcm(0x29, 0x1000000000002, 0x0)
ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f0000000000)={r0, r1})
sendto$inet(r0, &(0x7f0000000200)="9c", 0x1, 0x8051, 0x0, 0x0)

[  817.902386] binder: 2722:2726 ioctl 2270 200001c0 returned -22
[  818.067816] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based  firewall rule not found. Use the iptables CT target to attach helpers instead.
[  818.138342] binder: 2694:2699 ioctl 2270 200001c0 returned -22
[  818.204600] binder: 2688:2731 ioctl 2270 200001c0 returned -22
16:08:19 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000000280)=0x40, 0x4)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
ioctl$KVM_INTERRUPT(r0, 0x4004ae86, &(0x7f0000000340)=0x1)
ioctl$DRM_IOCTL_AGP_ACQUIRE(r1, 0x6430)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000380)={'nr0\x00', 0x1000})
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
write$P9_RCLUNK(r0, &(0x7f0000000180)={0x7, 0x79, 0x2}, 0x7)
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:19 executing program 2:
syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3)
syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0)

16:08:19 executing program 0:
r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/userio\x00', 0x220002, 0x0)
r1 = fcntl$getown(r0, 0x9)
ptrace$getsig(0x4202, r1, 0x4, &(0x7f0000000440))
pipe(&(0x7f0000000080)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
r4 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ppoll(&(0x7f0000000240)=[{r4, 0x1000}, {r2, 0x1020}, {r3, 0x500}, {r0, 0x210}, {r3, 0x2680}, {r3, 0x1}, {r2, 0x20}, {r3, 0x8000}], 0x8, &(0x7f0000000280)={0x77359400}, &(0x7f0000000340)={0x5}, 0x8)
write(r3, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
ioctl$sock_inet_SIOCGARP(r3, 0x8954, &(0x7f00000003c0)={{0x2, 0x4e21}, {0x6, @random="a2e2528664bd"}, 0x42, {0x2, 0x4e24, @rand_addr=0x9}, 'ip6tnl0\x00'})
ioctl$int_out(r4, 0x5460, &(0x7f0000000380))
vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:19 executing program 2:
perf_event_open(&(0x7f0000000d40)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
setitimer(0x0, &(0x7f0000000740)={{0x0, 0x2710}}, 0x0)

[  818.468119] binder: 2736:2740 ioctl 2270 200001c0 returned -22
16:08:19 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:19 executing program 2:
openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0)
unshare(0x2000400)
pselect6(0x40, &(0x7f0000007140), &(0x7f0000007180)={0x8}, &(0x7f00000071c0), &(0x7f0000007200)={0x0, 0x1c9c380}, &(0x7f0000007280)={&(0x7f0000007240), 0x8})

[  818.563777] binder: 2742:2750 ioctl 2270 200001c0 returned -22
16:08:19 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x700}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  818.653685] binder: 2722:2727 ioctl 2270 200001c0 returned -22
16:08:19 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

16:08:19 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x7000000, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  818.918674] binder: 2767:2770 ioctl 2270 200001c0 returned -22
[  818.928390] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  818.947832] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  819.103307] binder: 2736:2737 ioctl 2270 200001c0 returned -22
[  819.311827] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  819.391281] binder: 2742:2775 ioctl 2270 200001c0 returned -22
16:08:20 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x700}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:20 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:20 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000180)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000700), 0x100000ae, 0x8)

[  819.753175] binder: 2785:2789 ioctl 2270 200001c0 returned -22
[  819.775080] binder: 2781:2790 ioctl 2270 200001c0 returned -22
[  819.799762] binder: 2767:2793 ioctl 2270 200001c0 returned -22
16:08:21 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0xc501000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:21 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x3f000000, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  820.243337] binder: 2799:2802 ioctl 2270 200001c0 returned -22
[  820.506429] binder: 2785:2807 ioctl 2270 200001c0 returned -22
16:08:21 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x1400}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:21 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r3 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x13, r0, 0x62)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000180)={r3})
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r4=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r4+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000340)={0x5, &(0x7f0000000280)=[{}, {}, {}, {}, {}]})

[  820.558394] binder: 2781:2809 ioctl 2270 200001c0 returned -22
16:08:21 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
write(r1, &(0x7f0000000280)="ad9567555fd45024c8fee6ea842570367bf1", 0x12)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
ioctl$SG_SCSI_RESET(r0, 0x2284, 0x0)
ioctl$EVIOCGUNIQ(r1, 0x80404508, &(0x7f0000000440)=""/4096)

[  820.618769] binder: 2799:2804 ioctl 2270 200001c0 returned -22
16:08:21 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

16:08:21 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x187, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:21 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000500)=[@in6={0xa, 0x4e23, 0x3, @mcast2}, @in6={0xa, 0x4e23, 0x800, @loopback, 0x80}, @in6={0xa, 0x4e23, 0x6, @mcast1, 0x1}, @in={0x2, 0x4e22, @multicast2}, @in={0x2, 0x4e24, @loopback}, @in6={0xa, 0x4e24, 0x2, @mcast2, 0x7ff}, @in6={0xa, 0x4e24, 0x7, @dev={0xfe, 0x80, [], 0x1e}, 0x81}, @in6={0xa, 0x4e21, 0x5, @dev={0xfe, 0x80, [], 0xc}, 0x5}, @in6={0xa, 0x4e22, 0x5, @ipv4, 0x400}, @in={0x2, 0x4e23, @remote}], 0xf4)
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  820.731500] binder: 2815:2824 ioctl 2270 200001c0 returned -22
[  820.840597] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  820.847984] binder: 2826:2832 ioctl 2270 200001c0 returned -22
[  820.873969] binder: 2829:2834 ioctl 2270 200001c0 returned -22
16:08:21 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x1c5}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  821.464797] binder: 2815:2828 ioctl 2270 200001c0 returned -22
16:08:22 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x14}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:22 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
connect(r1, &(0x7f0000000340)=@pppoe={0x18, 0x0, {0x1, @remote, 'bridge_slave_1\x00'}}, 0x80)

[  821.634388] binder: 2826:2848 ioctl 2270 200001c0 returned -22
[  821.683987] binder: 2829:2852 ioctl 2270 200001c0 returned -22
[  821.750676] binder: 2853:2857 ioctl 2270 200001c0 returned -22
16:08:22 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x6400000000000000, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:22 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
fadvise64(r0, 0x0, 0x3, 0x7)
write(r1, &(0x7f0000000340), 0x10000014c)
bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000000240)=0x5, 0x4)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:23 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x64}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  821.945696] binder: 2862:2865 ioctl 2270 200001c0 returned -22
[  821.950925] binder: 2861:2866 ioctl 2270 200001c0 returned -22
16:08:23 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  822.230293] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  822.485681] binder: 2853:2859 ioctl 2270 200001c0 returned -22
16:08:23 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x58020000}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:23 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
ioctl$SG_GET_COMMAND_Q(r1, 0x2270, &(0x7f0000000180))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  822.720772] binder: 2861:2884 ioctl 2270 200001c0 returned -22
16:08:23 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x8701000000000000, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  822.794922] binder: 2862:2880 ioctl 2270 200001c0 returned -22
16:08:23 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000340)='/dev/userio\x00', 0x3, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0x404c534a, &(0x7f0000000240)={0x9, 0xfffffffffffffeff, 0x8})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  822.941844] binder: 2891:2895 ioctl 2270 200001c0 returned -22
[  822.974744] binder: 2894:2898 ioctl 2270 200001c0 returned -22
16:08:24 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x64000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  823.718236] binder: 2891:2910 ioctl 2270 200001c0 returned -22
16:08:24 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  823.834869] binder: 2894:2917 ioctl 2270 200001c0 returned -22
16:08:24 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x7}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:24 executing program 4:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000380)='/dev/nullb0\x00', 0x210041, 0x0)
ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f00000003c0)={0xab3e, 0x400, 0x5d6, 0x3, 0x1000})
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
fcntl$getownex(r0, 0x10, &(0x7f0000000440))
write(r2, &(0x7f0000000340), 0x10000014c)
getsockopt$bt_BT_POWER(r2, 0x112, 0x9, &(0x7f0000000180)=0xaa, &(0x7f0000000280)=0x1)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x1, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x32d, 0x6}, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r4=>0x0})
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f00000001c0))
ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000340)={'ip6tnl0\x00', {0x2, 0x4e23, @remote}})
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r4+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
ioctl$KVM_SET_ONE_REG(r2, 0x4010aeac, &(0x7f0000000480)={0xffffffff, 0xfffffffffffff000})

16:08:25 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000540)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r1, 0x2270, &(0x7f0000000240))
socketpair$packet(0x11, 0x3, 0x300, &(0x7f0000000180))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
ioctl$SG_GET_COMMAND_Q(r0, 0x2270, &(0x7f0000000280))
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  824.017244] binder: 2931:2936 ioctl 2270 200001c0 returned -22
[  824.024825] binder: 2929:2934 ioctl 2270 200001c0 returned -22
16:08:25 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x10000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:25 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  824.318772] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  824.360445] binder: 2931:2942 ioctl 2270 200001c0 returned -22
16:08:25 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
getsockopt$IP_VS_SO_GET_TIMEOUT(r0, 0x0, 0x486, &(0x7f0000000180), &(0x7f0000000280)=0xc)
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:25 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
write$FUSE_GETXATTR(r1, &(0x7f0000000180)={0x18, 0x0, 0x4, {0x2}}, 0x18)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  824.439882] binder: 2929:2934 ioctl 2270 200001c0 returned -22
16:08:25 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x8}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  824.591557] binder: 2962:2965 ioctl 2270 200001c0 returned -22
[  824.626631] binder: 2960:2968 ioctl 2270 200001c0 returned -22
[  824.669463] binder: 2966:2971 ioctl 2270 200001c0 returned -22
16:08:25 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:25 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x7}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  825.264864] binder: 2962:2965 ioctl 2270 200001c0 returned -22
16:08:26 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x8, 0x10, r0, 0x0)
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  825.400847] binder: 2960:2985 ioctl 2270 200001c0 returned -22
16:08:26 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x800000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  825.479764] binder: 2966:2988 ioctl 2270 200001c0 returned -22
16:08:26 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)

16:08:26 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$KVM_SET_IRQCHIP(r0, 0x8208ae63, &(0x7f0000000500)={0x1, 0x0, @pic={0x2, 0x0, 0x7, 0xffffffffffffff81, 0x5, 0x8, 0x0, 0x0, 0x5, 0x7fffffff, 0x4, 0xfff, 0x6, 0x8, 0xc1, 0xd2}})
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:26 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x3f000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  825.596007] binder: 2990:2994 ioctl 2270 200001c0 returned -22
[  825.681643] binder: 2998:3006 ioctl 2270 200001c0 returned -22
[  825.689674] binder: 3000:3007 ioctl 2270 200001c0 returned -22
16:08:26 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  826.283335] binder: 2990:2994 ioctl 2270 200001c0 returned -22
16:08:27 executing program 4:
r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$FICLONERANGE(r3, 0x4020940d, &(0x7f0000000180)={r0, 0x0, 0xcc76, 0x3, 0x100})
write(r2, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r4=>0x0})
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r4+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:27 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  826.500814] binder: 3000:3018 ioctl 2270 200001c0 returned -22
[  826.552623] binder: 2998:3021 ioctl 2270 200001c0 returned -22
16:08:27 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x3f00000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  826.594525] binder: 3019:3024 ioctl 2270 200001c0 returned -22
16:08:27 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x800)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
ioctl$VHOST_GET_FEATURES(r1, 0x8008af00, &(0x7f0000000240))
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:27 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x3f00}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:27 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x5802}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  826.758302] binder: 3031:3038 ioctl 2270 200001c0 returned -22
[  826.775492] binder: 3034:3041 ioctl 2270 200001c0 returned -22
[  827.333881] binder: 3019:3030 ioctl 2270 200001c0 returned -22
16:08:28 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:28 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  827.498488] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  827.508191] binder: 3047:3052 ioctl 2270 200001c0 returned -22
[  827.535430] binder: 3034:3043 ioctl 2270 200001c0 returned -22
16:08:28 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x6400000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  827.555821] binder: 3031:3054 ioctl 2270 200001c0 returned -22
16:08:28 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

16:08:28 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
lstat(&(0x7f0000000180)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, <r3=>0x0})
r4 = add_key(&(0x7f0000000340)='trusted\x00', &(0x7f0000000380)={'syz', 0x2}, &(0x7f0000000500)="1eebfb060a32077e5433bf8c7a6533327163c473eb8d534992fc7ff27f785b1fc70c8195a12b91f06d02209d824c7435f79950d9eaf5f19df766fff9ebb0cfa586fa26fdbf515ce240ad8171241f9cd0089c1c79cf7bc035aceeff3b396364612bdbf999dbbf16821ad5198d17dc9ca2990e17859a49c91d91b3cb9f8b4f6e3319f1b8953befcfcab7be9efef4fa48c21d39cb7eeabd85fd87dffd1c990cb1b298398339994848eec044ebed95a523a32c28018448582fe5a1c215d2ea152887abe83673abbc8c41dd4ffe6f9246e7d0f7ffe7b2fc374c2e0d92932fc8b7eae33fe3", 0xe2, 0xfffffffffffffffd)
keyctl$get_persistent(0x16, r3, r4)

16:08:28 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x4000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:28 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  827.770753] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  827.798905] binder: 3066:3075 ioctl 2270 200001c0 returned -22
[  827.811479] binder: 3069:3076 ioctl 2270 200001c0 returned -22
[  828.304939] binder: 3047:3082 ioctl 2270 200001c0 returned -22
16:08:29 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240))
stat(&(0x7f0000000180)='./file0\x00', &(0x7f0000000340))
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  828.555323] binder: 3066:3087 ioctl 2270 200001c0 returned -22
[  828.577585] binder: 3085:3091 ioctl 2270 200001c0 returned -22
[  828.639648] binder: 3069:3095 ioctl 2270 200001c0 returned -22
16:08:29 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r1, 0xc0045540, &(0x7f0000000180)=0x4)
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:29 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x3f00000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:29 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x14000000}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:29 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

16:08:29 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0xc5010000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  828.839994] binder: 3098:3102 ioctl 2270 200001c0 returned -22
[  828.875729] binder: 3100:3104 ioctl 2270 200001c0 returned -22
[  829.037579] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  829.336600] binder: 3085:3120 ioctl 2270 200001c0 returned -22
16:08:30 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
r0 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(0xffffffffffffffff, &(0x7f0000000340), 0x10000014c)
dup(r0)
r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vhci\x00', 0x4000, 0x0)
bind$llc(r1, &(0x7f0000000180)={0x1a, 0x309, 0x534, 0x7fff, 0x105, 0x1}, 0x10)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
ioctl$SG_GET_COMMAND_Q(r0, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:30 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5802000000000000}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  829.609995] binder: 3123:3124 ioctl 2270 200001c0 returned -22
[  829.620604] binder: 3098:3127 ioctl 2270 200001c0 returned -22
[  829.639254] binder: 3100:3128 ioctl 2270 200001c0 returned -22
16:08:30 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0xc501}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:30 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x6400000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:30 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
ioctl$KVM_SET_PIT2(r2, 0x4070aea0, &(0x7f0000000240)={[{0xab, 0x800, 0x80000001, 0x8, 0x800, 0xfffffffffffffbff, 0x0, 0xc470, 0x8e1, 0x8001, 0x1, 0x1f, 0x7fff}, {0x5, 0x3f, 0xe6, 0x401, 0x401, 0x5, 0x40, 0x1, 0x4, 0x7, 0x7fff, 0x3, 0x1}, {0x5, 0xce14, 0x1ff, 0x6b60, 0x2, 0xc8e1, 0x7fffffff, 0x4, 0x8, 0x200, 0x5, 0x3ff}], 0x6})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  829.842674] binder: 3140:3146 ioctl 2270 200001c0 returned -22
[  829.851500] binder: 3142:3147 ioctl 2270 200001c0 returned -22
[  829.882951] binder: 3142:3147 ioctl 4070aea0 20000240 returned -22
16:08:31 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  830.310864] binder: 3123:3133 ioctl 2270 200001c0 returned -22
16:08:31 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
ioctl$SG_GET_COMMAND_Q(r1, 0x2270, &(0x7f0000000480))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  830.417097] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  830.638928] binder: 3140:3159 ioctl 2270 200001c0 returned -22
[  830.645641] binder: 3142:3162 ioctl 2270 200001c0 returned -22
[  830.652255] binder: 3142:3164 ioctl 4070aea0 20000240 returned -22
16:08:31 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:31 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x64000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:31 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
ioctl$RTC_UIE_OFF(r0, 0x7004)
socketpair(0x2, 0x80803, 0x1, &(0x7f0000000540)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$TCSETAW(r3, 0x5407, &(0x7f0000000580)={0x1, 0x8, 0x5, 0x8b, 0x7ff, 0x8, 0x401, 0x3, 0x101, 0x3})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
readv(r2, &(0x7f0000000240)=[{&(0x7f0000000180)=""/19, 0x13}, {&(0x7f0000000340)=""/165, 0xa5}], 0x2)
select(0x40, &(0x7f0000000280)={0x8001, 0x4430d06b, 0x8, 0x1, 0x4, 0x2, 0x1, 0xfffffffffffff800}, &(0x7f0000000440)={0x5, 0xc734, 0xffffffffffffffff, 0x13b, 0x6, 0x1, 0x80000000, 0x5}, &(0x7f0000000480)={0x6, 0x4e0, 0x5, 0x7f, 0xffffffffffffc3b2, 0x101, 0x100000000, 0x3b}, &(0x7f0000000500)={0x0, 0x2710})
socket$can_bcm(0x1d, 0x2, 0x2)
recvmsg(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f00000005c0)=""/30, 0x1e}, {&(0x7f0000000600)=""/212, 0xd4}], 0x2, &(0x7f0000000740)=""/189, 0xbd, 0x3}, 0x10020)

16:08:31 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x10}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  830.891775] binder: 3170:3179 ioctl 2270 200001c0 returned -22
[  830.899750] binder: 3173:3180 ioctl 2270 200001c0 returned -22
16:08:32 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x583000, 0x0)
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:32 executing program 2:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r0 = socket$nl_route(0x10, 0x3, 0x0)
pread64(0xffffffffffffffff, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  831.523472] binder: 3187:3192 ioctl 2270 200001c0 returned -22
[  831.549716] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  831.677379] binder: 3173:3185 ioctl 2270 200001c0 returned -22
16:08:32 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

16:08:32 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  831.731252] binder: 3170:3198 ioctl 2270 200001c0 returned -22
16:08:32 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x87010000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:32 executing program 0:
r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r2, &(0x7f0000000340), 0x10000014c)
ioctl$FICLONERANGE(r2, 0x4020940d, &(0x7f0000000180)={r0, 0x0, 0x8001, 0x9, 0x2})
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000440)=<r4=>0x0)
perf_event_open(&(0x7f0000000380)={0x4, 0x70, 0x8, 0xffffffff, 0x1, 0x7, 0x0, 0x3, 0x1a0, 0x1, 0x4, 0x7d5106da, 0x89ab, 0x4, 0x2, 0x9, 0x5, 0x40, 0xffffffff, 0x0, 0xfffffffffffffffa, 0x1, 0x800, 0x3, 0x3, 0x2, 0xff, 0xd58, 0x5, 0x7, 0x7ff, 0x61, 0x80000000, 0x100000000, 0x100000000, 0xffffffffffffffcc, 0xeb7b, 0xfffffffffffffffa, 0x0, 0x3, 0x0, @perf_bp={&(0x7f0000000340), 0x1}, 0x400, 0x5, 0x3, 0x2, 0x4b, 0x71f4878e, 0x4}, r4, 0xe, 0xffffffffffffffff, 0x8)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
name_to_handle_at(r2, &(0x7f0000000240)='./file0\x00', &(0x7f0000000500)=ANY=[@ANYBLOB="a3000000fdffffffb0956e646e6aa4714d18c1a469a4d1cc38390744792285ab06ef085e21e44ba6c3326d092cfe527d10b0a9878f41e1b046cb26ab52f0debd6f492786b120fffdfa9a3dace57aefaf64ef0adc6e21b2af298d8d4397e1c84ffb24de8f58bc8774b721060a85594b398a9036b8f51774eefbf601960386407d31e100467be848dfca4cdae7eba3f53070fd0548cafd630099175ec9807bcf8f4d6b8f114c0dc8101e31e6575f150ebb99ab6978a90f3fa3c9e6c3"], &(0x7f0000000280), 0x1000)

16:08:32 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0xc501000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  831.877560] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  831.935199] binder: 3208:3221 ioctl 2270 200001c0 returned -22
[  831.974843] binder: 3210:3225 ioctl 2270 200001c0 returned -22
[  832.308518] binder: 3187:3231 ioctl 2270 200001c0 returned -22
16:08:33 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
openat$vnet(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vhost-net\x00', 0x2, 0x0)
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  832.559890] binder: 3234:3236 ioctl 2270 200001c0 returned -22
16:08:33 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x8000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  832.724770] binder: 3210:3242 ioctl 2270 200001c0 returned -22
[  832.736573] binder: 3208:3245 ioctl 2270 200001c0 returned -22
16:08:33 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5802}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:33 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000240)={0x0, 0x10000000000}, &(0x7f0000000140)={0x8, 0x2000000000000000, 0xfffffffffffffffd}, &(0x7f0000000180)={0x77359400}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:33 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x187}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:34 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  832.982922] binder: 3255:3260 ioctl 2270 200001c0 returned -22
[  833.005163] binder: 3257:3261 ioctl 2270 200001c0 returned -22
[  833.087952] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  833.250188] binder: 3234:3236 ioctl 2270 200001c0 returned -22
16:08:34 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  833.453083] binder: 3257:3261 ioctl 2270 200001c0 returned -22
16:08:34 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x700000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  833.583153] binder: 3268:3270 ioctl 2270 200001c0 returned -22
[  833.665344] binder: 3271:3275 ioctl 2270 200001c0 returned -22
16:08:34 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x3f000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:34 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700000000000000}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  833.733436] binder: 3255:3264 ioctl 2270 200001c0 returned -22
16:08:34 executing program 0:
r0 = syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x10001, 0x10000)
ioctl$KVM_GET_SREGS(r0, 0x8138ae83, &(0x7f0000000500))
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r2, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000180))

16:08:34 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  833.918312] binder: 3286:3290 ioctl 2270 200001c0 returned -22
[  834.083799] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  834.249369] binder: 3268:3298 ioctl 2270 200001c0 returned -22
16:08:35 executing program 4:
r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000280)=[{&(0x7f0000000500)}], 0x1000000000000211, 0xfffffffffffffffa)

16:08:35 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  834.437489] binder: 3271:3277 ioctl 2270 200001c0 returned -22
[  834.473945] binder: 3300:3302 ioctl 2270 200001c0 returned -22
16:08:35 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x7000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  834.569469] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  834.592175] binder: 3305:3310 ioctl 2270 200001c0 returned -22
16:08:35 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0xc5010000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:35 executing program 0:
r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000180)={<r1=>0xffffffffffffff9c})
r2 = syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00')
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000500)={{{@in6=@dev, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f0000000340)=0xe8)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1f, &(0x7f0000000440)={@mcast2, <r4=>0x0}, &(0x7f0000000480)=0x14)
getsockname$packet(r0, &(0x7f0000000600)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000640)=0x14)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000680)={{{@in6, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0}}, {{@in6=@mcast2}, 0x0, @in6=@mcast1}}, &(0x7f0000000780)=0xe8)
sendmsg$TEAM_CMD_NOOP(r1, &(0x7f0000000a00)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000009c0)={&(0x7f00000007c0)=ANY=[@ANYBLOB="cc010000", @ANYRES16=r2, @ANYBLOB="000426bd7000fddbdf250000000008000100", @ANYRES32=r3, @ANYBLOB="b00102003c000100240001006c625f74785f6d6574686f64000000000000000000000000000000000000000008000300050000000c000400686173680000000040000100240001007072696f72697479000000000000000000000000000000000000000000000000080003000e000000080004000200000008000600", @ANYRES32=r4, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f636f756e740000000000000000000000000000080003000300000008000400060000003c000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b0000000c0004007f0001000300000040000100240001006c625f686173685f737461747300000000000000000000000000000000000000080003000b0000000800040008000000080007000000000040000100240001006c625f706f72745f737461747300000000000000000000000000000000000000080003000b000000080004000600000008000600", @ANYRES32=r5, @ANYBLOB="3c00010024000100656e61626c656400000000000000000000160000000000000000b9ee42f2db26a9c50300060000000400040008000600", @ANYRES32=r6], 0x1cc}, 0x1, 0x0, 0x0, 0x4}, 0x40)
pipe(&(0x7f0000000080)={<r7=>0xffffffffffffffff, <r8=>0xffffffffffffffff})
r9 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
openat$urandom(0xffffffffffffff9c, &(0x7f0000000380)='/dev/urandom\x00', 0x40, 0x0)
write(r8, &(0x7f0000000340), 0x10000014c)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000ac0)={<r10=>0xffffffffffffffff, r7, 0x0, 0x5, &(0x7f00000003c0)='team\x00', 0xffffffffffffffff}, 0x30)
perf_event_open(&(0x7f0000000a40)={0x2, 0x70, 0x7, 0x0, 0x8, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, 0x8000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0x0, 0x0, 0x0, @perf_config_ext={0x9903, 0x5}, 0x0, 0x0, 0x0, 0x7}, r10, 0xfffffffffffffffb, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r9, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r7, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:35 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14000000}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:35 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  834.852014] binder: 3323:3328 ioctl 2270 200001c0 returned -22
[  834.867241] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:08:36 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  835.235174] binder: 3300:3306 ioctl 2270 200001c0 returned -22
[  835.247814] binder: 3323:3328 ioctl 2270 200001c0 returned -22
[  835.277103] binder: 3305:3312 ioctl 2270 200001c0 returned -22
16:08:36 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
request_key(&(0x7f0000000180)='pkcs7_test\x00', &(0x7f0000000240)={'syz', 0x2}, &(0x7f0000000280)='wlan1mime_type\x00', 0xfffffffffffffffb)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  835.337265] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:08:36 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x8701}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:36 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x3, &(0x7f0000000180)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  835.487549] binder: 3337:3345 ioctl 2270 200001c0 returned -22
[  835.499694] binder: 3340:3346 ioctl 2270 200001c0 returned -22
[  835.545663] binder: 3343:3347 ioctl 2270 200001c0 returned -22
16:08:36 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:36 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

16:08:36 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0xc501}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  835.967581] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  836.276936] binder: 3337:3365 ioctl 2270 200001c0 returned -22
[  836.317857] binder: 3340:3369 ioctl 2270 200001c0 returned -22
[  836.331573] binder: 3343:3370 ioctl 2270 200001c0 returned -22
16:08:37 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$UI_BEGIN_FF_UPLOAD(r1, 0xc06855c8, &(0x7f0000000240)={0x4, 0x5, {0x57, 0x7f, 0x6, {0x62, 0x9}, {0x1000, 0x840}, @ramp={0x4, 0x100000000, {0x10001, 0x4aa617df, 0x0, 0x81}}}, {0x55, 0x9, 0xfffffffffffffffb, {0xfffffffffffff644, 0xffffffffffff159f}, {0x7, 0x929}, @const={0x400, {0x1, 0x9, 0x3, 0x10001}}}})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:37 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/userio\x00', 0xffffffffffffffff, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff, 0xfffffffffffffffc}, &(0x7f0000000100)={0x0, 0x8, 0x0, 0x0, 0x0, 0xf5c}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f0000000180), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:37 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x1000000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:37 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  836.524321] binder: 3372:3379 ioctl 2270 200001c0 returned -22
[  836.545604] binder: 3375:3382 ioctl 2270 200001c0 returned -22
[  836.557809] binder: 3377:3383 ioctl 2270 200001c0 returned -22
16:08:37 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x700}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  836.631349] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:08:37 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:38 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  837.218626] binder: 3375:3382 ioctl 2270 200001c0 returned -22
[  837.305958] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  837.315156] binder: 3372:3405 ioctl 2270 200001c0 returned -22
[  837.351602] binder: 3377:3407 ioctl 2270 200001c0 returned -22
16:08:38 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000180)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
open_by_handle_at(r0, &(0x7f0000000500)={0x1008, 0xfffffffffffff1f3, "e7b968cc8b4ec3f863d1589730c6d62e18dbb704a824d96320acd5c0e23dfdb5907b64471e7c82b7e8a9d1d3b1d3269dddf1cacd3064feae27ff8fbb4cc51c11fcb8a5ecd678cb43e95b49468173d2023e3720db65a36020fe0e1819d7f1582a89116c9b540d595536032d06addbb55a5d75baacab66bc3adb10358a10ac21550cba2278b0169030b17364049065479ca265c5cba6d4af216dfbb7899660204ef9ce06933fa0f8c04a10ae9079edbe18f1e295adf576a253679003c9701cab7f6e226fabf424904083c715de4b7ca8c8b9deef8f85ef08e0a22305b5bd9132d1912280c529761792d718c0087a42f380bfb0354fce4fe8932feef8909cdd0bd50b5af487fc0ad298bad3a687270cf4f0ada1496e52802523285174dd4bd0972a58bec342c2597d0c0c814857500c962f280d9f26920443f86fd1f507b50e4a82e3c7ad155e67db5645d2a51b18091eae1dc201a422e3c2ca9de74dc71a4b6a0d8bdbecd33e75541ad319e3365e69a5d7595f9a38dffba08e5f2ede2953c4c00b36dcd36aa0809452aa39876d5e238fb871e530e6a4383cc9bd49aad0d122f089626d9d084f35dd5e23582d0f653e341e0e5791a8d3f216e8241942b4e8ef68d0842c1b2534b1b213e29e3f2b10406824a8b3052069c5182e964d47842fbead702c7b2c1d95f61b2a8d5049d9092ae9a1b0666886b6d03fcdfe4504820d113bd256783b13c28b43d832bc4352138c94f5da818ef69388dfa4fe738d78e5c785efd7bc07159253c31a3fb113e83f6408cc2a50e9b7be09b2e5455a137816bff5843c08eabb7570b1d31ab86dd99bb59d2cd0918e8fed2efb799493c0f6ae4d6b0567858e8cf3e5db269bf57f7d8ef07a82e843df94f718d975c7a8d9c6745c1e3553bda7b8b461b2893830028ffd79619dfc00aa03cf9f2ebb523af4d4337b358c7117d1065e707b252506902b44a3242ec0834902abb056db6d3b720501bd68be307af2e6b62d484dec521ff08f9e49c6463fd8c78bf1ec8e24182850d7329574deca2cb636f9f6caa1fa51d7e9765b4fd6f146d3f24518882644dadf3a2a78e26fb7faa726ae908adeacd57e6fcb2a2db4eb25318a64dfaa693585b46fbe0b03184a2c821a23c9636b1451d9f48e8f3ecdc74c8c049a33663d4567d179713599efaa15132dd59c89fd06628dbb0a40b4357257b80a5e04e0c113490ab6a68ba886c4198b99bfc7b64c3b1ae703a33e18a7b0f3e10c1908047710d3ca4e251bd340ac86a1ee7525e5f60fff29d20a8b4643f3e439bdf859225a2e37b79e47fc4565aa16086aaaf5748df8550ddd5129524e72bcf4e9213a190c72ceaa77aeb0b009ac56887800ca29f45072d06ea695c11ecab3d1e256bca77bca7b72b450a97fa219a97847204497c7ac85877466ea07590fb1d1ef73c3b4134bcb23fada00bebd74f99609cfa43ce153543f1e6f48863a0160ce9a3d97b5a32060be6dd89bae59d0115ae33c78c248a96196f5d7e2b3b71d6b954832515fb0b2988198a2febcb9fae4e18320c5c0b7861e71fb6213e5005831cce36ca39ace0288709ff6dc962c708519444e36369d05655c964b9c662a14bbac147963c629dab300ae889215d5aec68534d03348b68bf8132e56f245232a6344aba05a6a40098715e9c88ec84f2dae5aaa6ecc74dac807d36d3b74ccd6f43a043766238a084eef045a485790d8ddfeafd9c547d50f8bf05d9bf23099f3e8414da1517591d1ce16e62d8ddce87fc683673395e0f4d87d5a78ec16eea6804d1d791876dc96d2bb80b802a9f35c1e2b1610416a98e8baa3770fc71f08c0410776a5465fab1178535955fc862d78012ce816fce28b8407c211f05db69ee1ee31979d4bd0ca9cda71f938c88b4cc17ee3d4a18f3efdf25a028a82f7f3f1d5ad00cdd7279ba8eb059166589b7345839dfbff577b74f78146a481f73bc923918252a20f7e23f8a06c22b9d51ba24eb4b15697d5cfddddcfda7bb4a88e3ec65fdc213acb206737708d1e5c718564f0e1ef393d901a472a5870a397421f297cc43aa6e6b9b8ae4e8d8723d3bd79f9e4fb91ef7fd3c3fe1c70c52236f2a89961fe41ccbf0bc8e2cabfe6e2563e82b6c57145798a30c3c6366ba1d1f8e9f0b8d420db64ff40608cb73a220f35f8c0e85b5351965588230eeb6a8f28c85d0a2bfc41ceda1fff317c84a55b894eefbd77cf126d978fefa511889f61ea24c8fc92484b42b4fecb6db88a074f8335c640063641fb98aadfbd8f67914860f86d9fb392a5d12fb5c31552f2103e2525845cf7b1af49a796d7a7cbd78a3e59d184c7e3fa7f85fdc99a9513299aa1a763eecfd7787d6194ac854cf6e64149cdb8aeadfe5506d21cece008203d8d8173fc4c4a8dfa805ac103bdebe528eef7ab8f57d49849f039200621fdbde1f85bf8133639fcc0a935bfc02b07efe5eb93ed806a09155f0e0f4c9b944d27c4464a7923e57a3aaf36ac0852f3dcfc2a814adef6859574fbe99ba8be35d11d31767529e7e1b17f80234d89bfaaae2c00910329e3a23334b431488b9a8dee4798f3b87f2c23a662bcd51fcd8af9c5795193314ce6e9e1ee11c3fbafe530401aa2596e78d05155d87ac811c51c31604dac6285a9fc21dc2fadb68e1911c2569926394dc819fa17920fb1d1e73ff62ead3badb4b634eca365b8f2b6c04ddc3652dd4fdd97afcd0bf55cfbac6d13c57d2098305cb397c0a56db966aef931f8551693c0b24206813af9c0d3e9a6be7c1e0513978f0cf6f4403c62a88128992a5994d02d805e042acb1a1ce7ec39788295f43e289ddcef4e005d8d43fcd7cf3f4e008f520e4cc29b0c58ca1165a7226a712af79fc2fe21b123419a8c58e7d4725b136cb79fa7507be98656eb23d839d87dfb76a2190c6b060b2e43bbca34437859fdba88b5d7e75c9b182f4521c85f5e8c0bb75e16ee71d5bd0761fea1ded953dc90393776878a69a0a65f563d85dfa8f77686442b6662c00a29f8552d11067cbe1788cf72baa2bc093882ff4de4a134d04204b6611625232613d4de8cf1e77172b252973702a5f2647377268a46aff3edbef23f3a0260ab6054419fb0aa39817e0727e7b49179d8c7dbafb4fe59d9ef87bda8db20abb0a535cc9f91029e6ad3cf111651bdb59052ecf1ebac4f17ff40f6311e0f8751e3cc0ec69aa1e4b6d40d95be8fdfd000cabf2578daefd7a85d1b353441d81fc7fb709a625e9d2d51872a8baeb87913bf4b6b3f1ec2f44e5ba5bf58840164632efe24143377900c29fa37955ff4d19a2c43a503ccd8797b8a5f4a673ee94d753641f072fb263f92bc5cad86515201d739d3ec106c3e0e06f3d2b54f061184166c0d20dd9c8ffafffbbbb0c629edfb6d124813408b4c46dfecbcb4a9bfa98bf8555cd6f1be6acb8ae872907c6935bc358e3acc86e2e9f4ac16eaaceac44683e31eec86e0763772d57077ef0d901860b70a53b583da1c5364ccdc99ce2b69ac91b0b3560775923dce0f1b2f88aef7f6a339a6c738457e7178429598800bbfca07f2a234b8a5e4a26d9df33593d481fca7361feec16ac2460ff87c512e2defeb9367c0702ddede89e808a1b232c9f5f41b2648366a5a354843eccea6309e46488509b38ba8a1c6431de786fe5429b181c26859ca3e301a63ca84ab8f2cd38791ad8a7b4303910fd4504ac9ae4bf790f79a37d24e483d0c8be7b427ced77df114fff9ebf72eabf996f5da662dc8bcbeb02b66e8f6a63487b2d339d338ab3dcb0708d91954418446177a236415b163475f62e0b1f8ee21048b93ea46fe9b33c74caba664f7d3e7e08ad2856ac63d24fcbd0b6e878c2d3fcd74f8b5196f6694d443c719cb5edf7c304a656b489ab156fadb67346dbd8e8a74df226f44ec718c64590cc95dccdb0d230a625fb3084ad3a2f7cdade407a82fcb6fe91c90e1f48513bbff07e27f43030972f14879fa585615a37d0c40884cdc93dce2c1f72970daa415a0cbcb7e0209eb38e7aebf9db847f003fd165ca07d934e165b1c287d2f733939d3a6346790d9d2ff199e92414ebbb35792784aa1bbdd80e67dae66ffe38cd0b0bf96a86cb0a7da3add6fdfb27d90f604d44a652a15f1a047f19a9abfb1ca2022df2a8afc2a1dc593dccd7068989f0e66344c7e1c2019fdc1a1da6dcc549bb0bc96a4d024f314619648f097cd4fee349f867f93746412f5e77ea43bb9cd4ea8122a188f6529bc3acc6fb366e098539042550f2d0ce92cc21036211ff15a5be2f330c30a5f7bf956ffc89400c056a74999e84795e4afc401d0214c0c9ecd91578615ba33c47ddfa2a1df600c9e720de5cbc652bd655960566e3ecee24825c103a754316348fdde1a61ecfef180d767d1484f469204c3817b647b7d4640a87811f8f5a04a14456236bbb34f51bb51b170e070f295f6d2521fe2f895efc06f3ea746bf53e977809a6769ef1e6198c8d881ebd607cc12c7e6ef1d26ab150f51c3d87c0e88d60dccdc35bd2e7899efe8634ce38b39f4c92c45818f18885d9c3c1f31bcf1af8f82ad2fee4e0c6b88b8c3e4924bf468f21961009f494b6fbe6f4b400334987176c11f5da8ebc2e5d203758cffd379120f3699b06f0d0543ec111d635b991b6e646e9030433d339b36d155a1ba45d3e2bbf8807f84e9e90f929bf31df4f4404c3e69cb904fd4558c1349c2c94e62f59d4760044a539b57f8d072324750ade492b19ce289aabbd98769939f1f9d6adbc1eef1d271be3cd130ea630d3cc1dd12ad136e12e68cddc32e8591134b6fdfa5daa7f24411d11fd844304640646c6fe85271d8f9dcc5112a7290481685e2245300db35531376492be647d1736dee22b7a285cf1cb21ed7cbe648ce5741c7d6926a2853a11af390d957f5c963219d1f89c0a185a2ff449b2daac9ac58ef77c3353b514b5f2e166bfc726a6c45949551e19cd5a3c13b3a7cb82a213cff4245d77ffd9c8cb2bfa49a865ca484ce96afdffd030e39545f444cdb76ac84b12bca8fe59a8b84888df1e418a1678a6c065d50e9a406af0de216ccda81dce28a28bd7a74d4c1a27bc177cd799045e1986bdc787a8402701d3e17c34ebdd868c6c389a6bc129e9ac8a59ae1dcf979c3ee8213ce2de62069eb287086d1d1f1410b56d6a925a891c33213b7ad29d0cc53226ad18599d99f24d1e7b3b080e4e2a353262f33c2a5b8cb384f4b03df0dbab50a192c3655b648d8136e7563481c671f3944b53e6849a74950971699541226f146683abc76dd7f6eb5d7d6a7df2b12467ad3020d111eb673d8c2e13d301d6b38eaff3637161eb3d1e5c797058a5d0b3345c77f6c59aeae9c89b1596028cd3a73ffd7be535f560a6869e77cd312204c8ce81a7a3a18f2cd3b7ed5ee5dd43812e8a4e2e8bb3f751c38b477dbfe50a1592b6ffe5151b9dcbe68afad2b613c99f027238d5d55ecea95e00024ad39b24b94bb6e973f558a8aba9c218d4c1c063bcff5cc225ca51520812eca0be3cd7c12cace64a9c7e6b1e9dfa1e96f125a95646de55fff4b17f563115d5381e80c3a3d1a8f1d71cdc622e03aa36f25820aa9515715eaa4d314c573429a55e20b248a49a15ad5a78308f744a81b4ad2aa46933380745cfa22c8eb7cb8b92fdc74dac8daa33a3cb648df961dd0c38086f7aeeb107153aae743eb5f83f7b0509dd40bafc16582bdcc248a38f25306e45c10c2ecd22e7fa034e9370edf7dca4ea8882546709c91b4c7ad51be88a9ac835c77552a07e9afae853903fab978703ac3701c089de46bd81ca61df790c07c66cae2d7"}, 0x2c000)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5)
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:38 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r1, 0x2270, &(0x7f00000001c0))
getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000500)={{{@in=@multicast2, @in=@remote}}, {{@in6=@loopback}, 0x0, @in6=@remote}}, &(0x7f0000000180)=0xe8)
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:38 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x800000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:38 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x1c5}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  837.567810] binder: 3412:3414 ioctl 2270 200001c0 returned -22
16:08:38 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  837.646418] binder: 3417:3425 ioctl 2270 200001c0 returned -22
16:08:38 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  837.854324] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:08:39 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800"})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  838.143746] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  838.179709] binder: 3412:3414 ioctl 2270 200001c0 returned -22
16:08:39 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
ioctl$TIOCEXCL(r2, 0x540c)

16:08:39 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(0xffffffffffffffff, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  838.465227] binder: 3417:3444 ioctl 2270 200001c0 returned -22
16:08:39 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x7, 0x7f, 0x0, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x400, 0x0)
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  838.541808] binder: 3446:3452 ioctl 2270 200001c0 returned -22
[  838.572117] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:08:39 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x6400000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:39 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x40000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  838.658552] binder: 3446:3460 ioctl 540c 0 returned -22
[  838.675892] binder: 3455:3463 ioctl 2270 200001c0 returned -22
16:08:39 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  838.733675] binder: 3461:3466 ioctl 2270 200001c0 returned -22
16:08:39 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  839.180353] binder: 3446:3452 ioctl 2270 200001c0 returned -22
[  839.246096] binder: 3446:3460 ioctl 540c 0 returned -22
16:08:40 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x8, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000180)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  839.421039] binder: 3455:3481 ioctl 2270 200001c0 returned -22
[  839.496225] binder: 3479:3485 ioctl 2270 200001c0 returned -22
[  839.526352] binder: 3461:3489 ioctl 2270 200001c0 returned -22
16:08:40 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
ioctl$TIOCOUTQ(r1, 0x5411, &(0x7f0000000140))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f0000000180)={0x64, 0x10}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x400000000000}, &(0x7f0000000240)={0x8}, &(0x7f0000000280)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x200, 0x0)
fstat(r1, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
getresuid(&(0x7f00000005c0), &(0x7f0000000600)=<r5=>0x0, &(0x7f0000000640))
r6 = geteuid()
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000940)={0x0, <r7=>0x0}, &(0x7f00000006c0)=0xfd3b)
ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40042409, 0x0)
getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000700)={{{@in=@loopback, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r8=>0x0}}, {{@in=@rand_addr}, 0x0, @in6}}, &(0x7f0000000800)=0xe8)
syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000340)='./file0\x00', 0x1, 0x2, &(0x7f0000000500)=[{&(0x7f0000000380)="9acbffb602aa20e68359d833c1a678fbc1fad7c314a7784c2e38e6f4a7ac85b0dc0100e79459f3a62364c9980504501f566709c61fbf09eb4d13da43afdac6931eca5035ba9ca3e9a820354f25fb574cdfa5e2a997b68a848e30687685df6b8a3313752c836881efcf59d0c0eecee7a45cf3ef301849fcaa1627b3", 0x7b, 0x10000}, {&(0x7f0000000440)="bf4e77c0fc1f9cf792040ab99a29abfa21793589c4cf5c8d12db33045dd8b812bed89a8de86ba8bae476f2e02b0d612f20d482b45f6fbc61305cbe7e4f836f33bb86cca1f496d90219f6775a51a9fd9299432b2d01e5f6", 0x57, 0x4}], 0x1280008, &(0x7f0000000840)={[{@gid={'gid', 0x3d, r4}}, {@disable_sparse_yes='disable_sparse=yes'}, {@errors_remount='errors=remount-ro'}, {@errors_recover='errors=recover'}], [{@fowner_gt={'fowner>', r5}}, {@smackfshat={'smackfshat', 0x3d, 'securityself,)'}}, {@uid_gt={'uid>', r6}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'em1uservboxnet1'}}, {@euid_lt={'euid<', r7}}, {@uid_gt={'uid>', r8}}]})

16:08:40 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x1000000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:40 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x10000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  839.673369] binder: 3491:3499 ioctl 2270 200001c0 returned -22
[  839.716878] binder: 3496:3501 ioctl 2270 200001c0 returned -22
16:08:40 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:40 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  840.078724] binder: 3479:3485 ioctl 2270 200001c0 returned -22
16:08:41 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000500)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x3, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
accept4(r0, 0x0, &(0x7f0000000280), 0x0)
syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x2)
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
write$USERIO_CMD_REGISTER(r0, &(0x7f0000000440)={0x0, 0x5}, 0x2)
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
arch_prctl(0x1003, &(0x7f0000000340)="9344ba587c1785748bcb32a347707d3feacde68a9eaa952dc6a50e3be1b93542a2aa33377892cdb3c57ad91a0591174e2f009ba0b4196a766f9cea037a4080ca67755ac058df53f167c356725281b628ce626542dc376d61e3faef83242e3df65f83590357813d4d6483b1924b22b12d50331b00a13973d6cf6a0f54bd3caa61a643fecf6d347cee53673f70aae19c2a0930fd4a52b1c6d0d5c828bcc4335ef1e1301c78d054e2e3b87ccc588f")
ioctl$RTC_SET_TIME(r1, 0x4024700a, &(0x7f0000000480)={0x6, 0x29, 0xc, 0xd, 0x2, 0x100, 0x3, 0x56, 0xffffffffffffffff})

[  840.413409] binder: 3514:3516 ioctl 2270 200001c0 returned -22
[  840.429540] binder: 3491:3518 ioctl 2270 200001c0 returned -22
16:08:41 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x10}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  840.558853] binder: 3496:3521 ioctl 2270 200001c0 returned -22
16:08:41 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000240)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:41 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:41 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x64}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  840.773928] binder: 3528:3534 ioctl 2270 200001c0 returned -22
16:08:41 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  840.867957] binder: 3535:3539 ioctl 2270 200001c0 returned -22
[  841.153580] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  841.192711] binder: 3514:3546 ioctl 2270 200001c0 returned -22
16:08:42 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
getresuid(&(0x7f00000003c0)=<r4=>0x0, &(0x7f0000000440), &(0x7f0000000480))
stat(&(0x7f0000000500)='\x00', &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in=@rand_addr, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0}}, {{@in=@loopback}, 0x0, @in6}}, &(0x7f00000006c0)=0xe8)
ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000700)=r6)
fchownat(r1, &(0x7f0000000380)='./file0\x00', r4, r5, 0x100)
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f0000000180)={<r7=>0x0, 0xb5b4}, &(0x7f0000000280)=0x8)
setsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000340)={r7, 0xfff, 0x1, 0x2}, 0x10)
ioctl$sock_SIOCGIFBR(r0, 0x8940, &(0x7f0000000740)=@generic={0x2, 0x6})

[  841.476919] binder: 3550:3553 ioctl 2270 200001c0 returned -22
16:08:42 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x700000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  841.544042] binder: 3528:3556 ioctl 2270 200001c0 returned -22
16:08:42 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f00000000c0)={'ah\x00'}, &(0x7f0000000100)=0x1e)
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  841.640815] binder: 3535:3565 ioctl 2270 200001c0 returned -22
16:08:42 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1400}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  841.722414] binder: 3566:3572 ioctl 2270 200001c0 returned -22
16:08:42 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x10}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:42 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x20, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}}, 0x20}}, 0x0)

[  841.924368] binder: 3576:3579 ioctl 2270 200001c0 returned -22
[  842.036073] binder: 3550:3553 ioctl 2270 200001c0 returned -22
16:08:43 executing program 4:
pipe(&(0x7f0000000280)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0x0, 0x0)
ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
r4 = getpgid(0xffffffffffffffff)
ptrace$setsig(0x4203, r4, 0x7ff, &(0x7f0000000480)={0x38, 0xfffffffffffffff9, 0x2, 0x7fff})
ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000440)={0x3, 0x0, &(0x7f0000000180)=""/52, &(0x7f0000000340)=""/151, &(0x7f0000000500)=""/240, 0xd000})

[  842.288229] binder: 3586:3588 ioctl 2270 200001c0 returned -22
[  842.489746] binder: 3566:3592 ioctl 2270 200001c0 returned -22
16:08:43 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x800000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:43 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  842.765768] binder: 3576:3601 ioctl 2270 200001c0 returned -22
16:08:43 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
readv(r1, &(0x7f0000000440)=[{&(0x7f0000000500)=""/4096, 0x1000}, {&(0x7f0000000240)=""/125, 0x7d}, {&(0x7f0000000340)=""/114, 0x72}, {&(0x7f0000001500)=""/190, 0xbe}, {&(0x7f00000015c0)=""/204, 0xcc}, {&(0x7f00000016c0)=""/221, 0xdd}, {&(0x7f00000017c0)=""/4096, 0x1000}, {&(0x7f00000027c0)=""/210, 0xd2}], 0x8)
ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc008ae05, &(0x7f00000028c0)=""/164)
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
pwritev(r2, &(0x7f0000002e40)=[{&(0x7f0000002980)="fbf01c6f99b9f2a35a6134a2d3e6c7178b6c43b9981219c3df50ef509cd3244130804280f85d1781b5061630e8dfd32da0c618f9b13b4078fe18a699fabeb06b4aff66654d9f2a0a371121b7529a9762d6af700d15d0f206743df56992ec9e0d4d2405d061951be3953a4b861debca0d15a0043d3aa84b3438f2540c53dd283e36b0932b654e563c3c04a40862cb2b472b3b428fbeb8e235aee69afb22d8ef327c384b5a3caab1672b2c3ff14c6f5c3f6f8a41bf4102cd729ec9e7a2bec0fe46612f43628d708bff4cce68f103aa2775cb209aeb75a71a7066b449b6965bd0a6fe77", 0xe2}, {&(0x7f0000002a80)="16d92c431720fdd6cf22775a8bebcb10e858306610a9eb65a9a766d80d94eaeb4aada818970fe444eacaaad5db1c29d0c8d9c6260fc1a35e351724d509bcc729cbcd9f90814585299eed1ab88bd2ec7d8af65aade207fb269bc53396cfefa861cfdd2ba9ca08722eca1aa13bb58f8f56ee40619bbc9c9654938f419dd81a149f9c9bdfac050c2de357f394feff2b84edd8bb70e1e238fb4eca7a7b1b387f92e9e7d9759625a90b2cf5805acc4bb6b94e671cbb3224572fdb3d4e1c4b78aaa173362654c924eb3a9c843c989d809a2a73751f", 0xd2}, {&(0x7f0000002b80)="71f7fab40d0183b2ec26f5cec274987236d0235072fffc8c95aa2470bae981f0669a1746844261f3d58cadea4c16bd4efbdef6ef1075d48e64617d9d9d1cc2142e40331ae860d974ea4502ccfc9e89d866f364cca04c77", 0x57}, {&(0x7f0000002c00)="f282148c41b0caf91debce46e8cc61932cf733e3f9b6f29efcdcd7a89640827ae0069824c36ebb1c159deec06b5bf0bf2335bc7c3fc9eb2390b13fcd6aa8022797314de8522267385962ad16915825284848929ac3cf5e707d1caa1baee192b226b9607b309c56a80108982315407f23e1055a7076f71221da22f71b42343231cd2960d78e3dbfa3c9dc60cb5932b00459787154cd53dcaac973a025ccbb85bf72653c9b92bf8e7e263b928abca251fcbf8f58b4417bde8ee3c4c122a288f027ce4102fb66ed7f89ad4b8ea9af90b7fbf97aacf6ed26f9c8", 0xd8}, {&(0x7f0000002d00)="b07da3839444901ffafd57491eb6e6228dae1fe8a10c2f04c84802067bb08f5a57eb1b342c47cf3f9a67717a25b46313027cba8ab2487d81605aa9a2cea34461996683b7d63b47679a97426d89facc83d62082c65590ba32dc3ce36b91ec3814494b572701a87c65228ce8b551cd371818dbff93ed7145da667f6207ac22240d82f1ad82f5f1210fb8aa8573bda5", 0x8e}, {&(0x7f0000002dc0)="256ba8bb7ef459f1fd75218046ee2351aee82cfdaed86008537ef339bd9f568eeb32dc9300ab540aa297afee6ee47d9c80e8c107f299da0d1069ea313e59b53efee6d0245c0e45e9a09eed72d51acf908ae7273fd57bff3a9679762d595e40dd5b211ad90ea7b799210ff8ac7e2ea55af4664a06631636df1b4555d506b45fd9", 0x80}], 0x6, 0x0)

16:08:44 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

16:08:44 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x8}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  843.020672] binder: 3586:3588 ioctl 2270 200001c0 returned -22
[  843.075891] binder: 3612:3615 ioctl 2270 200001c0 returned -22
[  843.084275] binder: 3609:3616 ioctl 2270 200001c0 returned -22
[  843.104498] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:08:44 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getsockopt$inet_sctp_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f0000000280), &(0x7f0000000340)=0x8)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r0, 0x2270, &(0x7f0000000180))
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
mount$9p_rdma(&(0x7f0000001b80)='127.0.0.1\x00', &(0x7f0000001bc0)='./file0\x00', &(0x7f0000001c80)='9p\x00', 0x10, &(0x7f0000001cc0)={'trans=rdma,', {'port', 0x3d, 0x5}, 0x2c, {[{@timeout={'timeout', 0x3d, 0xfffffffffffffffd}}, {@sq={'sq', 0x3d, 0x23c0}}], [{@fsuuid={'fsuuid', 0x3d, {[0x32, 0x66, 0x62, 0x63, 0x63, 0x32, 0x37, 0x73], 0x2d, [0x77, 0x3d, 0x31, 0x7b], 0x2d, [0x37, 0x37, 0x65, 0x63], 0x2d, [0x37, 0x77, 0x3b, 0x77], 0x2d, [0x64, 0x61, 0x77, 0x32, 0x5e3735b69230b1a8, 0x77, 0x76, 0x61]}}}]}})
sendmsg$alg(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000001ac0)=[{&(0x7f0000000500)="c3ada00f30cbbfe5faa2f735b22dc9def3965afe243152741f9aa9b7433c8ecf41fff3e025a21444cf02f20575f8cb2907f5403e21147c84d5c764f3e31f1c3ef3d0a3a8e9fdcf0e82303c9f6c17f8c17c1644b5a730852c8fad7c24df03f9542540567c3d3411590450a6d0e1d9f7a79a6cb6dc3f317ba470e32eb4dab032e44f47bbf333a554ce48e7e3a2ff7c54ebf9b9cabdfa9001e4616982b6e8b9c1c7", 0xa0}, {&(0x7f00000005c0)="c37f89c15994958d26448530ebdca00a9ddc0a47f0291590bcd55ff4134f17eec7027b834403b46cb0cc038038e4807c3d43d374aacaa0d911b6a190f233fa50afc530d9bf8233e67b2a3669d8e8ffbd849fb82158c0474502bbc05c6dd9bab9fadf2526b1729ac8c3a98e3245411738ffd77e2da604587130a50bd89f1efe4d35a6c2ca94433adca8b9ba220ad73067e6701defdbe1c1d10c66f3e6d350b758df34b6b10b1e6176f5a5292370ffaf1006a479851f8402bb9b06e5c8b2e30dd9920d2d", 0xc3}, {&(0x7f00000006c0)="09f95a2e5441a2c7c818940ed071c82958994e68efe04cad65b7fcedb4b385ccba64a68d1bd496537b42655b02b6da284b29f16ac3ad197ee790267afe63ea2d2758a480206530c8fc183f580d3483d03ea2243a015def411343d7b5762839678216e86e23f4fb317a3b86e6aaafb7995d93a06c089ac07dd4e1a2babbc2788200f18b20b1ff4d08c43e4c26e575fa7aa3b6fac7e66f1ad6ef63418c5ac9d537d58bcce0ac53", 0xa6}, {&(0x7f0000000780)="eac344805ab38354ad343f8b5ec5e1f9f038ea6aff33d493348054e24b0e14089e32d7f370a0b9cc8b614a646540fe72ec829e7bef56a70fcbee56c80c758e91d231eec6355015f86ff0edcbcae71d9fbf40d1645e7fc27b386dc9cfc4bb483d0bfdc35fa2ec974fc13d96bd2482a1bba83e37231441ca1c5d0f463419e741eda4d9106a39884d31ae48c6a959c867f6232c632a10390b64ea950863852a2fc29c3756002af297aa4b37a87a748a711f7956746a6639d377", 0xb8}, {&(0x7f0000000840)="32a8f75bf8ef8309301b991c9637f199a1084442ec6d6f2b3a78f79f7d00931dc0f4937a4892db33bc9f24e204b7d944e178600ccc88bed5e83e098f08cafa7ff7d14cbae18c404bd44bf3ebc891612bd4c0a34a4e7fed3ec8c45e67f0057937c0c442455d37340b5f15c9d4ada4eb22e4d47e0965b76362b0b2f2d39f47b598b33d4e40bbf68c3abfd3af9dec1186afb236e530488bb1571477a7eaddbb197f20100bfe569f96bfff0a63d834acdd79a26ee3ba9573b1c08df3e62774f87af7b8c7fbb208a1195b26fef5039c29c4022d076a9f99ccd88fc17558eac3265372e91a597877fcc8a5e949953bc600f07bd01669370854a96523fcd1fc91", 0xfd}, {&(0x7f0000000940)="ea1c3b528ab38726e63290916dc57774de7e555d12f4dd38bcb6e753813dc40d6e385bc08452c972e215a043c86e6b57cbda737b0a6e0cd997a6cd4c3aa937f9a912415c240ce1cb0a6b0f47322c04fcdce6135ffeb941b7740db37501b0008520d0f21d85d46598ed805ebbfb917181d18142172700f2efced798c9c539c59c2131dd4348b1de48d7aa2d96", 0x8c}, {&(0x7f0000000380)="9b08cd143da4fc83e704940b8429", 0xe}, {&(0x7f0000000a00)="03e5969d1b0bd031b1c8fbfc9711fba4dde5f205ef8f8900be32dff70cb500c0c4b083eb58c74ba4302dadb2b2d542df5df9c66d9f8b3f944b7da505ce8a7f8d0ea296fb72cbbb9ec4128a5059b4141e3cd038f837b8ce2c04680c117334cabf408c5ea64206180807109321becf9a38b06cbef7fbc8eaab3b28fdadee7c0cab8dc5c04302eb05477245031901ca036e66379f51e3b1b6f3831b20052d5e77cfdcf509361742c50c048a3e77977252b26e348460d57b804b32433f8656b62a37a4d4420c4f81c272d30d2a49adf34aa18d6512de8bf5009f10e51fdcbc8eae327665fb8aa90234ae8ff2ba9c809e7da715823eaacc0687c687e13a36608419066d5488f6c9e4485732f77fd4168ae3c7f2a62fe51c084999f60f2feb011049bb68202b503c239be81688078d9cf8d7e59542b9e8a3bb2afb5723014cf9676df61dab3981642bc5fe68fa1a9117543a31c3f4d2de862422cf166cfd680c7234342f48cf8e97ce78cd37674040bd50ad6c2e2347f31af4c6a5fced37071939c75300ac1fc798152411a9302b99d6b27e39b2f7655a0fda7bc7bdca30c73f553cec89c0af174eac569f3d1856e7061dda48e5452c118ac1a7e908d587d07b12ff3ccfa9870e145da1677dc2d5ac4ccd2a08b5fa3254002db97f28ba60ac867100b8d9e82597315467e2b5b128e84b27e6790ce9e005f9b6dbcc545c3ef546b89827ba57de63b6add2913296296c626581f6ed81b486af0b9cbc65e56d8185170f0497e4c4b5ba82a0361a55cb2b7c73921a3daa3752512e1369c0ae51ccc66195f8177286019a820401a685b98be7080375c431e8dd7ee713c993747f444909863d175991ede95756d4981168947a07171119224dbe1e20cf3700175f4df5be11721db20f9fbb6598f7d3a99fe9dd5c19244cc619bf52d8aa6f8e4f36f924563f8ddc48f3d725cb7940da471a897c547379bdc1b8e7d01cd95a08492aca1cd0dd1bd543ec6e17a2caaff99cf7459f164bb0a98ea082d7ff08dc8f7a70c3295879b8ce763d344006752bc52cd462768ae067ef793a0948e848ebfdd6b65646c2f6c26e151ff848bfc2df5693d4d668986b065b3eb8b4de36f804d5711d7f228c9c25cb2f8d0308727d6fca8f2f1a75cfb89c69a9c34faaba22b11c393188ba2ba5097f3835e15486dda25c7a4bd26a4309aa7a551d520822488be3e1bb1a10010f71ca4c28b2c2c73e45c1134896ce2dd079e4463faef632f04ce4c7fd69a5c3c37f3244728ae2b909e5bf07a4fb45cda4a6b5d69bb35be561f01ad5f699514a5236cf86477eeb18d7126aa9e14d4e5e880281ae277afb489a90acd7b026fcb088a2c18c5050b549e910c2498ae81bc93c0c3f1c370762de48c79d30a4107f67694b5cc9553998fb10b20dba134776a8922cb033d04d0fbcce32f5f5f413b7b27769289f9189b59e88850454bdbc73210adb089b27aab9f0a8cbb5de6450e967d53bb0e24dcc127f9e75c7aa1e694d4d955220fd848d31c1f1a62a2a3cb68c768792858e41f5a4129dd76244227cafa0a4b2f3603e2e97305231ff9b70918b036bc30259b8d3ffdab47a220c4d1d7f91f7fdf27ed3d7bd5f84a32b2f95cdadde32685da8fbf93197690aa2b0f37add38de002a6a97c4b9f522c99411d36a5ddac5bb183bd835355fe70875d460dea254c01668b764c665fee26a87eaed2b57d49c9f5c139c10d1511c33a2156c2a2e13c2a2c50e4b6e718480e928219680a72c3c59be4ebbf26dfbd51c713d1a816d988bb6117688a812426b9f0144b4379eb6356e75a30bf51889fca87a107e70682b2b342be08662a58ef990cf2e1eda8d513cdf1ef4093f4d84a0a267ac24036634177ec9516524cb1b5c2df0386e47c2c70563c85d31c594a6edb6d3fe8db2406ddd760cc09789ddecfe9aae199a693fa56213c8135886ee5a10a9c5d472d82af709c602ba0e960af8df89ec408b70aa1cb7c32c7f82db493bcf4e335a490a9d667a9b1121f8a6b453498544d338ada582415e395f4beb4b96987f44dfe43eae67854011368ee1587eebcaea31ee71dfb1c68a63906a278da444a47ed080bc58284e81e69cc29343c29e00faa07f11edf193f4e738992d277a6a3ff0cc1ddc4d4bd2f130590217d8ceebf0f268d76bcbbfce5b3d59f474c0e955d548e292029626b9b71d9c1d063eb319a97f2a367b21f1ceedc17b313cab8f9fbbd95a1739a4c95e7bfc55fb6c1d964c3dd30bbda36bd07f73481e8afd1fdccd6ae7047fe5ef55f3b59798ab418262d9e3abc7124565b7d705169e494d27657102ef6bd60e8a4a816aaeefbe12769725c68829245b40ff32b9a94f862116a86da7340baad9be406fd7c0b10db39d3be2f9786f11d68024f9002a52169cb8512bacca6650e74d4a3434be778ee31c9dc8981ab4716f41192a879aca098dbc0cf90ed7384f6e03d7aeb8083667278611486fd3139e2e9a8b90ac2ae195f32badcd40b0ee1a5c49cbf2be5f7efc52234a44fe50c4377bb71307eb2c098f3877c0d761c4524679c08cd63713a21f5a73a254dcc0360ee9d732c616cabaadee585ae6bcbeeb55658fe39393fc0ce9a3c12b78c7dd6fdabe66e0221ccab7486868f3b3bd7bed8d2a3bf68790e9d0c79d3f8a7bcfae9b3c1d9b25c46858a28ec3ca7e0b53f32a387a7091ec02e69c00efdb21f541310e456360c62a9f5fb82f0b9717398d72ac2d8b8f577efb0a0e73523c73d55edfa3526ca0c4a33735f277a25a8af1b5f8062251435e9b05c1c2dcf488b6ecd9c565d08f8daf5dfc4717fe7d3d2d478d6d8c8d9c664ae02d41a96113869b96e64e62a9fa8bba9adb388b11b16355607bca1d1d3b941527a2cd2287494774331214e89bbfde8b2a2b1eaa6a47e8bbc988de3402e5e23c541921bbeae7b6628bc192b3c4262b861639c77dc9adfeb746d2ac40f2671225b3acb28d4ef0b1f65ae15c3dfd425722d87bcb953a111d2b6a6994fb4c280938d15376ccce213754e4a525525958ea0951c5eade4587869460c4b2409ed24454dce10476a8cc76e3288a7e2aa6596c3e7ead7d18d9ab7e7bdccf9b4848ea2dbe4226f55a254da2e3540d99304f985c0fcbc61a940b922e09ddbd625e8842c293793ad0e033f904336d9d7d0b4b88091a64b1a40b0f0459fab9db459c745ada0e1a0cec0529751463f3cfb791e8cd9c9903897cc8ca77bcf442caf1f83c673afa925b8d463eaeec454fd9ebdbf39e608d1551f4e4bf409a7220fd7964d0e80a13c0e8a3ad8e87e5b054e33c50a443ff0dc4eee32a48a6f3b07062f9e222c7fdda3f1f702fa550bf47261ae64a6f8cf2a2d1dd8d4781799e7e360bcf7699470e49e037fac8e75d5b612abb2dcb76033b1123fe5c060545e20fb5a9f86ccc19e5c04164670938b82adb7120fac02a75050a6ba79cb26400275d9fe776d38f353dffd17bb967bb9ad7f743ba3f7606aeca50db0cdd3ec38d4055a0d0fb265a8a8fe3a0b597e1324b1da9d98b589f7c246786fcd2dc5fa4fd780f8761c8b585bc19f61d4b4ea4faeb254f3ceaea8b00d42104ae79c41b11c08c4ef0657be51d78241b940d97ef1a06eb9152216e4364dc2bdd32c84d05e89839defb47df0d2d37fdfb93d713d1d848f7874be66249f45d98671007ffa12accb42d3ec170c9ec0b8edf3a0697443ecf428a96bec5a2dcad8298b677aa81e008a61fc2f137048603a119449f001591c8eed1914af46b3678d23875ffe2650fd01924ea09ef30b0583f8f2a44b947edbca86dd0485dbc92f8a0fbf908e231b7376f71ae1e61ec273c9bb9b71d34eaa216f7823efb247316e657167b9d10f378d9c64260d7b68b9e10e69ba351d9ac60fbe125fbc622547f4494e1a98a93dd69b8e07d6d8bccf771c07944680148852c1ae1a09a058b6e0ef2fa98a39a6428507866021fd73332752d93632aa4d4ea68b4a3e05c8996cb7d7987f0e1afa2a3824810c84fb580f7862770a51803a881feedcca77b78522b96375261ad37e222d53242b1629183d7a3ce6bb374fc0d29163f2fa7fdf553589788a49168b6ce61bcfbc3845587b6010a16a814f344bde830cd4ef6f9aecd2ba2e691b76a3983bf562c3b0fce0aafc453408c922118ac71ecf5806d0827599374af65047e0e6f02ede16c19d0ca2b7f8490d2df1a6a378782777e968b9469d07919de6c974465b56440942d8d0d72beba2430384e7565f851d33bf1fd8ea22c8eda220a9a0057def2420a97cef332ef6d6405d5451094cb959393529e684cf66c77cbe4eb04b3ad855377818710d81ba34bf2cc135d021fc32870a9bd5e4e39e03f7e6e6f08e29777a90a44b157aff0560d5d27a57990d4ef9ff2e954a854fc1ceead6c78f5634c7e77fc5308432dd8e7b02d6fadfcdcdc0dfa817e9b4c1c84abc4d2192c39181fe9a28d1f0d78da71d0bca4399f00a6e968a78d15a6c3cb1bdd35f4dadc4149a5816aab493ed8bcfb62a0e2258e7e0a5b074eb387f63153a321eca89c9a20bad63da122bf2f78f1469f028f9f0a1552aed1306b03d8956d072d06288957c4ec188f29974188c398efd41a33230b975af67e531125788179a8378c5da63730db75c86af825fbedbf5385ce6a4c4e5447459a9bb0dbe02bb0c5e70d5ffede27424c0205044170ff5573320730820120ef55c37cd5b67dac83ee01fb626d6924517bf9896ad08173e9ed4ac7db21bf49b4429259ce050ad3ab2e35eaee07b23856f98dcf1d6075209fc6bd9532156dc07a8f676017975893b13bcae148d10a11242c5574fca056ce7f91b23e28fdbd012380d48d83eaa8a44458ea58ac85e842a328317970dccb27bb51434edb0dde85c247934e1126c191035232b5018f5c70a0df8d4aff16187a08f7728c9f1c99a849d0166c491fb582d188cf4394f756d8770fa994b5c08a8f96781dd51a1ccd15ad1ce5dd1f90ef55ee3bd566d29d5c8f57b123b962e0302746cce8c31f7ebee4a1c76a49d7004c54813303ebd2e85abe56352607b480a50baa3455baed7a6916afc4c3809b90d6d9d0ce8d1174c7c766d6539658aa63c4ef6b3e133233b0e3cf1ca24e357b685f239f78c86dd176211727a7859cf09cf93dc319923ac033184604ec8d2121bbc9c2170b3d88791e1a206e00e3dfe19fa731ae5487bdae5c2f0c31e754c51db9ffa5085fd130ad9705a0989a2aded1344157949a65488051ff791793c82462c5841f24d740f0ba530241d241bf90a1196aee6aeb026024af8b384daeda0fc99b6334feb4bb45a6cc55b1c83372a48b579890f3a144737d34f8fcc1e0b736aa5b8455aa74ae12b0f75d16bb2f8791265d69ac5151dbb78b601c67ea5effd740591283cb67b9915fba9e78badf698d0807783d9b2036928bdcfead6c2865920a8c151313d83a7d43443f552f3eed5bc224536ec9a4e9c034805e225d55a6a87e23e53d98a2ca70d86be0be44e40c465b76551e76244632ba1fca685cc2423578d1c8aa03aa26f2399e5b5a9307f1926392ba1e354a136d0b7b3f0976327db8955f4c2b20b04fe92a188180872a71bf969e2ce8925326ac516ce1bae32bf3f8e4dc08ec86ca84534f328a5673a462e585d8e623e6e26c720627137dd039a1d727faad1b2a35cc4b322ec0b065a222d6b01f69e2c6b1f3e34264cd79329cc0f68e34fbdde9def9f0f965769c24f359271275833fa7eec2891f8f7c205e4e7d98b7e8ef6dfe8406dd47e8d1bc4678a9ffee59d31b7b3ef459adf862e849d04bb2adbe8a49c66b64ca8ae1b576", 0x1000}, {&(0x7f0000001a00)="1a53941bac8c30ae559a1159ec72141c0decb27a42a99e0abb5e900fb5d3810e0989ae4b2b0a8165eaef974f8286af2ee447a7cbd7517a10191b15de219d83caf7b51edc72de5864146ca2b50b1f57888d22396b8becc35b8735d2e2165c0d8b281c5a4eb76934e283990de79d22d65fec27f5c2cc605bc0f8227383096268c8e495de1acb051904458767798e4300c584a14e9afd2f236ae6912148827db3198376cf2c5c70b2f27ba8613af297ba684090afc5724297e1a07b480466", 0xbd}, {&(0x7f0000000440)="922acf8c90774e277942f9df8d2fed18bcec9795a717e7df7cdc22d04e611dde1fb222d6595801e52a8cd2201f6b2188729a518ed2cf36839a2603a92b1cbc74d70a464e7eeb0adee1ff82dd7756734d6876d7eac6213a435f4cf727141cf9a5436b555ecb938556951c7af7fa14d2594f629b321693c312c5a48d", 0x7b}], 0xa, &(0x7f0000001c00)=ANY=[@ANYBLOB="5000000000000000170100000200000036000000ebc0e566f7870c9bf51ac24b490315d484ca31ef4b19d6a858acf7e44a0db24ab176a7342fd5848f0794f4406b03b50a39f1a78e7b17eddcdfcca49d40b54b0197e75934000000000000"], 0x50, 0x10}, 0x40)
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  843.411900] binder: 3621:3623 ioctl 2270 200001c0 returned -22
[  843.467820] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:08:44 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x64000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:44 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2c)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000001380)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c)
ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000000)=0xfffffffffffff801)

16:08:44 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x258}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  843.825018] binder: 3609:3633 ioctl 2270 200001c0 returned -22
[  843.846332] binder: 3612:3615 ioctl 2270 200001c0 returned -22
16:08:45 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:45 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x4000000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  844.070028] binder: 3642:3646 ioctl 2270 200001c0 returned -22
[  844.137639] binder: 3647:3650 ioctl 2270 200001c0 returned -22
[  844.191984] binder: 3621:3652 ioctl 2270 200001c0 returned -22
16:08:45 executing program 2:
mkdir(&(0x7f0000002a80)='./file0\x00', 0x0)
clone(0x2102001ffb, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff)
mount(&(0x7f0000000180)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)='hfsplus\x00', 0x0, &(0x7f0000000280)="24e47e5c34381b56a7214a78be16faded8a2b94e78ce6903d4cfd88928f55c69004af966ab74f576d22f6185bcd8c4066c7f37a9550ffefc975c8fde405db7bab19bb567b88bbf9af88debff5e28dd4dad838aac54f86fb3f7bca77c75576a0b5a61520b82a6ab784cf9829651fa81032874bc34b1ebe1fd76f2c269ed0221c85d960037fe495390cd40bc06a21eb8e8c17ab59d726f54643e67c1023e8c1dfe4f16ffb1f3d9950e917f2b68add94b4f8efdb6be61764ae544e1ace1ea0cc4d2318645cfa484ca12bf67a9d1b1cbeb250a464b708cc7cd9abef735f09fe8c210c353b8f8167e5de88562a57e391ae7")
dup(0xffffffffffffffff)
syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x0, 0x1)

16:08:45 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$IOC_PR_REGISTER(r1, 0x401870c8, &(0x7f0000000840)={0x573c, 0x2, 0x1})
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendmsg(r1, &(0x7f00000003c0)={&(0x7f0000000340)=@nl=@kern={0x10, 0x0, 0x0, 0x1000010}, 0x80, &(0x7f00000007c0)=[{&(0x7f0000000500)="661a9efc2bb851d33a91e220174ac7c17a0c3eb9962da168bf1f94523efd52dbb01364622e5466b301c0a990f60e7a63969c525f92d06775db4078e099eee1631dc2b56182e75993a3cac64844e787cb40238909317a6481ef44352a7cc704997cf5a1f4a289f9b3876167a69066644f5beceb3e88fec12c5e412adf255b9252f71673eb2fd0ea9ef46aec07ec721d54a2876bd445bcaeb380a0f578933f1a412ace88e9577676ed6463960e035b9138436fdcd298959a86845e3dd126034def836c88f773a12e7a93609f85be1879a440b8447f02b31a5e34c4ee709e0ca35ffb306c98370886e4d82244c3683292154f85ac3043f4f5b6b0", 0xf9}, {&(0x7f0000000180)="5a22e7f3ae6f9340546698f86458bc68e1c7b5639faa85f35a", 0x19}, {&(0x7f0000000600)="2ad0ad5d18125e9a1ac96fdaebadc0657a84c32263485f4218e7ff2448954ceec09cb6c35341587d786a201d90811c804c839924d77d38ee1668742b09b7162f1833d25a3d84528b814a6f8aa018d49926ab33b0f6a84933b637581e08db7ba14102795583703209ec9ca249c6a674ed379c260da232f1c7e5202ccf5800182c306bccbd31aa2719c1516a2ecf92c96f4e9d341e5a565c23bb28ad4681af3de0319871f310eaee998ea3de108dabf09729fc0a09217836dfc220015bb2ee2bb2d479058f255fa07d9946d2a5bd03423fab4b1d3cf325", 0xd6}, {&(0x7f0000000440)="34c270cd8c8c49ff9e21384044fa6fc85291b2547b51dab18884c7385d8d978f0e4d8d58e61b7cbbc7478580682a4ff5fcd5e0b6b746e538c74e9a9557851c6c6273a691990247833a42cb98bd230de502dc752ef467a8", 0x57}, {&(0x7f0000000280)="6154d2a35f9ae1d4c0954fa215f0bd3d4cbd41779f09b4649f", 0x19}, {&(0x7f0000000700)="51c0fa54e9a40546cc98c00306b8428093b8bafe71ad4983fa471a9a87736e8f7c61eb926f63fdd4c8a53ffb34192d1b4f2eb07cbffc83950e899a82afb6b194bbf6f6b310a4b976683d4a5a9ba93414b9b384c7b0e55fefd9185c1d4fd07b63c441993f015a753a498679e1660e4fd74ed853dc3065b4cb2df5360c312b9c8d201cc080f10143b4430404", 0x8b}], 0x6, 0x0, 0x0, 0x80}, 0x50)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  844.388420] hfsplus: unable to parse mount options
16:08:45 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x20000004e20}, 0x1c)
connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0xb}, 0x1c)
syz_emit_ethernet(0x46, &(0x7f0000000200)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "c22df7", 0x10, 0x11, 0x0, @dev, @local, {[], @dccp={{0x0, 0x4e20, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "0087ae", 0x0, "ca8345"}}}}}}}, &(0x7f0000001780))

[  844.433117] hfsplus: unable to parse mount options
[  844.478799] binder: 3661:3665 ioctl 2270 200001c0 returned -22
16:08:45 executing program 2:
r0 = socket$alg(0x26, 0x5, 0x0)
ioctl$sock_SIOCGSKNS(r0, 0x894c, &(0x7f0000000300))
accept$alg(r0, 0x0, 0x0)
socket$unix(0x1, 0x2, 0x0)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x5)
syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[])
r1 = creat(&(0x7f0000000180)='./file0/file0\x00', 0x0)
write$binfmt_elf64(r1, &(0x7f0000000180)=ANY=[], 0xfffffd97)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mknod(&(0x7f0000000440)='./file0/file1\x00', 0x0, 0x0)
syz_open_dev$amidi(&(0x7f00000002c0)='/dev/amidi#\x00', 0x2c12, 0x0)
ioctl$TIOCGLCKTRMIOS(0xffffffffffffffff, 0x5456, &(0x7f0000000140)={0x0, 0x0, 0x804, 0x7, 0xadb, 0x0, 0x0, 0xfff, 0x3, 0x10000, 0x0, 0x101})
r2 = open(&(0x7f00000000c0)='./file0/file1\x00', 0x0, 0x0)
r3 = openat$cgroup_procs(r2, &(0x7f0000000380)='cgroup.threads\x00', 0x2, 0x0)
dup2(r2, r3)
fsetxattr(r2, &(0x7f0000000200)=@known='trusted.overlay.opaque\x00', &(0x7f0000000240)='vfat\x00', 0x5, 0x0)
socket$nl_crypto(0x10, 0x3, 0x15)

16:08:45 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000000}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  844.680718] binder: 3647:3650 ioctl 2270 200001c0 returned -22
16:08:45 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x3f00}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:45 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

16:08:45 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r1, 0xc10c5541, &(0x7f0000000500)={0x4, 0x4, 0xbcd, 0x0, 0x0, [], [], [], 0x7, 0x5})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:45 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x6400}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  844.828548] binder: 3642:3684 ioctl 2270 200001c0 returned -22
[  844.876853] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  844.974150] binder: 3690:3694 ioctl 2270 200001c0 returned -22
[  844.984167] binder: 3692:3695 ioctl 2270 200001c0 returned -22
[  845.088795] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  845.097621] binder: 3661:3665 ioctl 2270 200001c0 returned -22
16:08:46 executing program 4:
openat$ashmem(0xffffffffffffff9c, &(0x7f0000000440)='/dev/ashmem\x00', 0x86880, 0x0)
r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000180)='/dev/null\x00', 0x8000, 0x0)
ioctl$KDGETKEYCODE(r1, 0x4b4c, &(0x7f0000000280)={0xff, 0x100000000})
pipe(&(0x7f0000000380)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
r4 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0x0, 0x1000000000000802)
write(r3, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r5=>0x0})
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f00000001c0))
fsync(r0)
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r5+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
ioctl$BLKROTATIONAL(r3, 0x127e, &(0x7f0000000340))
vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:46 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000000100)='/dev/snd/timer\x00', 0x0, 0x38)
pipe(&(0x7f0000000040)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x0)
getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000080), &(0x7f0000000440)=0x8)
r3 = getpgid(0xffffffffffffffff)
ptrace$peekuser(0x3, r3, 0x3ff)
r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000840)={{{@in=@broadcast, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0}}, {{@in=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000300)=0x96)
setsockopt$inet_mreqn(r2, 0x0, 0xe368adb30c792f1f, &(0x7f0000000340)={@local, @local, r5}, 0xc)
sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0)
setsockopt$inet6_dccp_buf(r4, 0x21, 0x82, &(0x7f00000007c0)="e2f2929f15964dfa05a1076dfcbb9f4b49714b9e6418465ff7bb86e19f0bb16c467c2584f09fda44e23efcbbdd25f1f5775237271ee6404495f4ead21603f6c0d81a1e34703241712ee5241614cfdd30a25aaddab295ca5c", 0x58)
ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000100)=<r6=>0x0)
openat$cgroup_type(r2, &(0x7f0000000780)='cgroup.type\x00', 0x2, 0x0)
getpeername$unix(0xffffffffffffffff, &(0x7f00000003c0)=@abs, &(0x7f0000000600)=0x6e)
ioctl$sock_SIOCSPGRP(r1, 0x8902, &(0x7f0000000280)=r6)
openat$cgroup_procs(r2, &(0x7f00000000c0)='tasks\x00', 0x2, 0x0)
getsockopt$IP_VS_SO_GET_TIMEOUT(0xffffffffffffffff, 0x0, 0x486, &(0x7f0000000580), &(0x7f00000005c0)=0xc)
unshare(0x40000000)
socket$inet(0x2, 0x80b, 0x7)
getsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f00000002c0)=@assoc_value, &(0x7f0000000640)=0x8)
write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000700)={0x0, 0x18, 0xfa00, {0x2, &(0x7f00000006c0)={<r7=>0xffffffffffffffff}, 0x106, 0x1}}, 0x20)
write$RDMA_USER_CM_CMD_MIGRATE_ID(r1, &(0x7f0000000740)={0x12, 0x10, 0xfa00, {&(0x7f0000000680), r7, r2}}, 0x18)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/snapshot\x00', 0x0, 0x0)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000040)={'tunl0\x00', @ifru_names='bridge0\x00'})
ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000001000)={{0x3}})
ioctl$sock_bt_hci(r2, 0xc00448ff, &(0x7f0000000500)="5d02319ed1f01999049eb7c0a3e95698029e128dfa1bd5764e52e5fbf13d72bae15cf023a94c4a00cf21026325c63aeb2398e7fac5ec7bf5c4f249475b")

[  845.404039] binder: 3698:3700 ioctl 2270 200001c0 returned -22
[  845.538406] IPVS: ftp: loaded support on port[0] = 21
[  845.550722] binder: 3690:3694 ioctl 2270 200001c0 returned -22
16:08:46 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:46 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x7}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:46 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1400000000000000}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  845.862689] binder: 3692:3710 ioctl 2270 200001c0 returned -22
[  846.024230] IPVS: ftp: loaded support on port[0] = 21
16:08:47 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000000100)='/dev/snd/timer\x00', 0x0, 0x38)
pipe(&(0x7f0000000040)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x0)
getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000080), &(0x7f0000000440)=0x8)
r3 = getpgid(0xffffffffffffffff)
ptrace$peekuser(0x3, r3, 0x3ff)
r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000840)={{{@in=@broadcast, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0}}, {{@in=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000300)=0x96)
setsockopt$inet_mreqn(r2, 0x0, 0xe368adb30c792f1f, &(0x7f0000000340)={@local, @local, r5}, 0xc)
sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0)
setsockopt$inet6_dccp_buf(r4, 0x21, 0x82, &(0x7f00000007c0)="e2f2929f15964dfa05a1076dfcbb9f4b49714b9e6418465ff7bb86e19f0bb16c467c2584f09fda44e23efcbbdd25f1f5775237271ee6404495f4ead21603f6c0d81a1e34703241712ee5241614cfdd30a25aaddab295ca5c", 0x58)
ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000100)=<r6=>0x0)
openat$cgroup_type(r2, &(0x7f0000000780)='cgroup.type\x00', 0x2, 0x0)
getpeername$unix(0xffffffffffffffff, &(0x7f00000003c0)=@abs, &(0x7f0000000600)=0x6e)
ioctl$sock_SIOCSPGRP(r1, 0x8902, &(0x7f0000000280)=r6)
openat$cgroup_procs(r2, &(0x7f00000000c0)='tasks\x00', 0x2, 0x0)
getsockopt$IP_VS_SO_GET_TIMEOUT(0xffffffffffffffff, 0x0, 0x486, &(0x7f0000000580), &(0x7f00000005c0)=0xc)
unshare(0x40000000)
socket$inet(0x2, 0x80b, 0x7)
getsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f00000002c0)=@assoc_value, &(0x7f0000000640)=0x8)
write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000700)={0x0, 0x18, 0xfa00, {0x2, &(0x7f00000006c0)={<r7=>0xffffffffffffffff}, 0x106, 0x1}}, 0x20)
write$RDMA_USER_CM_CMD_MIGRATE_ID(r1, &(0x7f0000000740)={0x12, 0x10, 0xfa00, {&(0x7f0000000680), r7, r2}}, 0x18)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/snapshot\x00', 0x0, 0x0)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000040)={'tunl0\x00', @ifru_names='bridge0\x00'})
ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000001000)={{0x3}})
ioctl$sock_bt_hci(r2, 0xc00448ff, &(0x7f0000000500)="5d02319ed1f01999049eb7c0a3e95698029e128dfa1bd5764e52e5fbf13d72bae15cf023a94c4a00cf21026325c63aeb2398e7fac5ec7bf5c4f249475b")

16:08:47 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BLKRRPART(r1, 0x125f, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  846.069614] binder: 3717:3722 ioctl 2270 200001c0 returned -22
[  846.195670] binder: 3727:3731 ioctl 2270 200001c0 returned -22
[  846.254285] IPVS: ftp: loaded support on port[0] = 21
[  846.286306] binder: 3698:3728 ioctl 2270 200001c0 returned -22
16:08:47 executing program 4:
r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
dup2(0xffffffffffffffff, r0)
write(r2, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r4=>0x0})
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r4+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  846.559162] binder: 3736:3738 ioctl 2270 200001c0 returned -22
16:08:47 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x64}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:47 executing program 2:
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r0, &(0x7f0000000000)={0x40000000, 0x4000000000000000, &(0x7f0000000380)={&(0x7f0000000300)={0x2, 0x2, 0x0, 0x9, 0x10, 0x0, 0x0, 0x0, [@sadb_x_sa2={0x2, 0x13, 0x2}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @mcast1={0x11e, 0x17, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x17}}}]}, 0x80}}, 0x0)
creat(&(0x7f00000000c0)='./file0\x00', 0x0)

[  846.847925] binder: 3717:3743 ioctl 2270 200001c0 returned -22
16:08:48 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x8701000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:48 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58020000}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  846.987239] binder: 3727:3751 ioctl 2270 200001c0 returned -22
16:08:48 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000240)='/dev/userio\x00', 0x40, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$DRM_IOCTL_ADD_BUFS(r0, 0xc0206416, &(0x7f0000000180)={0x80, 0x523, 0x2, 0x6, 0x8, 0x101})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
alarm(0x90)

16:08:48 executing program 2:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000480)='/dev/nullb0\x00', 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r1, 0x0)
getresuid(&(0x7f0000000100)=<r2=>0x0, &(0x7f0000000240), &(0x7f0000000400))
setresuid(0x0, 0x0, r2)
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000002a00)={&(0x7f00000000c0), 0xc, &(0x7f0000002980), 0x0, &(0x7f00000029c0)}, 0x4000080)
r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000340)='/dev/sequencer2\x00', 0x0, 0x0)
ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f0000000500))
ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045532, &(0x7f0000000180))
ioctl$TUNGETFILTER(r3, 0x800854db, &(0x7f0000000280)=""/102)
write$binfmt_misc(r1, &(0x7f0000000440)=ANY=[@ANYBLOB="5279378c"], 0x4)
ioctl$sock_bt_bnep_BNEPCONNDEL(0xffffffffffffffff, 0x400442c9, &(0x7f0000000300)={0x8, @remote})
io_setup(0x101, &(0x7f0000000040)=<r4=>0x0)
io_submit(r4, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x6000000, 0x0, 0xd, 0x0, 0x0, r0, &(0x7f0000000000), 0xfffffce4}])

[  847.057020] binder: 3753:3757 ioctl 2270 200001c0 returned -22
[  847.178453] binder: 3760:3767 ioctl 2270 200001c0 returned -22
[  847.327143] binder: 3736:3738 ioctl 2270 200001c0 returned -22
16:08:48 executing program 2:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000180)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
open_by_handle_at(r0, &(0x7f0000000500)={0x1008, 0xfffffffffffff1f3, "e7b968cc8b4ec3f863d1589730c6d62e18dbb704a824d96320acd5c0e23dfdb5907b64471e7c82b7e8a9d1d3b1d3269dddf1cacd3064feae27ff8fbb4cc51c11fcb8a5ecd678cb43e95b49468173d2023e3720db65a36020fe0e1819d7f1582a89116c9b540d595536032d06addbb55a5d75baacab66bc3adb10358a10ac21550cba2278b0169030b17364049065479ca265c5cba6d4af216dfbb7899660204ef9ce06933fa0f8c04a10ae9079edbe18f1e295adf576a253679003c9701cab7f6e226fabf424904083c715de4b7ca8c8b9deef8f85ef08e0a22305b5bd9132d1912280c529761792d718c0087a42f380bfb0354fce4fe8932feef8909cdd0bd50b5af487fc0ad298bad3a687270cf4f0ada1496e52802523285174dd4bd0972a58bec342c2597d0c0c814857500c962f280d9f26920443f86fd1f507b50e4a82e3c7ad155e67db5645d2a51b18091eae1dc201a422e3c2ca9de74dc71a4b6a0d8bdbecd33e75541ad319e3365e69a5d7595f9a38dffba08e5f2ede2953c4c00b36dcd36aa0809452aa39876d5e238fb871e530e6a4383cc9bd49aad0d122f089626d9d084f35dd5e23582d0f653e341e0e5791a8d3f216e8241942b4e8ef68d0842c1b2534b1b213e29e3f2b10406824a8b3052069c5182e964d47842fbead702c7b2c1d95f61b2a8d5049d9092ae9a1b0666886b6d03fcdfe4504820d113bd256783b13c28b43d832bc4352138c94f5da818ef69388dfa4fe738d78e5c785efd7bc07159253c31a3fb113e83f6408cc2a50e9b7be09b2e5455a137816bff5843c08eabb7570b1d31ab86dd99bb59d2cd0918e8fed2efb799493c0f6ae4d6b0567858e8cf3e5db269bf57f7d8ef07a82e843df94f718d975c7a8d9c6745c1e3553bda7b8b461b2893830028ffd79619dfc00aa03cf9f2ebb523af4d4337b358c7117d1065e707b252506902b44a3242ec0834902abb056db6d3b720501bd68be307af2e6b62d484dec521ff08f9e49c6463fd8c78bf1ec8e24182850d7329574deca2cb636f9f6caa1fa51d7e9765b4fd6f146d3f24518882644dadf3a2a78e26fb7faa726ae908adeacd57e6fcb2a2db4eb25318a64dfaa693585b46fbe0b03184a2c821a23c9636b1451d9f48e8f3ecdc74c8c049a33663d4567d179713599efaa15132dd59c89fd06628dbb0a40b4357257b80a5e04e0c113490ab6a68ba886c4198b99bfc7b64c3b1ae703a33e18a7b0f3e10c1908047710d3ca4e251bd340ac86a1ee7525e5f60fff29d20a8b4643f3e439bdf859225a2e37b79e47fc4565aa16086aaaf5748df8550ddd5129524e72bcf4e9213a190c72ceaa77aeb0b009ac56887800ca29f45072d06ea695c11ecab3d1e256bca77bca7b72b450a97fa219a97847204497c7ac85877466ea07590fb1d1ef73c3b4134bcb23fada00bebd74f99609cfa43ce153543f1e6f48863a0160ce9a3d97b5a32060be6dd89bae59d0115ae33c78c248a96196f5d7e2b3b71d6b954832515fb0b2988198a2febcb9fae4e18320c5c0b7861e71fb6213e5005831cce36ca39ace0288709ff6dc962c708519444e36369d05655c964b9c662a14bbac147963c629dab300ae889215d5aec68534d03348b68bf8132e56f245232a6344aba05a6a40098715e9c88ec84f2dae5aaa6ecc74dac807d36d3b74ccd6f43a043766238a084eef045a485790d8ddfeafd9c547d50f8bf05d9bf23099f3e8414da1517591d1ce16e62d8ddce87fc683673395e0f4d87d5a78ec16eea6804d1d791876dc96d2bb80b802a9f35c1e2b1610416a98e8baa3770fc71f08c0410776a5465fab1178535955fc862d78012ce816fce28b8407c211f05db69ee1ee31979d4bd0ca9cda71f938c88b4cc17ee3d4a18f3efdf25a028a82f7f3f1d5ad00cdd7279ba8eb059166589b7345839dfbff577b74f78146a481f73bc923918252a20f7e23f8a06c22b9d51ba24eb4b15697d5cfddddcfda7bb4a88e3ec65fdc213acb206737708d1e5c718564f0e1ef393d901a472a5870a397421f297cc43aa6e6b9b8ae4e8d8723d3bd79f9e4fb91ef7fd3c3fe1c70c52236f2a89961fe41ccbf0bc8e2cabfe6e2563e82b6c57145798a30c3c6366ba1d1f8e9f0b8d420db64ff40608cb73a220f35f8c0e85b5351965588230eeb6a8f28c85d0a2bfc41ceda1fff317c84a55b894eefbd77cf126d978fefa511889f61ea24c8fc92484b42b4fecb6db88a074f8335c640063641fb98aadfbd8f67914860f86d9fb392a5d12fb5c31552f2103e2525845cf7b1af49a796d7a7cbd78a3e59d184c7e3fa7f85fdc99a9513299aa1a763eecfd7787d6194ac854cf6e64149cdb8aeadfe5506d21cece008203d8d8173fc4c4a8dfa805ac103bdebe528eef7ab8f57d49849f039200621fdbde1f85bf8133639fcc0a935bfc02b07efe5eb93ed806a09155f0e0f4c9b944d27c4464a7923e57a3aaf36ac0852f3dcfc2a814adef6859574fbe99ba8be35d11d31767529e7e1b17f80234d89bfaaae2c00910329e3a23334b431488b9a8dee4798f3b87f2c23a662bcd51fcd8af9c5795193314ce6e9e1ee11c3fbafe530401aa2596e78d05155d87ac811c51c31604dac6285a9fc21dc2fadb68e1911c2569926394dc819fa17920fb1d1e73ff62ead3badb4b634eca365b8f2b6c04ddc3652dd4fdd97afcd0bf55cfbac6d13c57d2098305cb397c0a56db966aef931f8551693c0b24206813af9c0d3e9a6be7c1e0513978f0cf6f4403c62a88128992a5994d02d805e042acb1a1ce7ec39788295f43e289ddcef4e005d8d43fcd7cf3f4e008f520e4cc29b0c58ca1165a7226a712af79fc2fe21b123419a8c58e7d4725b136cb79fa7507be98656eb23d839d87dfb76a2190c6b060b2e43bbca34437859fdba88b5d7e75c9b182f4521c85f5e8c0bb75e16ee71d5bd0761fea1ded953dc90393776878a69a0a65f563d85dfa8f77686442b6662c00a29f8552d11067cbe1788cf72baa2bc093882ff4de4a134d04204b6611625232613d4de8cf1e77172b252973702a5f2647377268a46aff3edbef23f3a0260ab6054419fb0aa39817e0727e7b49179d8c7dbafb4fe59d9ef87bda8db20abb0a535cc9f91029e6ad3cf111651bdb59052ecf1ebac4f17ff40f6311e0f8751e3cc0ec69aa1e4b6d40d95be8fdfd000cabf2578daefd7a85d1b353441d81fc7fb709a625e9d2d51872a8baeb87913bf4b6b3f1ec2f44e5ba5bf58840164632efe24143377900c29fa37955ff4d19a2c43a503ccd8797b8a5f4a673ee94d753641f072fb263f92bc5cad86515201d739d3ec106c3e0e06f3d2b54f061184166c0d20dd9c8ffafffbbbb0c629edfb6d124813408b4c46dfecbcb4a9bfa98bf8555cd6f1be6acb8ae872907c6935bc358e3acc86e2e9f4ac16eaaceac44683e31eec86e0763772d57077ef0d901860b70a53b583da1c5364ccdc99ce2b69ac91b0b3560775923dce0f1b2f88aef7f6a339a6c738457e7178429598800bbfca07f2a234b8a5e4a26d9df33593d481fca7361feec16ac2460ff87c512e2defeb9367c0702ddede89e808a1b232c9f5f41b2648366a5a354843eccea6309e46488509b38ba8a1c6431de786fe5429b181c26859ca3e301a63ca84ab8f2cd38791ad8a7b4303910fd4504ac9ae4bf790f79a37d24e483d0c8be7b427ced77df114fff9ebf72eabf996f5da662dc8bcbeb02b66e8f6a63487b2d339d338ab3dcb0708d91954418446177a236415b163475f62e0b1f8ee21048b93ea46fe9b33c74caba664f7d3e7e08ad2856ac63d24fcbd0b6e878c2d3fcd74f8b5196f6694d443c719cb5edf7c304a656b489ab156fadb67346dbd8e8a74df226f44ec718c64590cc95dccdb0d230a625fb3084ad3a2f7cdade407a82fcb6fe91c90e1f48513bbff07e27f43030972f14879fa585615a37d0c40884cdc93dce2c1f72970daa415a0cbcb7e0209eb38e7aebf9db847f003fd165ca07d934e165b1c287d2f733939d3a6346790d9d2ff199e92414ebbb35792784aa1bbdd80e67dae66ffe38cd0b0bf96a86cb0a7da3add6fdfb27d90f604d44a652a15f1a047f19a9abfb1ca2022df2a8afc2a1dc593dccd7068989f0e66344c7e1c2019fdc1a1da6dcc549bb0bc96a4d024f314619648f097cd4fee349f867f93746412f5e77ea43bb9cd4ea8122a188f6529bc3acc6fb366e098539042550f2d0ce92cc21036211ff15a5be2f330c30a5f7bf956ffc89400c056a74999e84795e4afc401d0214c0c9ecd91578615ba33c47ddfa2a1df600c9e720de5cbc652bd655960566e3ecee24825c103a754316348fdde1a61ecfef180d767d1484f469204c3817b647b7d4640a87811f8f5a04a14456236bbb34f51bb51b170e070f295f6d2521fe2f895efc06f3ea746bf53e977809a6769ef1e6198c8d881ebd607cc12c7e6ef1d26ab150f51c3d87c0e88d60dccdc35bd2e7899efe8634ce38b39f4c92c45818f18885d9c3c1f31bcf1af8f82ad2fee4e0c6b88b8c3e4924bf468f21961009f494b6fbe6f4b400334987176c11f5da8ebc2e5d203758cffd379120f3699b06f0d0543ec111d635b991b6e646e9030433d339b36d155a1ba45d3e2bbf8807f84e9e90f929bf31df4f4404c3e69cb904fd4558c1349c2c94e62f59d4760044a539b57f8d072324750ade492b19ce289aabbd98769939f1f9d6adbc1eef1d271be3cd130ea630d3cc1dd12ad136e12e68cddc32e8591134b6fdfa5daa7f24411d11fd844304640646c6fe85271d8f9dcc5112a7290481685e2245300db35531376492be647d1736dee22b7a285cf1cb21ed7cbe648ce5741c7d6926a2853a11af390d957f5c963219d1f89c0a185a2ff449b2daac9ac58ef77c3353b514b5f2e166bfc726a6c45949551e19cd5a3c13b3a7cb82a213cff4245d77ffd9c8cb2bfa49a865ca484ce96afdffd030e39545f444cdb76ac84b12bca8fe59a8b84888df1e418a1678a6c065d50e9a406af0de216ccda81dce28a28bd7a74d4c1a27bc177cd799045e1986bdc787a8402701d3e17c34ebdd868c6c389a6bc129e9ac8a59ae1dcf979c3ee8213ce2de62069eb287086d1d1f1410b56d6a925a891c33213b7ad29d0cc53226ad18599d99f24d1e7b3b080e4e2a353262f33c2a5b8cb384f4b03df0dbab50a192c3655b648d8136e7563481c671f3944b53e6849a74950971699541226f146683abc76dd7f6eb5d7d6a7df2b12467ad3020d111eb673d8c2e13d301d6b38eaff3637161eb3d1e5c797058a5d0b3345c77f6c59aeae9c89b1596028cd3a73ffd7be535f560a6869e77cd312204c8ce81a7a3a18f2cd3b7ed5ee5dd43812e8a4e2e8bb3f751c38b477dbfe50a1592b6ffe5151b9dcbe68afad2b613c99f027238d5d55ecea95e00024ad39b24b94bb6e973f558a8aba9c218d4c1c063bcff5cc225ca51520812eca0be3cd7c12cace64a9c7e6b1e9dfa1e96f125a95646de55fff4b17f563115d5381e80c3a3d1a8f1d71cdc622e03aa36f25820aa9515715eaa4d314c573429a55e20b248a49a15ad5a78308f744a81b4ad2aa46933380745cfa22c8eb7cb8b92fdc74dac8daa33a3cb648df961dd0c38086f7aeeb107153aae743eb5f83f7b0509dd40bafc16582bdcc248a38f25306e45c10c2ecd22e7fa034e9370edf7dca4ea8882546709c91b4c7ad51be88a9ac835c77552a07e9afae853903fab978703ac3701c089de46bd81ca61df790c07c66cae2d7"}, 0x2c000)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5)
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:48 executing program 4:
r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000280)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r2, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sync_file_range(r0, 0x0, 0x2, 0x4)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r4=>0x0})
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r4+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  847.890358] binder: 3777:3781 ioctl 2270 200001c0 returned -22
[  847.902101] binder: 3753:3782 ioctl 2270 200001c0 returned -22
16:08:49 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700000000000000}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  847.959757] binder: 3760:3788 ioctl 2270 200001c0 returned -22
[  847.993633] binder: 3783:3789 ioctl 2270 200001c0 returned -22
16:08:49 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x7000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:49 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
getrandom(&(0x7f0000000340)=""/111, 0x6f, 0x3)
ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r0, 0x80045700, &(0x7f0000000240))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
ioctl$TIOCMBIS(r0, 0x5416, &(0x7f0000000180)=0x7f)
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
ioctl$KVM_GET_SREGS(r1, 0x8138ae83, &(0x7f0000000500))

16:08:49 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x8000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  848.242269] binder: 3799:3803 ioctl 2270 200001c0 returned -22
[  848.366036] binder: 3804:3807 ioctl 2270 200001c0 returned -22
[  848.649165] binder: 3783:3789 ioctl 2270 200001c0 returned -22
16:08:49 executing program 2:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
ioctl$RTC_UIE_OFF(r0, 0x7004)
socketpair(0x2, 0x80803, 0x1, &(0x7f0000000540)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$TCSETAW(r3, 0x5407, &(0x7f0000000580)={0x1, 0x8, 0x5, 0x8b, 0x7ff, 0x8, 0x401, 0x3, 0x101, 0x3})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
readv(r2, &(0x7f0000000240)=[{&(0x7f0000000180)=""/19, 0x13}, {&(0x7f0000000340)=""/165, 0xa5}], 0x2)
select(0x40, &(0x7f0000000280)={0x8001, 0x4430d06b, 0x8, 0x1, 0x4, 0x2, 0x1, 0xfffffffffffff800}, &(0x7f0000000440)={0x5, 0xc734, 0xffffffffffffffff, 0x13b, 0x6, 0x1, 0x80000000, 0x5}, &(0x7f0000000480)={0x6, 0x4e0, 0x5, 0x7f, 0xffffffffffffc3b2, 0x101, 0x100000000, 0x3b}, &(0x7f0000000500)={0x0, 0x2710})
socket$can_bcm(0x1d, 0x2, 0x2)
recvmsg(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f00000005c0)=""/30, 0x1e}, {&(0x7f0000000600)=""/212, 0xd4}], 0x2, &(0x7f0000000740)=""/189, 0xbd, 0x3}, 0x10020)

16:08:49 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000000}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  849.038878] binder: 3799:3814 ioctl 2270 200001c0 returned -22
[  849.057219] binder: 3810:3816 ioctl 2270 200001c0 returned -22
16:08:50 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
r0 = shmget$private(0x0, 0x1000, 0x78000020, &(0x7f0000ffe000/0x1000)=nil)
shmctl$IPC_INFO(r0, 0x3, &(0x7f0000000500)=""/167)
pipe(&(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
faccessat(r1, &(0x7f0000000340)='./file0\x00', 0x11a, 0x1001)
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x1000004, 0x0, 0xfffffffffffffffc, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, &(0x7f0000000140)={0x8, 0x0, 0xfffffffffffffff8, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000280)={&(0x7f00000002c0), 0x50})
write$P9_RXATTRCREATE(r1, &(0x7f0000000300)={0x7, 0x21, 0x2}, 0xff25)
ioctl$SG_SET_TIMEOUT(r1, 0x2201, &(0x7f0000000380)=0x5)
pread64(r1, &(0x7f0000000180)=""/15, 0xf, 0x0)

[  849.185762] binder: 3823:3826 ioctl 2270 200001c0 returned -22
16:08:50 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x10000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  849.227323] binder: 3804:3828 ioctl 2270 200001c0 returned -22
16:08:50 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$FIBMAP(r0, 0x1, &(0x7f0000000180)=0x6c3)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000240)={0x1, 0x2b9a9d86}, 0x2)
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:50 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14000000}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:50 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x700}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  849.554479] binder: 3843:3846 ioctl 2270 200001c0 returned -22
16:08:50 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x6400}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:50 executing program 0:
r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000180)={0x1, 0x10001, 0xfffffffffffffff8, 0x800, 0x380000000000, 0x8001})
r3 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r2, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  849.936145] binder: 3823:3849 ioctl 2270 200001c0 returned -22
16:08:51 executing program 4:
r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r2, &(0x7f0000000340), 0x10000014c)
r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r5=>0x0})
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r5+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
io_setup(0x6, &(0x7f0000000340)=<r6=>0x0)
io_submit(r6, 0x8, &(0x7f0000001a40)=[&(0x7f0000000380)={0x0, 0x0, 0x0, 0xf, 0xff, r3, &(0x7f0000000500)="65054bd0d1bc17c5ffbfb43ff8216b139199c1ef0bdc1fbfe48f8928c5a57ef7b2497f3ffcf61b2ce86645c820e43348cbf084c123c301ad875e7eaf735d2fee2f5b453e369e543d7a55f6a9d3ebb51a817caaccf241a79299ef628b78df397a6f68efd428300cb12c0e1426af930e6b357a40ea4f8d769c91364afb1525301e22d76d66ddea026ff1865c1bbbcf9f93a8c9d48ff7032f8c57be92b55daf267b026ce5beb45d4207902af1320545a0f151ae02d1dd2691829c4d2f18a5fd3f7ea6eb43512fad1f225fba4a4a3028063acb1d09099a34d818a6400effafaef9953c58e452a66606e5302902d0c412ef93790a21ff8f15ad", 0xf7, 0x8, 0x0, 0x1, r4}, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x7df, r1, &(0x7f0000000600)="71ed88062f8d18b00a444696eabf59edf94975bee61fd4119cc3bbfb65274137d0af22348b9371b26fb118476930473ebc725ddf2dd5b3ab9f7e7e4ba367e11cfb053e735b7014129016ebddb79d6c8397f90422aa80b86a9c91141674f154315db62c9ee4bd1579771636f59d25c6fcc7637a43763827962d53dce01e8d453ba41a68468d210e163959a4b3cad2d93f4e1e85f6e17025908ab97b2f86eb98a3850ab5f170f43d3b8c17d3475978e18fdf3db789c2760e13d40708ffcc3eefc9252d707cf0b765c8d4de3c78681011ec8323b016ee732f19a20061927d2f1cc60f66844a45e3f00a0417c8dd6d679a158eb1120f42f6312b4fc28f71b6496b5e21b6b8482850b167ee04b7a1bb4329a99918303afc2568da8dc2faf92428f56a73eeadcda0eefcfdeb5d70b4e9f9e109b560084d864bdac6d7d69375233e591aaa7cd91c3d2fcd19b0eb4e4f08ba2de0dcb0443695c784a5ab5105f6bad65d51132121cac729776ab41bd0100c8f1d3d98a27f4c831706e16afbd75ab99fd24d5b4512eda0a62756f27391137e73cbbf919ac43c31433b9092e32697f47264722eb1a9fed61bea94f87a8da45f939dc5b19a3065857f6073b5cc0223d4d01472c62938ccaff39530eb426de6eacfade15081482c4c904b0e92a86d347c979d69aa16d90ec615ef328688be15f0c037adf001988a8fe6d441b906e9a504feea3662bec9b80c8175d7179314bf1ed66ccb196c01e8712e8a7c84f80e51d5935ccfeaa818e0e9f6bba5337114a15f2a0d259376bf71df908175080c5dffca97eaebea4b9e462a95856d4fc39a018835c1ebc1de129519d0a371f5b4fdab8792b29ece64b774c4ad778eeaf1e8f0b613c4569b88df08e99b3a142e701635374ec7eeecbad60ae0f4ca76928242408b00de8fc0b92540c35451c7d470bf357b6090c7c5cf0e20ad4555cba67dc1dd3461f5fc6c33d3537e8e8686250d900295b4c4fa7bde3814229af8d789ecc2a0489bcddcd6406caf05d689c284c7228c742f0b52fbb8c8d54d5aa68468365c380655d6ec87300cbb7eeca57aec02b745018864bcb7a6f3097ecd2161598c4e431ee58ec9731a478c2f1b954ade2092e1fd0ea091f889e8f2a0d6f75f5ac1717762e780e0f39bbf065418105da5940492d07cf01d8b18c00455cf9b858dd0e9ca6764ad789cfd5ae03d5bc1d530df34514af494e3a179273ae6ca379276ac55b8efb03c4cb7ff9fb39a2d880451e5ea0c18ab7e3744485680f6e59825719e24002e19587d4ef4075d55babba24c26f8667fe51a880b9ad6626f916d02b323bfc7efa8416c780a06a4e731eb001dab747bb492b2081d8efd9a7cf5f83ba2f61e9c91b3f25c9cfb2bbb2c297c62d361477b3f1be92922e92d0d552c2d7b3616dba0ff40ee9cedbff5f91988eb39688ecd51aa6bc8059d302ee3d669819ef479a617d99e4e1657e80b7888df40d72e5bb02313335854f3ace7f780c44b808c4c077cb0abeff01240b53582ebe58907c8f5ed0fff502bf7cda9851c434b97e664aaf4520729e11e24a250eb2911548c7776edc9529b103666b66762b232d869449e5327b6bfad4fa36298697047bc8a85fe2b4c4c8026f4d0df89aa55d2bb7665864a3625d112ae03ba3610775ba031cf9def98190442c8ed3b31f2db280a65e627819c40d0dc671e2fef33120263b7b0cf465aa2470fd12f7fca525fc0d6f2059c2a8f78e84e91fc96e636b60a27abb92b56eb58a1df1772050bb0f69f0ee516a2d37b1daaa9e24729f162a7f401ecf54b56019007b46bfce0a23f6e5491b72a6b02b2a06735387184ad715defa6ab847c3ccc9e99caf48ffd2e1381b6cac4f0fbf8bee00f2e94605beccd0987d047afd97bacbbfdeba8db16029029704dc06401fc43e6ecd85b04882771c1be37999daaac7db6c4e187122e201d0d8b6ae1daba94d3571c0f2a7ef3e582f7fd11f8fc259b61c747b8363895026f61cfa27efcfc6112cc2d74c1b3d734a2bab378507bf857c626425d2a6e080f05abfde8711a9905544592a13f23ce788db4b158e99a387276302372568e5815ba6aa479100c69bff796eeff0f71e319f7da6411bbdd12b4d60eaf2d96e77c8ccccedb7cc5d0ba5a6f43d6efd41ed05bc56b99ec35de7c21b996a5b643b9aa9982d0aaa725abbd3bff42fc80be72a0c7d32b6f723d2ba61f9465a885c3360b01a36a98929dc9210defbefb35c51f4b29578fe48a2b0b6b3b14a70a3117c26eb119fa85bee62350d9bc9a57ebab9dd42f8b7b62d9dc8db5ab680ceb89098ae75f90f35fb2b140b4834bcbcc1bca938ab7005ee4b9c691fdcdc72bab0fbb127673aace77895e0079d64751b85af8ec6d18ee54ead76b73ea0b6163f724416b39f378ed5199dcfb704a5eef086182ccbef43917008960e8086357ef55c907f58b302bbf8c1a9d88ed5f2935de7215b826c28602272ffe0f38b50b78bde3cfeffa8d6fca96db77412748daa7205d31501d8d04276f0c4b62bf527374859edd0f50c237ed76fed35c60186189720cd473a8ddac84336258f4f217de4752ceaf3e3df22794016178d95636987db33a815a1c41b8ad91444cc8200c66909d12a8cb2bfc20f79ecaa0cddfe758be51ec7941b3d0590efc71b3327a5169c44fc3e78b40149ee00c19034790674bd04124fa8d3758bc809a0b362d7c8121e495c1abc7c19d38b628a9aac28abcaed7593f7017ff437d319ebf39377b2591453c60360feffd415ea2aa3b6c702df24d3c5328ca93abb53625eb3786a7ed0123d19073b0eddc01c481e1641a7cdcba73fe8047fadb0d2728d18516c2244f2771ed15aaabbb952356a5a52bfb704a8239ec7f96a7239c482342e6567099ed6f1d044acc3a6023390210e127e46813980515c5c2ab88dd76e84660980bcfd64984fcc89b2d88634850fe436ec1b4eaaecd46613f935835cd8ba6bc3f8a8e2c4448aa4922fee7e9109429561407238f4f3c8071317827f068bae3d3a91cee987efe7594a623da35a104b5221d706e799366440e368853143f0d524a45aa6725ccf455045a068fdac3551337d5573b6b3f1d195be1f7f1192d1d4054b416fd9e64b8097101dec9193e03ef85e2891138bfe930e7fe0a3e7b79a3387e38f018d839ddd645de0f29249e15e8d62bec0af2b9ce3f9b23fe67ed3ae67e487362e844076683ba92be6d85db9fb22f858f996ba0dfcce60118c3a9ea0e2d10191606d1ae7a5d2deacf9a9b8a9abd1fe2c6bbf7dd787e87178b2e993a398b70c93048c003eece1cbb4ddbb39d0302e3e8866af80c27f71281c1f00f657080fc53a777bf626bb016503a21c8ff63671efe66d368d464a6dc9a408cec1080a175b9d35a9603d5db5d81823b5ededeb9b63009355022f00b49084e0186bad4660d1710884cc0e534f44c737a7aa8406fca239be0ffa2802ed75f7748478855996000f564a1fbdd2fc2260cf41211cbe7e02193fd565db5a582b2b5af23273b74a3b75dda7afc0ead17733e1fdd5b85bd3cc6c95864a97a02d1d31568e6a538201f04a76d2cd74f90eb62e59ca0a4638f280afe1e971c61a5f3d29102ebb7795eeb6701b42bb0dc4002f5f11604088cb9697d8a43f81eeacd86f87d7b4fd1af85f4a589b4bc1baf08f23704672f5ebc1bef8b460c0233026e1617965b03dc6f8819a60cd59269fa3ca2be3c5713650a15acf7c3f2f9f94eeb47bd73d769eb424abe8e97544285d9af7216fb63c5ee2161c95922e7f29c189a9e090960b246243e52c1ffdf7fd51eb9a67790b14ad7b818d5cfcbfa361907477487a4a848064efdae54b2c824484dc950d6466058dcb2abae672385b3de7c4f603a4dfd5cccf59e90fd102c7b54d24a4ba68deb5028dc5e921425d66ee0401ce39fc6525eeaadd002e62eee2558fe7f5dd762f02b3cb86ff6773f13ad49f0aa71e354ffc9bde5b7443e079d825025d2a7d29cab40eea7ff417578397414e0c43f0d346c8fa8400bf15996637dd6f52fac9521a11965ba86b1e0b07c6d8b5b4a2bf09ff1a215dc048e51738a1468b7bc01d4851c36a38f9e0ea83f77757235e03ebb81e54122921b2fc2fe94a074567cd517570f6103a8612c85498f32ba0460c7fd44959efe79922af9a2e2eae06b3556ece5bcfdb5490826d82cf7eba6cc313a68679f17ba58b56b7c468b5ca2ca1d97aea96ca8ac6d6cfc15271a9c89ee296490623271d87d276581c1b98989badad0e376acdc3b85accf9a33604e6c601c529aa714a5258fea75a29d729754153569571a41fb9f5977f39dc72d90a587d6ded520aa7980d6196fecdbe10f8a78b3d17ed7661094a5c6d9d73b5dfa38f5a7855d81c0d27c634bb69e4ff23683c2f8387e2c11c814657cd1bab2fa0cf8d9c702c1fe08465185d98a594edc53bc1c47ad118d409605a4040f8c700aa7750eaa8f93d670d4b0027b060f5d6a2752b337d630d186edcedbfc99b906f7b38b42dc745392a7e111899d06b63906abe1c3f798cb6573f35b19691d7106a416ec4f824ced47e9996d3e62ae32adbf61e6e36fef76bf7b0522d004ad2f6e4084aa8d11da0b861358eaf72bfa946a6aa0753960405ff42720923a46818768b456a22458e3d94328f30079d76dce79b2356c250693e34cf2ec5e3d64b9419dd38b9e9b89bd0eff63474a9c08cca666ec75de6fd8ac253578862b2c848192718fbf8bd9d9ee1f7b3332063336c3ea04b7b2cd82414d1348d2e8aedaf55fdc75bdd376a0a698fed18afc75e56763ffa9d8530a78379f65b22a44ffc17c51c96cfb2544678d2a011056fd7bbde8421729f35acc48b67d2c3e175e7caf43f07e49d27f0817f2450b9c602f2ed9cc562f1c84cea9bbee7296f5ab0c9b973a7eb633a791072beee837bd0789d060a8bb90fb1a0dcda95056d10a7d8c280c4d0beeaa233196c6222a715b009d983dffc7abc30fb4db276328321be716004b23b143239c25a5d5005e84f593269a25654023695394c1d77a44c89641de3c09a0af9ac66559029d5f6efb8364ac4414a9e1ffccf97656bb3338667aa70fb5b6991df4c002766408d4690e57a75104529205424cfb187965aabc64cb576eb7b203d0f64a522312ead4dcf527eef777985098fc4e0d12e8ac09fdb33fcc2955edd9052a2d3a7ddbe1570cbf102cab1b1930682caa7b869df8380c026721eba34197c07e75242b5074cd13ffec1094c1c766e240717f5542014f70711c647594abaa870829287ca871beb0719e3cfd92752194cc928764ae4ed8007578530d2ed46f342c9ba38f1b7839e32d41de2d8ea4125c6958d176e5ce9d52fcf749cf7894d6b8cda3779bf6b79bb6badafcf8a09e51daea4acf7ee89c6eccc4f8e8ef400342d646c77f3fe44324678bb130ae1d9fb7d35d5a274c3c728dd62e7688867c49c1d8503f51a40367963fbe79d29106e1b12d875e6178afc448345e36773a8b4bd4196ef7a29d3cd24883ff8dbe58e88f20d14aa880bf49197eb829e7134d35dc519135d0daabad716917fd168716c65dba7f6b17a318edb48d7c41389657d79f9ac3dabb6a066077e657873599271fda0481c43627f2ad92c1e05bd1d4bf6fb7274258fe45f6f6e8994d42fc18da5afc0faa31e07d33f5df1023629be33cbe0fc6ea00c8b8cbcb3b78da11cb75cfcb1717865e1ff56fd7d1f56522459f5addd29491a63bd8da8dd713a8ee5c2678a845ea05d452712156e42a31ac66e7988fdb1c080e92dcd6aad784a68acc82b84fe8bfd2d260d54de9349af5", 0x1000, 0x6, 0x0, 0x0, r1}, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x7, 0x0, r2, &(0x7f0000001600)="90d3dc2a92f5512484064eb023cd29f25d125ff18bf783c28c6474b616111a416bfb62893fbb98b001835da888793b8d945861debe515e2f473067e0a9cf92a5263ccd5f7bae3f6e8d0720c21d9cd4e9899baa69a5dd10d5d4e46c0a344a23dfa451da22abfbcc175a3adc826fb70849c94c58bf4f249165102da2ffe64d8d0e256ec733023ad76b5e58144cebd0338f46fe55ef77f3957b4f56c304487a4132b7191063d7", 0xa5, 0x0, 0x0, 0x0, r1}, &(0x7f00000016c0)={0x0, 0x0, 0x0, 0x0, 0xf0, r0, &(0x7f0000000480)="fdcf199214949bd0e8637a0db06fe89b95f68a2583d7f91ededab08dbe1deb6d75f0f0c52218c8375037ccfdccc713", 0x2f, 0xffffffffffffffff, 0x0, 0x1, r1}, &(0x7f00000017c0)={0x0, 0x0, 0x0, 0x7, 0x4, r2, &(0x7f0000001700)="6ca2bc7de7c611e19e15a1c7d2bf030270a7981ea2c34aef899a195c9d15bffc3ef5ea7eb6f0c31311a123b70f91afd44b98fe1f684865362c1d7f8d020da0e63dcc69f67cd34b2315e67e8314d4b27210b6b58e33d8e1388de1faf4f5a44dd6a3535b3a989f1c97fe29aa5185f56b11bd9f0b17e3631425eccc81b26d517b834c0da2c92d08cae71e9eefb252afff82afcdaa5bcfb0db5ad6f315e49ccc2375f7d9", 0xa2, 0x3, 0x0, 0x1, r1}, &(0x7f00000018c0)={0x0, 0x0, 0x0, 0x7, 0x5cf, r0, &(0x7f0000001800)="242189d49b6fb15460c2c69d5de8c594ada5c7a5457c0a63e5c7c2ba873a0ed7ab149e915d6d4fd72a8448a0589ff51df4a6d19ea00930823551cf0e99cab08aee2e0c8d37130f1bf74d44276208b349ca3087d5739a329450eba5428e8fab00a3aaf345bfda1ea17d0f9d92e8b0e503e4d78db190547085dba0b228c7790dd8391356b075de2791a735eeef371f6e315e8206727507d66017e7c7cdc6a87444dc9a1620b58ca6a6d0334cdbd476253474f8dde7", 0xb4, 0x1, 0x0, 0x0, r1}, &(0x7f0000001980)={0x0, 0x0, 0x0, 0x0, 0x5, r0, &(0x7f0000001900)="cdc32883e4eeba01f57faf552c35f99e10b1b4275d517a485d8e8a8f724a09686e1773e275be86eac2b899a64cf560b96dd56932064511e4736b867db27a1101c730eb", 0x43, 0x656, 0x0, 0x2, r1}, &(0x7f0000001a00)={0x0, 0x0, 0x0, 0x7, 0xfffffffffffffff8, r4, &(0x7f00000019c0), 0x0, 0x1, 0x0, 0x2, r2}])
vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
syz_open_dev$mice(&(0x7f0000000280)='/dev/input/mice\x00', 0x0, 0x200000)
setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000000180)=0x42, 0x4)

[  850.074709] binder: 3853:3860 ioctl 2270 200001c0 returned -22
16:08:51 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58020000}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  850.136861] binder: 3857:3863 ioctl 2270 200001c0 returned -22
[  850.244397] binder: 3843:3847 ioctl 2270 200001c0 returned -22
16:08:51 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x3f00}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  850.482090] binder: 3871:3873 ioctl 2270 200001c0 returned -22
[  850.618125] binder: 3857:3866 ioctl 2270 200001c0 returned -22
[  850.876124] binder: 3853:3880 ioctl 2270 200001c0 returned -22
[  851.075831] binder: 3871:3873 ioctl 2270 200001c0 returned -22
16:08:52 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

16:08:52 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x7}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:52 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240))
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x3c, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x1000, 0x7ff, 0x200}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1}, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:52 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:52 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:52 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x6400}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  851.560895] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  851.596827] binder: 3885:3895 ioctl 2270 200001c0 returned -22
[  851.601693] binder: 3889:3897 ioctl 2270 200001c0 returned -22
[  851.604427] binder: 3883:3898 ioctl 2270 200001c0 returned -22
16:08:52 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  851.875354] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:08:53 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  852.360956] binder: 3885:3912 ioctl 2270 200001c0 returned -22
[  852.372964] binder: 3889:3914 ioctl 2270 200001c0 returned -22
[  852.375146] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  852.397351] binder: 3883:3916 ioctl 2270 200001c0 returned -22
16:08:53 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:53 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x3f00000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:53 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x8b}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:53 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:53 executing program 4:
r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r2, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r4=>0x0})
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f00000001c0))
getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000500)={{{@in, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0}}, {{@in6=@dev}, 0x0, @in=@multicast2}}, &(0x7f0000000280)=0xe8)
fsetxattr$security_capability(r0, &(0x7f0000000180)='security.capability\x00', &(0x7f0000000340)=@v3={0x3000000, [{0x1, 0xffff}, {0x80000000, 0x5}], r5}, 0x18, 0x2)
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r4+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:53 executing program 2:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x1a, &(0x7f00000000c0)={0x0, 0xfffffffffffffffe, 0x4}, &(0x7f0000000340)={0xfffffffffffffffd, 0x7}, &(0x7f0000000180)={0xffffffff, 0x0, 0x9, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x2}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  852.664007] binder: 3924:3933 ioctl 2270 200001c0 returned -22
[  852.687170] binder: 3926:3934 ioctl 2270 200001c0 returned -22
[  852.698214] binder: 3930:3937 ioctl 2270 200001c0 returned -22
[  852.834938] binder: 3938:3942 ioctl 2270 200001c0 returned -22
[  853.450566] binder: 3930:3945 ioctl 2270 200001c0 returned -22
[  853.471881] binder: 3924:3947 ioctl 2270 200001c0 returned -22
16:08:54 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x64}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:54 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  853.545933] binder: 3926:3941 ioctl 2270 200001c0 returned -22
16:08:54 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
ioctl$VHOST_GET_VRING_BASE(r0, 0xc008af12, &(0x7f0000000180))
socket(0x9, 0x3, 0x7)

16:08:54 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x1, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:54 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x3f00000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:54 executing program 2:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x8601000000000000}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  853.771286] binder: 3958:3965 ioctl 2270 200001c0 returned -22
[  853.780196] binder: 3957:3967 ioctl 2270 200001c0 returned -22
[  853.807035] binder: 3963:3968 ioctl 2270 200001c0 returned -22
[  853.937882] binder: 3973:3976 ioctl 2270 200001c0 returned -22
[  854.507721] binder: 3958:3971 ioctl 2270 200001c0 returned -22
[  854.539811] binder: 3957:3980 ioctl 2270 200001c0 returned -22
16:08:55 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x1c5}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:55 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1400000000000000}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  854.589770] binder: 3963:3983 ioctl 2270 200001c0 returned -22
16:08:55 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
ioctl$TIOCSWINSZ(r0, 0x5414, &(0x7f0000000180)={0x1ff, 0x3, 0x9, 0xffffffff})
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:55 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0xfffffffffffffffc, 0xa1, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4a, 0x0, 0x0, 0x0, 0x3, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xc, r1, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:55 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1000000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:55 executing program 2:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x64}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  854.755495] binder: 3995:4002 ioctl 2270 200001c0 returned -22
[  854.825559] binder: 3999:4008 ioctl 2270 200001c0 returned -22
[  854.870429] binder: 4004:4010 ioctl 2270 200001c0 returned -22
[  855.339464] binder: 3999:4008 ioctl 2270 200001c0 returned -22
16:08:56 executing program 0:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x100, 0x0)
write$binfmt_elf32(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="7f454c4682060008ee0000000000000002003f00ffff0000b000000038000000280000000400f5ff600020000200040072000101000000000700000000080000ff07000009000000070000000000000004000000ff7f000003000000930a0000ff01000000000000001000000200000040000000ffffff7f537aa72f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c284168eec68e48dcc45e063e20d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000"], 0x17c)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000680)='/dev/binder#\x00', r0}, 0x10)
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$TUNDETACHFILTER(r1, 0x401054d6, 0x0)
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
clock_gettime(0x0, &(0x7f0000000380)={<r3=>0x0, <r4=>0x0})
pselect6(0x40, &(0x7f0000000240)={0x1f00, 0x6, 0xffff, 0x1, 0x0, 0x4}, &(0x7f0000000280)={0x3, 0x1, 0x4, 0x400, 0x8, 0xfff, 0x2b, 0x100000001}, &(0x7f0000000340)={0x6, 0x2, 0x8, 0x7, 0x81, 0x1, 0x2, 0x9}, &(0x7f00000003c0)={r3, r4+30000000}, &(0x7f0000000480)={&(0x7f0000000440)={0x1}, 0x8})
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
getpeername$netlink(r0, &(0x7f0000000700), &(0x7f0000000740)=0xc)
vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000700)}], 0x1, 0x0)

16:08:56 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  855.503286] binder: 3995:4019 ioctl 2270 200001c0 returned -22
[  855.520181] binder: 4016:4020 ioctl 2270 200001c0 returned -22
16:08:56 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:56 executing program 4:
r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pselect6(0x40, &(0x7f0000000180)={0x0, 0x9, 0x2, 0x5, 0x18000000000, 0x0, 0x400, 0x6560}, &(0x7f0000000280)={0x100000000, 0x8, 0x90, 0x800, 0x5, 0x9, 0x5, 0xff}, &(0x7f0000000340)={0x8, 0x86b9, 0x3, 0x6, 0x3, 0x7f607164}, &(0x7f0000000380), &(0x7f0000000440)={&(0x7f00000003c0)={0x1ff}, 0x8})
pipe(&(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r2, &(0x7f0000000340), 0x10000014c)
ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r0, 0x5386, &(0x7f0000000500))
r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
flistxattr(r4, &(0x7f0000000540)=""/108, 0x6c)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r5=>0x0})
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r5+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
ioctl$BLKRESETZONE(r2, 0x40101283, &(0x7f0000000480)={0x7, 0x6})

[  855.617944] binder: 4004:4025 ioctl 2270 200001c0 returned -22
16:08:56 executing program 2:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f00000003c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000240)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000180)={<r3=>0xffffffffffffffff}, 0x2, 0x100f}}, 0x20)
write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000340)={0x3, 0x40, 0xfa00, {{0xa, 0x4e24, 0x81, @ipv4={[], [], @local}, 0x9}, {0xa, 0x4e24, 0x4bf4, @local, 0xf20b}, r3, 0x6}}, 0x48)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:56 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  855.743314] binder: 4031:4033 ioctl 2270 200001c0 returned -22
[  855.838234] binder: 4037:4042 ioctl 2270 200001c0 returned -22
[  855.862460] binder: 4035:4044 ioctl 2270 200001c0 returned -22
16:08:57 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
clock_settime(0x0, &(0x7f0000000180))
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
r3 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x4, 0x11, r2, 0x48)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0xb4, 0x0, &(0x7f0000000500)=[@reply_sg={0x40486312, {{0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x40, 0x28, &(0x7f0000000280)=[@flat={0x776a2a85, 0x100, r3}, @ptr={0x70742a85, 0x0, &(0x7f0000000240), 0x1, 0x4, 0x1a}], &(0x7f0000000340)=[0x28, 0x48, 0x40, 0x18, 0x30]}, 0xab73}}, @request_death={0x400c630e, 0x4}, @enter_looper, @dead_binder_done={0x40086310, 0x3}, @transaction={0x40406300, {0x0, 0x0, 0x2, 0x0, 0x10, 0x0, 0x0, 0x48, 0x30, &(0x7f0000000440)=[@ptr={0x70742a85, 0x1, &(0x7f0000000380), 0x1, 0x4, 0x20}, @fda={0x66646185, 0x0, 0x3, 0x3a}], &(0x7f00000003c0)=[0x18, 0x38, 0x38, 0x30, 0x20, 0x38]}}, @exit_looper], 0x3, 0x0, &(0x7f00000005c0)='S2U'})

16:08:57 executing program 2:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
r0 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(0xffffffffffffffff, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0)
write(r1, &(0x7f0000000000)='-', 0x1)
ioctl$SG_GET_COMMAND_Q(r0, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  856.285964] binder: 4016:4046 ioctl 2270 200001c0 returned -22
16:08:57 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x6400000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:57 executing program 2:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
r0 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(0xffffffffffffffff, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0)
write(r1, &(0x7f0000000000)='-', 0x1)
ioctl$SG_GET_COMMAND_Q(r0, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  856.403697] binder: 4049:4052 ioctl 2270 200001c0 returned -22
[  856.419486] binder: 4050:4053 ioctl 2270 200001c0 returned -22
16:08:57 executing program 2:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x3f00000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  856.485571] binder: 4058:4059 ioctl 2270 200001c0 returned -22
16:08:57 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  856.539345] binder: 4031:4032 ioctl 2270 200001c0 returned -22
[  856.589026] binder: 4037:4045 ioctl 2270 200001c0 returned -22
16:08:57 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r3 = syz_open_dev$vcsn(&(0x7f0000000180)='/dev/vcs#\x00', 0x3, 0x400002)
write(r1, &(0x7f0000000340), 0x10000014c)
ioctl$ASHMEM_SET_SIZE(r1, 0x40087703, 0x8)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x22, &(0x7f0000000280)={0x3, 0x8001, 0x4c5f, 0x1, <r4=>0x0}, &(0x7f0000000340)=0x10)
setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r1, 0x84, 0x79, &(0x7f0000000380)={r4, 0x4, 0x7}, 0x8)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r5=>0x0})
connect$bt_rfcomm(r2, &(0x7f00000003c0)={0x1f, {0xc116, 0x10001, 0x81, 0x27a}, 0x3}, 0xa)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000440))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r5+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:57 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x700}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  856.774611] binder: 4071:4077 ioctl 2270 20000440 returned -22
[  856.808544] binder: 4074:4079 ioctl 2270 200001c0 returned -22
[  857.187309] binder: 4050:4082 ioctl 2270 200001c0 returned -22
16:08:58 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r0, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r1, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500)}], 0x1, 0x0)

16:08:58 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x64000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  857.369871] binder: 4074:4079 ioctl 2270 200001c0 returned -22
[  857.428940] binder: 4085:4087 ioctl 2270 200001c0 returned -22
16:08:58 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x187}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:58 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5802000000000000}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:58 executing program 2:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x3f00000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  857.570495] binder: 4071:4081 ioctl 2270 20000440 returned -22
[  857.580286] binder: 4092:4102 ioctl 2270 200001c0 returned -22
16:08:58 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/userio\x00', 0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a50}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  857.729505] binder: 4107:4111 ioctl 2270 200001c0 returned -22
16:08:59 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0xc501}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  858.185161] binder: 4085:4113 ioctl 2270 200001c0 returned -22
[  858.242534] binder: 4092:4105 ioctl 2270 200001c0 returned -22
16:08:59 executing program 2:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x3f00, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:59 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x40000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:59 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:08:59 executing program 0:
r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000280)='/dev/userio\x00', 0x7f, 0x0)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f0000000340))
pipe(&(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$RTC_EPOCH_READ(r1, 0x8008700d, &(0x7f0000000180))
write(r2, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$sg(&(0x7f0000000240)='/dev/sg#\x00', 0xff, 0x101000)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  858.431534] binder: 4120:4123 ioctl 2270 200001c0 returned -22
[  858.467568] binder: 4107:4125 ioctl 2270 200001c0 returned -22
[  858.500986] binder: 4122:4128 ioctl 2270 200001c0 returned -22
16:08:59 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
r0 = creat(&(0x7f0000005180)='./file0\x00', 0x4)
setsockopt$IP6T_SO_SET_ADD_COUNTERS(r0, 0x29, 0x41, &(0x7f00000051c0)=ANY=[@ANYBLOB="6d616e676c65000000000000000000000000000000000000000000000000000005000000000000000000000000000000000000000000000000fd0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x78)
pipe(&(0x7f0000000280)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000640)='IPVS\x00')
sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000500)={0xb4, r3, 0x800, 0x70bd2a, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xfffffffffffffc01}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x7}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0xff}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0xf27}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_STATE={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x5}, @IPVS_CMD_ATTR_DEST={0x3c, 0x2, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@dev={0xac, 0x14, 0x14, 0x13}}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x40}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e23}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x4000)
r4 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000480)=<r5=>0x0)
perf_event_open(&(0x7f00000005c0)={0x4, 0x70, 0x3, 0x100, 0x63, 0xffffffffffff7fff, 0x0, 0x1, 0x0, 0x2, 0x100000, 0x3, 0xffffffffffff93ad, 0x82ac, 0x400, 0x0, 0x3, 0xe39, 0x400, 0x2, 0xfffffffffffffffc, 0xffffffff, 0x81, 0xd1a, 0x94, 0x4c0d, 0x2, 0x6, 0x8, 0x5, 0xfffffffffffffff8, 0x8, 0x2, 0x80000001, 0x0, 0x8, 0x8, 0x0, 0x0, 0x8000, 0x1, @perf_bp={&(0x7f0000000380), 0x5}, 0x20040, 0x1, 0x8, 0x5, 0x4, 0x774, 0x80000000}, r5, 0x7, r4, 0x2)
write(r2, &(0x7f0000000340), 0x10000014c)
r6 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TIOCSCTTY(r2, 0x540e, 0x4)
open_by_handle_at(r6, &(0x7f0000000680)=ANY=[@ANYBLOB="25b64693db7fea085c0d0c34b11a000000f43d291992ab71a5d06dc735d0fb15ccc8f0a26d1988e854e6db3859862775689a06159b2411312bb6530ed7c98c52d3dffd3408cff9f883e3afc998682800ab7e58ece39b1dfcbd46a8ff4b73e38f5118a9d1d72228693c69a12a440a2d581077fd027ee6c591b5801ed5ad944be82417"], 0x1)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r7=>0x0})
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r7+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  858.586484] binder: 4131:4133 ioctl 2270 200001c0 returned -22
[  858.748305] binder: 4137:4140 ioctl 2270 200001c0 returned -22
16:08:59 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0xc501000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  859.175097] binder: 4120:4123 ioctl 2270 200001c0 returned -22
16:09:00 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x87010000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  859.356975] binder: 4131:4149 ioctl 2270 200001c0 returned -22
16:09:00 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:00 executing program 2:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x40000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:00 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
getsockopt$EBT_SO_GET_INFO(r1, 0x0, 0x80, &(0x7f0000000240)={'broute\x00'}, &(0x7f0000000180)=0x78)
mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1000000, 0x150810, r2, 0x0)

[  859.459678] binder: 4150:4154 ioctl 2270 200001c0 returned -22
[  859.473035] binder: 4137:4156 ioctl 2270 200001c0 returned -22
[  859.563212] binder: 4158:4164 ioctl 2270 200001c0 returned -22
[  859.570090] binder: 4157:4163 ioctl 2270 200001c0 returned -22
16:09:00 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/userio\x00', 0xfffffffffffffffc, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000000280)={<r3=>0x0, 0x401}, &(0x7f0000000340)=0x8)
openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f00000003c0)='/proc/self/attr/exec\x00', 0x2, 0x0)
setsockopt$inet_sctp6_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000380)=@assoc_value={r3, 0x5}, 0x8)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r4=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r4+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:00 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  859.774150] binder: 4169:4172 ioctl 2270 200001c0 returned -22
16:09:01 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1400}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  860.232045] binder: 4150:4161 ioctl 2270 200001c0 returned -22
16:09:01 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8701}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  860.347339] binder: 4158:4181 ioctl 2270 200001c0 returned -22
16:09:01 executing program 2:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x40000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:01 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x2)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  860.470397] binder: 4185:4188 ioctl 2270 200001c0 returned -22
[  860.515027] binder: 4169:4176 ioctl 2270 200001c0 returned -22
[  860.545702] binder: 4189:4196 ioctl 2270 200001c0 returned -22
[  860.570666] binder: 4191:4197 ioctl 2270 200001c0 returned -22
16:09:01 executing program 4:
r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r2, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r4=>0x0})
io_setup(0x3c1, &(0x7f0000000180)=<r5=>0x0)
io_cancel(r5, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x4, r0, &(0x7f0000000340)="e884cfcf22535940aa3b1d52089e9afa175b96b5707f913d8e2d975f4cf1aab521cbc74ea3959bba689f11300ee38a8e66bca1c8c632f5abc1bdb255d9404b51ff8b513d360f80b7995b72272d3557d8aa7592338411c1d95cf375eee9d43fa49f26261e1e8c1b8df925d6373450f1a85ed542dbe0e2", 0x76, 0x3bd, 0x0, 0x2, r1}, &(0x7f00000003c0))
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r4+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r1, &(0x7f0000000000), 0x0, 0x0)

16:09:01 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x8000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  860.832594] binder: 4202:4204 ioctl 2270 200001c0 returned -22
16:09:02 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  861.124736] binder: 4185:4188 ioctl 2270 200001c0 returned -22
16:09:02 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x800000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  861.348247] binder: 4191:4218 ioctl 2270 200001c0 returned -22
[  861.364682] binder: 4216:4221 ioctl 2270 200001c0 returned -22
16:09:02 executing program 2:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x87010000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:02 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
ioctl$DRM_IOCTL_ADD_BUFS(r0, 0xc0206416, &(0x7f0000000180)={0x81, 0x7, 0x5, 0x1ff, 0x2, 0x7})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  861.513985] binder: 4223:4226 ioctl 2270 200001c0 returned -22
[  861.547312] binder: 4202:4229 ioctl 2270 200001c0 returned -22
[  861.577235] binder: 4225:4230 ioctl 2270 200001c0 returned -22
16:09:02 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:02 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x10}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:02 executing program 4:
r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vcs\x00', 0x0, 0x0)
ioctl$TIOCSTI(r0, 0x5412, 0x7fff)
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r2, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r1, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@decrefs={0x40046307, 0x3}, @register_looper], 0x4e, 0x0, &(0x7f0000000380)="6e76cedc5a6e2bfc659226be7a938eadb2442522738f5b916d320bcdade3fffb12d59e693cb11239b92794aee41d70ede3cfd94add13c459f4f6b9b978d52d13e99ca79cfa484b0be78d4610dccc"})
open$dir(&(0x7f0000000180)='./file0\x00', 0x48000, 0x100)

[  862.046763] binder: 4216:4221 ioctl 2270 200001c0 returned -22
16:09:03 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x10}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  862.350909] binder: 4225:4249 ioctl 2270 200001c0 returned -22
16:09:03 executing program 0:
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
clone(0x2102001ffb, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff)
r0 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x2, 0x0)
mount$9p_fd(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfgno', 0x3d, r0}})

[  862.411646] binder: 4250:4254 ioctl 2270 200001c0 returned -22
[  862.498513] 9pnet: Insufficient options for proto=fd
16:09:03 executing program 2:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x87010000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:03 executing program 0:
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
clone(0x2102001ffb, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff)
r0 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x2, 0x0)
mount$9p_fd(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfgno', 0x3d, r0}})

[  862.656204] binder: 4259:4262 ioctl 2270 200001c0 returned -22
[  862.714062] 9pnet: Insufficient options for proto=fd
16:09:03 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5802}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:03 executing program 0:
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
clone(0x2102001ffb, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff)
r0 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x2, 0x0)
mount$9p_fd(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfgno', 0x3d, r0}})

16:09:03 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  862.935946] 9pnet: Insufficient options for proto=fd
16:09:04 executing program 0:
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
clone(0x2102001ffb, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff)
r0 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x2, 0x0)
mount$9p_fd(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfsno', 0x3d, r0}})

16:09:04 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340)="a5bedc6a5f706abbdc48365004943c7d499b4ca1159afe0ed198c4eff9e3c3ca20eb04fd409415775d2a30c6bea49957a86da7463c1840bd97aebf59c3b223cf223cd8cef99ddb510092e15b17ebd112e98423faeddab152d724", 0x5a)
ioctl$KVM_XEN_HVM_CONFIG(r0, 0x4038ae7a, &(0x7f0000000280)={0x5, 0x31f, &(0x7f0000000500)="84df2eeb8cea7b91f400eb555dc600a9273b1ecac24e115a91844e2cb994f4634cf1dc78f7c7d054c0df47f4d6de37447f7e4a650e3cc2f3b4c7fa3f3bfd350ed085cdecd433db479bca79ec5c161adbaf2a93fcde5d00ebae904c8a4c754055c9b6abc1e023aabba1ebc32820d9927d72a5f86892fb519bb85515d51a9dd244497f4bf1a005961deac25c3504d2e9de6592ac7455ae7cad5d7764", &(0x7f0000000180), 0x9b})
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  863.057811] binder: 4250:4254 ioctl 2270 200001c0 returned -22
[  863.079762] 9pnet: Insufficient options for proto=fd
16:09:04 executing program 0:
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
clone(0x2102001ffb, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff)
r0 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x2, 0x0)
mount$9p_fd(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfsno', 0x3d, r0}})

[  863.123393] binder: 4290:4291 ioctl 2270 200001c0 returned -22
16:09:04 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x7}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  863.182361] 9pnet: Insufficient options for proto=fd
16:09:04 executing program 0:
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
clone(0x2102001ffb, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff)
r0 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x2, 0x0)
mount$9p_fd(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfsno', 0x3d, r0}})

16:09:04 executing program 0:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000, 0x0, 0x0, 0x0, 0x7}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  863.301022] 9pnet: Insufficient options for proto=fd
[  863.307058] binder: 4296:4300 ioctl 2270 200001c0 returned -22
[  863.359568] binder: 4290:4291 ioctl 2270 200001c0 returned -22
16:09:04 executing program 2:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x87010000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:04 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$sock_SIOCGIFBR(r0, 0x8940, &(0x7f0000000280)=@get={0x1, &(0x7f0000000500)=""/242, 0x20})
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
r4 = gettid()
ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f0000000180)=r4)
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:04 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x7000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  863.548266] binder: 4309:4315 ioctl 2270 200001c0 returned -22
[  863.559134] binder: 4311:4316 ioctl 2270 200001c0 returned -22
16:09:04 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x258}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  863.869851] binder: 4296:4305 ioctl 2270 200001c0 returned -22
16:09:05 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x64}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:05 executing program 0:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000, 0x0, 0x0, 0x0, 0x7}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  864.165985] binder: 4328:4330 ioctl 2270 200001c0 returned -22
[  864.260783] binder: 4311:4312 ioctl 2270 200001c0 returned -22
16:09:05 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000180))

16:09:05 executing program 2:
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
clone(0x2102001ffb, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff)
r0 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x2, 0x0)
mount$9p_fd(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x3000000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r0}})

16:09:05 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x3f000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  864.466591] binder: 4338:4344 ioctl 2270 200001c0 returned -22
[  864.545697] binder: 4328:4330 ioctl 2270 200001c0 returned -22
16:09:05 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8701000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:05 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x200000c8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:05 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x39000}], 0x1, 0x0)

[  864.736436] binder: 4352:4355 ioctl 2270 200001c0 returned -22
[  864.843506] binder: 4358:4362 ioctl 2270 200001c0 returned -22
[  865.029213] binder: 4338:4348 ioctl 2270 200001c0 returned -22
16:09:06 executing program 2:
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
clone(0x2102001ffb, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff)
r0 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x2, 0x0)
mount$9p_fd(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x3000000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r0}})

16:09:06 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x700}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:06 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x8, 0x0, 0x1ff, 0x0, 0x50d, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe63}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pipe(&(0x7f0000000180)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r4=>0x0})
write$binfmt_aout(r3, &(0x7f0000000e00)=ANY=[@ANYBLOB="08010008880200002c00000000040000db010000e0ffffff0000000000000000e57c54370000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e9e69b6c212a25e91d8a068bac2c268720a2c780d1405b55e95addb6a957a3e9f1e3e8f05acb496186be33c14007516e1e3044d69e60b164352fbb1c28a174849d48429231fc604a09f7324f3bb6944cc0e3b7f628a2f6aff9c009055f68fa729b555fa4323a875aa185b354d2bad1a01160efb6bbd5a93771f129e14c746efd9d9ad27035e5abf688299e65d782a5653d415eeae19821e20ec57b4d6cb01aaf7f317f4f6d2bcedb4f03a3b2c71b87fcaebe5c8905d3283545da75caea86dc590458be06c71d85fdec9f36"], 0x824)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r4+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:06 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x20000108}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  865.400354] binder: 4366:4374 ioctl 2270 200001c0 returned -22
[  865.487044] binder: 4352:4360 ioctl 2270 200001c0 returned -22
16:09:06 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x700000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  865.684686] binder: 4382:4384 ioctl 2270 200001c0 returned -22
16:09:06 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x20000148}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:06 executing program 0:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000, 0x0, 0x58020000}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  865.877162] binder: 4366:4374 ioctl 2270 200001c0 returned -22
16:09:07 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0x0, 0x1)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
ioctl$sock_bt_bnep_BNEPGETSUPPFEAT(r1, 0x800442d4, &(0x7f0000000440)=0x8)
openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x40, 0x0)
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000380)="7d540b36e88980b024426f9053b5fffb54c71ddfec9f758bf85a4cf940742765c21dd8d651560e48291c36245273d0904608fec39f845e453fe3bf1f70d153db521670999f550c734559d977be13659da476dabf05d6f5c8dd0548cd0890cb69665db5fc", 0x2f6}], 0x1, 0x20e)
ioctl$SG_GET_COMMAND_Q(r1, 0x2270, &(0x7f0000000280))

16:09:07 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x6400}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:07 executing program 2:
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
clone(0x2102001ffb, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff)
r0 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x2, 0x0)
mount$9p_fd(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x3000000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r0}})

[  866.136754] binder: 4397:4401 ioctl 2270 200001c0 returned -22
16:09:07 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x200002c8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  866.407189] binder: 4382:4412 ioctl 2270 200001c0 returned -22
16:09:07 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x3f000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:07 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x7}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  866.628463] binder: 4417:4420 ioctl 2270 200001c0 returned -22
16:09:07 executing program 0:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000, 0x0, 0x58020000}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:07 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$PIO_UNIMAP(r1, 0x4b67, &(0x7f0000000380)={0x8, &(0x7f0000000340)=[{0x8, 0x2}, {0x9, 0x400}, {0x3, 0x470}, {0x8, 0x1}, {0x3ff, 0x2}, {0x8, 0x3}, {0x1, 0x9}, {0x8, 0xda9}]})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000180), 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000280)={0x1, 0xab, 0x5, 0x7ff})
fcntl$F_SET_FILE_RW_HINT(r0, 0x40e, &(0x7f0000000180)=0x4)

[  866.888273] binder: 4397:4427 ioctl 2270 200001c0 returned -22
16:09:08 executing program 2:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x19000}], 0x1, 0x0)

[  867.012661] binder: 4429:4430 ioctl 2270 200001c0 returned -22
16:09:08 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x2a}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  867.139656] binder: 4432:4437 ioctl 2270 200001c0 returned -22
[  867.336394] binder: 4417:4422 ioctl 2270 200001c0 returned -22
16:09:08 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x800000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:08 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  867.493512] binder: 4444:4448 ioctl 2270 200001c0 returned -22
16:09:08 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x700}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:08 executing program 0:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000, 0x0, 0x58020000}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  867.779165] binder: 4429:4430 ioctl 2270 200001c0 returned -22
16:09:08 executing program 4:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r1 = perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000880)={&(0x7f0000000800)=@pppol2tp={0x18, 0x1, {0x0, <r2=>0xffffffffffffffff, {0x2, 0x0, @remote}}}, 0x80, &(0x7f0000000700)=[{&(0x7f0000000a80)=""/184, 0xb8}, {&(0x7f0000000540)=""/11, 0xb}, {&(0x7f0000000680)=""/27, 0x1b}], 0x3, &(0x7f0000000b40)=""/253, 0xfd, 0x4d7}, 0x40000000)
mmap$xdp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2000008, 0x4011, r2, 0x80000000)
r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000c80)='/dev/dsp\x00', 0x101000, 0x0)
ioctl$RTC_VL_READ(r3, 0x80047013, &(0x7f0000000cc0))
syz_open_dev$sndctrl(&(0x7f000000a000)='/dev/snd/controlC#\x00', 0x0, 0x0)
ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000300)={<r4=>0xffffffffffffffff})
ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(0xffffffffffffffff, 0xc0505510, &(0x7f0000000740)={0x400, 0x1, 0xc92, 0x0, &(0x7f00000006c0)=[{}]})
fgetxattr(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], &(0x7f0000000340)=""/144, 0x90)
socketpair$inet_sctp(0x2, 0x0, 0x84, &(0x7f00000007c0))
r5 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/ip6_flowlabel\x00')
clock_gettime(0x0, &(0x7f0000000440)={<r6=>0x0, <r7=>0x0})
ppoll(&(0x7f0000000140)=[{}, {r5, 0xb012}, {r5, 0x200}, {r4, 0x6000}, {r1, 0x4009}], 0x5, &(0x7f0000000940)={r6, r7+30000000}, &(0x7f0000000980)={0x666}, 0x8)
r8 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000d40)=ANY=[@ANYBLOB="6f73322e23706f7369785f61636c5f5788974825f6287b243d6d0e04a95574ab7d6819551de0cd8ef0106817021950aaae79b0a1748a9a64bfdcd6f77495069192339106139e2f5f9b65919dc1010d48166e03990616ad89188922fcb1b018a2a13ea0884821aaf6d0ecfe03177c0bd5e189fb2b84827ecfae40079454e10000000000000101f2331df600fc958a56824c7127e9ae9590c207ca1603da1799237675ee6d8ab179b748defc0d1d49a96bd91657afacd5d078a3e7e39e93cfe1bd1866a878c0664928f835df5ae47b1798232256dab78b25747dbafc74af092bad516de39162fe2b9f44f0b8bad4737eab0c7c9a06477c037395c33aa75e025599dbedc5"], &(0x7f0000000200)=""/116, 0x74)
r9 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$nl_netfilter(r9, &(0x7f0000000080)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000440)={0x14, 0x3, 0x6, 0x3}, 0x14}}, 0x0)
setsockopt$IP_VS_SO_SET_STOPDAEMON(0xffffffffffffffff, 0x0, 0x48c, &(0x7f00000002c0)={0x0, 'syzkaller1\x00', 0x3}, 0x18)
vmsplice(r1, &(0x7f0000000000), 0x0, 0x4)
write$FUSE_LSEEK(r5, &(0x7f0000000c40)={0x18, 0x0, 0x7, {0x4}}, 0x18)
getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffff9c, 0x84, 0x22, &(0x7f00000008c0)={0x0, 0x0, 0x72feb984, 0x0, <r10=>0x0}, &(0x7f0000000900)=0x10)
ioctl$KVM_CREATE_IRQCHIP(r8, 0xae60)
ioctl$KVM_CREATE_PIT2(r8, 0x4040ae77, &(0x7f0000000100))
getsockopt$inet_sctp_SCTP_RESET_STREAMS(r5, 0x84, 0x77, &(0x7f0000000000)=ANY=[@ANYRES32=r10, @ANYBLOB="010002090050ff07"], &(0x7f00000000c0)=0xc)
openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x0, 0x0)
getxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000400)=@known='system.posix_acl_access\x00', &(0x7f0000000480)=""/166, 0xa6)
ioctl$SNDRV_TIMER_IOCTL_STOP(0xffffffffffffffff, 0x54a1)
write$P9_RMKNOD(r1, &(0x7f0000000d00)={0x14, 0x13, 0x1, {0x7, 0x0, 0x3}}, 0x14)
flock(r5, 0xc)

[  868.065815] binder: 4444:4450 ioctl 2270 200001c0 returned -22
16:09:09 executing program 2:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x8}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:09 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x700000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:09 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4000000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:09 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/userio\x00', 0x40000000000, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
ioctl$GIO_FONT(r0, 0x4b60, &(0x7f00000003c0)=""/67)
perf_event_open(&(0x7f0000000340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
write$FUSE_INTERRUPT(r1, &(0x7f0000000040)={0x10, 0x0, 0x8}, 0x10)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  868.323426] binder: 4479:4485 ioctl 2270 200001c0 returned -22
[  868.386571] binder: 4481:4489 ioctl 2270 200001c0 returned -22
16:09:09 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x1400000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:09 executing program 0:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000, 0x0, 0x5802}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:09 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x10000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  868.827121] binder: 4481:4489 ioctl 2270 200001c0 returned -22
[  868.836947] binder: 4479:4485 ioctl 2270 200001c0 returned -22
16:09:09 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x6400000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:09 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
ioctl$SG_GET_COMMAND_Q(r0, 0x2270, &(0x7f0000000180))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:10 executing program 2:
openat$userio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/userio\x00', 0x40000000000, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
ioctl$GIO_FONT(r0, 0x4b60, &(0x7f00000003c0)=""/67)
perf_event_open(&(0x7f0000000340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
write$FUSE_INTERRUPT(r1, &(0x7f0000000040)={0x10, 0x0, 0x8}, 0x10)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  869.050521] binder: 4507:4513 ioctl 2270 200001c0 returned -22
[  869.114605] binder: 4511:4518 ioctl 2270 200001c0 returned -22
16:09:10 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0xc5010000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  869.412376] binder: 4507:4513 ioctl 2270 200001c0 returned -22
16:09:10 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x1000000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:10 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x64000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:10 executing program 2:
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
clone(0x2102001ffb, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff)
r0 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x2, 0x0)
mount$9p_fd(0x20000000, &(0x7f0000000380)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r0}})

16:09:10 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0xfffffdfe, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:10 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240))
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x108010, r3, 0x0)

[  869.641162] binder: 4529:4535 ioctl 2270 200001c0 returned -22
[  869.741097] binder: 4540:4545 ioctl 2270 200001c0 returned -22
[  869.756677] binder: 4542:4546 ioctl 2270 200001c0 returned -22
16:09:11 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x3f00}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:11 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x1400}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  870.369725] binder: 4529:4544 ioctl 2270 200001c0 returned -22
16:09:11 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x10000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:11 executing program 2:
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
clone(0x2102001ffb, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff)
r0 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x2, 0x0)
mount$9p_fd(0x20000000, &(0x7f0000000380)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r0}})

16:09:11 executing program 0:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0xfffffdfe, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  870.531527] binder: 4542:4559 ioctl 2270 200001c0 returned -22
[  870.591702] binder: 4560:4568 ioctl 2270 200001c0 returned -22
[  870.628698] binder: 4562:4569 ioctl 2270 200001c0 returned -22
16:09:11 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000340)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$TUNSETOFFLOAD(r0, 0x400454d0, 0x8)
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r0, 0xc0a85322, &(0x7f0000000500))
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  870.768275] binder: 4573:4575 ioctl 2270 200001c0 returned -22
16:09:11 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:12 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x7}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  871.274444] binder: 4560:4568 ioctl 2270 200001c0 returned -22
16:09:12 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x7000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:12 executing program 0 (fault-call:4 fault-nth:0):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

16:09:12 executing program 2:
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
clone(0x2102001ffb, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff)
r0 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x2, 0x0)
mount$9p_fd(0x20000000, &(0x7f0000000380)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r0}})

16:09:12 executing program 2 (fault-call:4 fault-nth:0):
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  871.509750] binder: 4588:4594 ioctl 2270 200001c0 returned -22
[  871.532726] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  871.558979] device team0 left promiscuous mode
[  871.565777] binder: 4573:4576 ioctl 2270 200001c0 returned -22
[  871.576348] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  871.602403] device team_slave_0 left promiscuous mode
[  871.634792] FAULT_INJECTION: forcing a failure.
[  871.634792] name failslab, interval 1, probability 0, space 0, times 0
[  871.648995] device team_slave_1 left promiscuous mode
[  871.718122] CPU: 1 PID: 4597 Comm: syz-executor2 Not tainted 4.19.0-rc7-next-20181015+ #94
[  871.726594] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  871.735974] Call Trace:
[  871.738589]  dump_stack+0x244/0x39d
[  871.742246]  ? dump_stack_print_info.cold.1+0x20/0x20
[  871.747465]  should_fail.cold.4+0xa/0x17
[  871.751547]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  871.756682]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  871.762244]  ? zap_class+0x640/0x640
[  871.765986]  ? find_held_lock+0x36/0x1c0
[  871.770071]  ? __lock_is_held+0xb5/0x140
[  871.774176]  ? perf_trace_sched_process_exec+0x860/0x860
[  871.779652]  ? __lock_is_held+0xb5/0x140
[  871.783740]  __should_failslab+0x124/0x180
[  871.787991]  should_failslab+0x9/0x14
[  871.791810]  kmem_cache_alloc_trace+0x2d7/0x750
[  871.796502]  ? lock_release+0xa10/0xa10
[  871.800492]  ? ovl_test_flag+0x12/0x20
[  871.804395]  ? __sanitizer_cov_trace_cmp1+0x17/0x20
[  871.809435]  ovl_iterate+0x787/0xe20
[  871.813184]  ? ovl_iterate_real+0xda0/0xda0
[  871.817522]  ? down_read_killable+0x150/0x150
[  871.822046]  iterate_dir+0x20c/0x5d0
[  871.825794]  ksys_getdents64+0x228/0x450
[  871.829870]  ? __ia32_sys_getdents+0x4f0/0x4f0
[  871.834463]  ? iterate_dir+0x5d0/0x5d0
[  871.838402]  ? trace_hardirqs_off_caller+0x300/0x300
[  871.843529]  __x64_sys_getdents64+0x73/0xb0
[  871.847875]  do_syscall_64+0x1b9/0x820
[  871.851781]  ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
[  871.857163]  ? syscall_return_slowpath+0x5e0/0x5e0
[  871.862117]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  871.866978]  ? trace_hardirqs_on_caller+0x310/0x310
[  871.872010]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[  871.877049]  ? prepare_exit_to_usermode+0x291/0x3b0
[  871.882103]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  871.886978]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  871.892177] RIP: 0033:0x457569
[  871.895385] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
16:09:12 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000180)=<r4=>0x0)
migrate_pages(r4, 0xa6, &(0x7f0000000280)=0x2, &(0x7f0000000340)=0x100000000)
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:12 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc5010000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  871.914297] RSP: 002b:00007fc9ace21c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
[  871.922018] RAX: ffffffffffffffda RBX: 00007fc9ace21c90 RCX: 0000000000457569
[  871.929294] RDX: 0000000000000506 RSI: 0000000020000140 RDI: 0000000000000003
[  871.936563] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000
[  871.943833] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc9ace226d4
[  871.951107] R13: 00000000004bdea9 R14: 00000000004ccda8 R15: 0000000000000004
16:09:13 executing program 2 (fault-call:4 fault-nth:1):
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  872.036965] binder: 4607:4614 ioctl 2270 200001c0 returned -22
16:09:13 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  872.147365] binder: 4588:4599 ioctl 2270 200001c0 returned -22
[  872.194070] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  872.235871] FAULT_INJECTION: forcing a failure.
[  872.235871] name failslab, interval 1, probability 0, space 0, times 0
[  872.257388] CPU: 0 PID: 4621 Comm: syz-executor2 Not tainted 4.19.0-rc7-next-20181015+ #94
[  872.265815] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  872.275182] Call Trace:
[  872.277798]  dump_stack+0x244/0x39d
[  872.281454]  ? dump_stack_print_info.cold.1+0x20/0x20
[  872.286681]  should_fail.cold.4+0xa/0x17
[  872.290766]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  872.295885]  ? perf_trace_lock+0x7a0/0x7a0
[  872.300161]  ? zap_class+0x640/0x640
[  872.303891]  ? mark_held_locks+0x130/0x130
[  872.308152]  ? zap_class+0x640/0x640
[  872.311881]  ? debug_smp_processor_id+0x1c/0x20
[  872.316567]  ? perf_trace_lock_acquire+0x15b/0x800
[  872.321515]  ? __lock_acquire+0x62f/0x4c20
[  872.325773]  ? find_held_lock+0x36/0x1c0
[  872.329859]  ? __lock_is_held+0xb5/0x140
[  872.333939]  ? rtl92ce_rx_query_desc+0x1aa8/0x2630
[  872.338902]  ? perf_trace_sched_process_exec+0x860/0x860
[  872.344369]  ? kasan_check_read+0x11/0x20
[  872.348534]  ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170
[  872.353828]  ? rcu_softirq_qs+0x20/0x20
[  872.357820]  __should_failslab+0x124/0x180
[  872.362069]  should_failslab+0x9/0x14
[  872.366357]  kmem_cache_alloc+0x2be/0x730
[  872.370526]  ? kernel_text_address+0x79/0xf0
[  872.372876] binder: 4607:4616 ioctl 2270 200001c0 returned -22
[  872.374951]  ? __kernel_text_address+0xd/0x40
[  872.375015]  __alloc_file+0xa8/0x470
[  872.389202]  ? file_free_rcu+0xd0/0xd0
[  872.393126]  ? save_stack+0xa9/0xd0
[  872.396773]  ? save_stack+0x43/0xd0
[  872.400412]  ? ovl_path_upper+0x71/0x220
[  872.404489]  alloc_empty_file+0x72/0x170
[  872.408569]  dentry_open+0x71/0x1d0
[  872.412216]  ovl_path_open+0x58/0x70
[  872.415950]  ovl_dir_read_merged+0x26d/0xbf0
[  872.420387]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  872.425942]  ? ovl_dir_open+0x300/0x300
[  872.429938]  ? ovl_fill_plain+0x320/0x320
[  872.434120]  ? ovl_iterate+0x787/0xe20
[  872.438033]  ? rcu_read_lock_sched_held+0x14f/0x180
[  872.443087]  ? kmem_cache_alloc_trace+0x353/0x750
[  872.447954]  ? lock_release+0xa10/0xa10
[  872.451944]  ? ovl_test_flag+0x12/0x20
[  872.455847]  ? __sanitizer_cov_trace_cmp1+0x17/0x20
[  872.460884]  ovl_iterate+0x87e/0xe20
[  872.464625]  ? ovl_iterate_real+0xda0/0xda0
[  872.468961]  ? down_read_killable+0x150/0x150
[  872.473481]  iterate_dir+0x20c/0x5d0
[  872.477216]  ksys_getdents64+0x228/0x450
[  872.481296]  ? __ia32_sys_getdents+0x4f0/0x4f0
16:09:13 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000000180)={'veth1_to_bond\x00', {0x2, 0x4e24, @multicast2}})
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  872.485888]  ? iterate_dir+0x5d0/0x5d0
[  872.489793]  ? trace_hardirqs_off_caller+0x300/0x300
[  872.494922]  __x64_sys_getdents64+0x73/0xb0
[  872.499433]  do_syscall_64+0x1b9/0x820
[  872.503344]  ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
[  872.508727]  ? syscall_return_slowpath+0x5e0/0x5e0
[  872.513668]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  872.513690]  ? trace_hardirqs_on_caller+0x310/0x310
[  872.513708]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[  872.513726]  ? prepare_exit_to_usermode+0x291/0x3b0
[  872.513748]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  872.528614]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  872.528634] RIP: 0033:0x457569
[  872.546842] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  872.565751] RSP: 002b:00007fc9ace21c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
[  872.573471] RAX: ffffffffffffffda RBX: 00007fc9ace21c90 RCX: 0000000000457569
16:09:13 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x6400000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  872.580749] RDX: 0000000000000506 RSI: 0000000020000140 RDI: 0000000000000003
[  872.588027] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000
[  872.595312] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc9ace226d4
[  872.602586] R13: 00000000004bdea9 R14: 00000000004ccda8 R15: 0000000000000004
[  872.692695] binder: 4625:4630 ioctl 2270 200001c0 returned -22
[  872.701462] binder: 4628:4631 ioctl 2270 200001c0 returned -22
16:09:13 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:13 executing program 2 (fault-call:4 fault-nth:2):
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

16:09:13 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x258}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:13 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  872.932838] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  872.967454] FAULT_INJECTION: forcing a failure.
[  872.967454] name failslab, interval 1, probability 0, space 0, times 0
[  873.010939] CPU: 0 PID: 4640 Comm: syz-executor2 Not tainted 4.19.0-rc7-next-20181015+ #94
[  873.019389] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  873.028855] Call Trace:
[  873.031479]  dump_stack+0x244/0x39d
[  873.035152]  ? dump_stack_print_info.cold.1+0x20/0x20
[  873.040387]  should_fail.cold.4+0xa/0x17
[  873.044477]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  873.049611]  ? is_bpf_text_address+0xd3/0x170
[  873.054128]  ? kernel_text_address+0x79/0xf0
[  873.058567]  ? zap_class+0x640/0x640
[  873.062299]  ? unwind_get_return_address+0x61/0xa0
[  873.067250]  ? find_held_lock+0x36/0x1c0
[  873.071333]  ? __lock_is_held+0xb5/0x140
[  873.075413]  ? kernfs_put_open_node.isra.7+0x378/0x420
[  873.080719]  ? perf_trace_sched_process_exec+0x860/0x860
[  873.086197]  __should_failslab+0x124/0x180
[  873.090455]  should_failslab+0x9/0x14
[  873.094278]  kmem_cache_alloc_trace+0x2d7/0x750
[  873.098968]  ? __might_sleep+0x95/0x190
[  873.102966]  apparmor_file_alloc_security+0x17b/0xac0
[  873.108184]  ? apparmor_path_rename+0xcd0/0xcd0
[  873.112885]  ? rcu_read_lock_sched_held+0x14f/0x180
[  873.117921]  ? kmem_cache_alloc+0x33a/0x730
[  873.122271]  security_file_alloc+0x4c/0xa0
[  873.126530]  __alloc_file+0x12a/0x470
[  873.130351]  ? file_free_rcu+0xd0/0xd0
[  873.134268]  ? save_stack+0xa9/0xd0
[  873.137907]  ? save_stack+0x43/0xd0
[  873.141551]  ? ovl_path_upper+0x71/0x220
[  873.145634]  alloc_empty_file+0x72/0x170
[  873.149715]  dentry_open+0x71/0x1d0
[  873.153362]  ovl_path_open+0x58/0x70
[  873.157109]  ovl_dir_read_merged+0x26d/0xbf0
[  873.161554]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  873.167123]  ? ovl_dir_open+0x300/0x300
[  873.171128]  ? ovl_fill_plain+0x320/0x320
[  873.175314]  ? ovl_iterate+0x787/0xe20
[  873.179221]  ? rcu_read_lock_sched_held+0x14f/0x180
[  873.184257]  ? kmem_cache_alloc_trace+0x353/0x750
[  873.189126]  ? lock_release+0xa10/0xa10
[  873.193142]  ? ovl_test_flag+0x12/0x20
[  873.197047]  ? __sanitizer_cov_trace_cmp1+0x17/0x20
[  873.202102]  ovl_iterate+0x87e/0xe20
[  873.205853]  ? ovl_iterate_real+0xda0/0xda0
[  873.210192]  ? down_read_killable+0x150/0x150
[  873.214713]  iterate_dir+0x20c/0x5d0
[  873.218460]  ksys_getdents64+0x228/0x450
[  873.222543]  ? __ia32_sys_getdents+0x4f0/0x4f0
[  873.227147]  ? iterate_dir+0x5d0/0x5d0
[  873.231062]  ? trace_hardirqs_off_caller+0x300/0x300
[  873.236206]  __x64_sys_getdents64+0x73/0xb0
[  873.240549]  do_syscall_64+0x1b9/0x820
[  873.244458]  ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
[  873.249838]  ? syscall_return_slowpath+0x5e0/0x5e0
[  873.254783]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  873.259645]  ? trace_hardirqs_on_caller+0x310/0x310
[  873.264683]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[  873.269744]  ? prepare_exit_to_usermode+0x291/0x3b0
[  873.274772]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  873.279614]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  873.284795] RIP: 0033:0x457569
[  873.287988] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  873.306886] RSP: 002b:00007fc9ace21c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
[  873.314588] RAX: ffffffffffffffda RBX: 00007fc9ace21c90 RCX: 0000000000457569
[  873.321869] RDX: 0000000000000506 RSI: 0000000020000140 RDI: 0000000000000003
[  873.329151] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000
[  873.336430] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc9ace226d4
[  873.337287] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  873.343707] R13: 00000000004bdea9 R14: 00000000004ccda8 R15: 0000000000000004
16:09:14 executing program 2 (fault-call:4 fault-nth:3):
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  873.417263] binder: 4625:4649 ioctl 2270 200001c0 returned -22
[  873.446922] binder: 4628:4650 ioctl 2270 200001c0 returned -22
16:09:14 executing program 4:
r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000280)=[{&(0x7f0000000180)="9b", 0x1}], 0x1, 0x0)

16:09:14 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x10000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:14 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x700000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  873.583799] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  873.614849] binder: 4652:4657 ioctl 2270 200001c0 returned -22
[  873.616453] FAULT_INJECTION: forcing a failure.
[  873.616453] name failslab, interval 1, probability 0, space 0, times 0
[  873.655121] CPU: 0 PID: 4655 Comm: syz-executor2 Not tainted 4.19.0-rc7-next-20181015+ #94
[  873.663554] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  873.672914] Call Trace:
[  873.675525]  dump_stack+0x244/0x39d
[  873.679174]  ? dump_stack_print_info.cold.1+0x20/0x20
[  873.684391]  should_fail.cold.4+0xa/0x17
[  873.688472]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  873.693598]  ? __save_stack_trace+0x8d/0xf0
[  873.697940]  ? perf_trace_lock+0x7a0/0x7a0
[  873.702191]  ? zap_class+0x640/0x640
[  873.705934]  ? find_held_lock+0x36/0x1c0
[  873.710016]  ? __lock_is_held+0xb5/0x140
[  873.714107]  ? icl_calc_dpll_state.isra.14+0x1548/0x21d0
[  873.719598]  ? perf_trace_sched_process_exec+0x860/0x860
[  873.725062]  ? lock_downgrade+0x900/0x900
[  873.729238]  ? check_preemption_disabled+0x48/0x280
[  873.734279]  __should_failslab+0x124/0x180
[  873.738531]  should_failslab+0x9/0x14
[  873.742351]  kmem_cache_alloc_trace+0x2d7/0x750
[  873.747050]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  873.752623]  ext4_readdir+0x2734/0x3c30
[  873.756625]  ? zap_class+0x640/0x640
[  873.760367]  ? __ext4_check_dir_entry+0x350/0x350
[  873.765229]  ? fsnotify_first_mark+0x350/0x350
[  873.769840]  ? lock_acquire+0x1ed/0x520
[  873.773827]  ? iterate_dir+0xd8/0x5d0
[  873.777651]  ? lock_release+0xa10/0xa10
[  873.781640]  ? perf_trace_sched_process_exec+0x860/0x860
[  873.787116]  ? debug_lockdep_rcu_enabled+0x77/0x90
[  873.792069]  ? fsnotify_first_mark+0x350/0x350
[  873.796698]  ? down_read_killable+0x90/0x150
[  873.801121]  ? iterate_dir+0xd8/0x5d0
[  873.804946]  ? down_write+0x130/0x130
[  873.808773]  iterate_dir+0x48c/0x5d0
[  873.812514]  ovl_dir_read_merged+0x3c1/0xbf0
[  873.816956]  ? ovl_dir_open+0x300/0x300
[  873.820955]  ? ovl_fill_plain+0x320/0x320
[  873.825139]  ? ovl_iterate+0x787/0xe20
[  873.829046]  ? rcu_read_lock_sched_held+0x14f/0x180
[  873.834099]  ? kmem_cache_alloc_trace+0x353/0x750
[  873.838967]  ? lock_release+0xa10/0xa10
[  873.842954]  ? ovl_test_flag+0x12/0x20
[  873.846856]  ? __sanitizer_cov_trace_cmp1+0x17/0x20
[  873.851892]  ovl_iterate+0x87e/0xe20
[  873.855635]  ? ovl_iterate_real+0xda0/0xda0
[  873.859975]  ? down_read_killable+0x150/0x150
[  873.864507]  iterate_dir+0x20c/0x5d0
[  873.868260]  ksys_getdents64+0x228/0x450
[  873.872346]  ? __ia32_sys_getdents+0x4f0/0x4f0
[  873.876940]  ? iterate_dir+0x5d0/0x5d0
[  873.880861]  ? trace_hardirqs_off_caller+0x300/0x300
[  873.885989]  __x64_sys_getdents64+0x73/0xb0
[  873.890332]  do_syscall_64+0x1b9/0x820
[  873.894240]  ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
[  873.899622]  ? syscall_return_slowpath+0x5e0/0x5e0
[  873.904561]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  873.909420]  ? trace_hardirqs_on_caller+0x310/0x310
[  873.914458]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[  873.919488]  ? prepare_exit_to_usermode+0x291/0x3b0
[  873.924526]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  873.929400]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  873.934597] RIP: 0033:0x457569
[  873.937804] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  873.956714] RSP: 002b:00007fc9ace21c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
[  873.964434] RAX: ffffffffffffffda RBX: 00007fc9ace21c90 RCX: 0000000000457569
[  873.971711] RDX: 0000000000000506 RSI: 0000000020000140 RDI: 0000000000000003
[  873.978984] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000
[  873.986262] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc9ace226d4
[  873.993542] R13: 00000000004bdea9 R14: 00000000004ccda8 R15: 0000000000000004
[  874.009934] binder: 4656:4668 ioctl 2270 200001c0 returned -22
16:09:15 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:15 executing program 2 (fault-call:4 fault-nth:4):
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

16:09:15 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x4, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  874.278763] binder: 4656:4669 ioctl 2270 200001c0 returned -22
16:09:15 executing program 4:
r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000480)={<r3=>0x0, 0x8}, &(0x7f0000000500)=0x8)
bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000006c0)={r1, 0x10, &(0x7f0000000680)={&(0x7f0000000640)=""/12, 0xc, 0xffffffffffffffff}}, 0x10)
getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000540)={r3, 0x21dd}, &(0x7f0000000580)=0x8)
r4 = getpgid(0xffffffffffffffff)
sched_setaffinity(r4, 0x8, &(0x7f0000000700)=0x8)
syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r2, &(0x7f0000000340), 0x10000014c)
getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000380)={<r5=>0x0, 0x51a9bd79}, &(0x7f00000003c0)=0x8)
setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r2, 0x84, 0x10, &(0x7f0000000440)=@assoc_value={r5, 0x6}, 0x8)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r6=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r6+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
getsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000180)={@remote, 0x5, 0x3, 0x0, 0xf, 0x4, 0x10001, 0x20}, &(0x7f0000000280)=0x20)
write$USERIO_CMD_REGISTER(r0, &(0x7f0000000340)={0x0, 0x282}, 0x2)
clock_gettime(0x0, &(0x7f00000005c0)={<r7=>0x0, <r8=>0x0})
setsockopt$sock_timeval(r1, 0x1, 0x14, &(0x7f0000000600)={r7, r8/1000+10000}, 0x10)
vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  874.358233] binder: 4652:4675 ioctl 2270 200001c0 returned -22
[  874.418508] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  874.444430] FAULT_INJECTION: forcing a failure.
[  874.444430] name failslab, interval 1, probability 0, space 0, times 0
[  874.485833] CPU: 1 PID: 4679 Comm: syz-executor2 Not tainted 4.19.0-rc7-next-20181015+ #94
[  874.494282] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  874.504158] Call Trace:
[  874.506776]  dump_stack+0x244/0x39d
[  874.510437]  ? dump_stack_print_info.cold.1+0x20/0x20
[  874.515670]  should_fail.cold.4+0xa/0x17
[  874.519755]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  874.524878]  ? __sanitizer_cov_trace_cmp8+0x18/0x20
[  874.529911]  ? ext4_data_block_valid+0x28b/0x330
[  874.534693]  ? __check_block_validity.constprop.78+0xd9/0x210
[  874.540597]  ? zap_class+0x640/0x640
[  874.544328]  ? ext4_map_blocks+0x429/0x1b50
[  874.548664]  ? perf_trace_lock+0x7a0/0x7a0
[  874.552913]  ? debug_smp_processor_id+0x1c/0x20
[  874.557592]  ? perf_trace_lock_acquire+0x15b/0x800
[  874.562542]  ? find_held_lock+0x36/0x1c0
[  874.566625]  ? __lock_is_held+0xb5/0x140
[  874.570725]  ? perf_trace_sched_process_exec+0x860/0x860
[  874.576189]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  874.581740]  ? ext4fs_dirhash+0xb49/0x10d0
[  874.586002]  __should_failslab+0x124/0x180
[  874.590254]  should_failslab+0x9/0x14
[  874.594069]  __kmalloc+0x2e0/0x760
[  874.597639]  ? rcu_softirq_qs+0x20/0x20
[  874.601628]  ? rcu_softirq_qs+0x20/0x20
[  874.605622]  ? unwind_dump+0x190/0x190
[  874.609532]  ? ext4_htree_store_dirent+0x8d/0x5a0
[  874.614392]  ext4_htree_store_dirent+0x8d/0x5a0
[  874.619092]  htree_dirblock_to_tree+0x56b/0xae0
[  874.623787]  ? dx_probe+0x1120/0x1120
[  874.627605]  ? save_stack+0xa9/0xd0
[  874.631250]  ? save_stack+0x43/0xd0
[  874.634891]  ? ext4_readdir+0x2734/0x3c30
[  874.639052]  ? iterate_dir+0x48c/0x5d0
[  874.642966]  ? ovl_dir_read_merged+0x3c1/0xbf0
[  874.647559]  ? ovl_iterate+0x87e/0xe20
[  874.651462]  ? iterate_dir+0x20c/0x5d0
[  874.655360]  ? ksys_getdents64+0x228/0x450
[  874.659608]  ? __x64_sys_getdents64+0x73/0xb0
[  874.664123]  ? do_syscall_64+0x1b9/0x820
[  874.668201]  ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  874.673586]  ext4_htree_fill_tree+0x40c/0xd60
[  874.678110]  ? do_split+0x1bc0/0x1bc0
[  874.681930]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  874.687485]  ? check_preemption_disabled+0x48/0x280
[  874.692526]  ? __lock_is_held+0xb5/0x140
[  874.696611]  ? ext4_readdir+0x2734/0x3c30
[  874.700778]  ? rcu_read_lock_sched_held+0x14f/0x180
[  874.705808]  ? kmem_cache_alloc_trace+0x353/0x750
[  874.710683]  ext4_readdir+0x1ca1/0x3c30
[  874.714723]  ? __ext4_check_dir_entry+0x350/0x350
[  874.719577]  ? fsnotify_first_mark+0x350/0x350
[  874.724185]  ? lock_acquire+0x1ed/0x520
[  874.728160]  ? iterate_dir+0xd8/0x5d0
[  874.731960]  ? lock_release+0xa10/0xa10
[  874.735926]  ? perf_trace_sched_process_exec+0x860/0x860
[  874.741380]  ? debug_lockdep_rcu_enabled+0x77/0x90
[  874.746313]  ? fsnotify_first_mark+0x350/0x350
[  874.750893]  ? down_read_killable+0x90/0x150
[  874.755292]  ? iterate_dir+0xd8/0x5d0
[  874.759088]  ? down_write+0x130/0x130
[  874.762901]  iterate_dir+0x48c/0x5d0
[  874.766628]  ovl_dir_read_merged+0x3c1/0xbf0
[  874.771034]  ? ovl_dir_open+0x300/0x300
[  874.775001]  ? ovl_fill_plain+0x320/0x320
[  874.779153]  ? ovl_iterate+0x787/0xe20
[  874.783035]  ? rcu_read_lock_sched_held+0x14f/0x180
[  874.788043]  ? kmem_cache_alloc_trace+0x353/0x750
[  874.792879]  ? lock_release+0xa10/0xa10
[  874.796841]  ? ovl_test_flag+0x12/0x20
[  874.800732]  ? __sanitizer_cov_trace_cmp1+0x17/0x20
[  874.805754]  ovl_iterate+0x87e/0xe20
[  874.809464]  ? ovl_iterate_real+0xda0/0xda0
[  874.813794]  ? down_read_killable+0x150/0x150
[  874.818324]  iterate_dir+0x20c/0x5d0
[  874.822070]  ksys_getdents64+0x228/0x450
[  874.826163]  ? __ia32_sys_getdents+0x4f0/0x4f0
[  874.830758]  ? iterate_dir+0x5d0/0x5d0
[  874.834675]  ? trace_hardirqs_off_caller+0x300/0x300
[  874.839807]  __x64_sys_getdents64+0x73/0xb0
[  874.844151]  do_syscall_64+0x1b9/0x820
[  874.848060]  ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
[  874.853453]  ? syscall_return_slowpath+0x5e0/0x5e0
[  874.858401]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  874.863264]  ? trace_hardirqs_on_caller+0x310/0x310
[  874.868296]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[  874.873333]  ? prepare_exit_to_usermode+0x291/0x3b0
[  874.878356]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  874.883197]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  874.888386] RIP: 0033:0x457569
[  874.891595] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  874.910486] RSP: 002b:00007fc9ace21c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
[  874.918183] RAX: ffffffffffffffda RBX: 00007fc9ace21c90 RCX: 0000000000457569
[  874.925446] RDX: 0000000000000506 RSI: 0000000020000140 RDI: 0000000000000003
16:09:15 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:16 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x8000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  874.932724] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000
[  874.940002] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc9ace226d4
[  874.947273] R13: 00000000004bdea9 R14: 00000000004ccda8 R15: 0000000000000004
[  874.968010] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:09:16 executing program 2 (fault-call:4 fault-nth:5):
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

16:09:16 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x5802000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  875.053207] binder: 4687:4691 ioctl 2270 200001c0 returned -22
[  875.151759] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  875.188858] FAULT_INJECTION: forcing a failure.
[  875.188858] name failslab, interval 1, probability 0, space 0, times 0
[  875.231488] CPU: 0 PID: 4699 Comm: syz-executor2 Not tainted 4.19.0-rc7-next-20181015+ #94
[  875.239934] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  875.249313] Call Trace:
[  875.251929]  dump_stack+0x244/0x39d
[  875.255586]  ? dump_stack_print_info.cold.1+0x20/0x20
[  875.260813]  should_fail.cold.4+0xa/0x17
[  875.264898]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  875.270029]  ? save_stack+0x43/0xd0
[  875.273665]  ? kasan_kmalloc+0xc7/0xe0
[  875.277566]  ? __kmalloc+0x15b/0x760
[  875.281298]  ? ext4_htree_store_dirent+0x8d/0x5a0
[  875.286158]  ? htree_dirblock_to_tree+0x56b/0xae0
[  875.291015]  ? zap_class+0x640/0x640
[  875.294749]  ? ovl_dir_read_merged+0x3c1/0xbf0
[  875.299342]  ? ovl_iterate+0x87e/0xe20
[  875.303241]  ? iterate_dir+0x20c/0x5d0
[  875.307154]  ? ksys_getdents64+0x228/0x450
[  875.311404]  ? __x64_sys_getdents64+0x73/0xb0
[  875.315915]  ? do_syscall_64+0x1b9/0x820
[  875.319997]  ? find_held_lock+0x36/0x1c0
[  875.324088]  ? __lock_is_held+0xb5/0x140
[  875.328172]  ? driver_deferred_probe_add.isra.8+0x78/0x2d0
[  875.333830]  ? perf_trace_sched_process_exec+0x860/0x860
[  875.339300]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  875.344846]  ? ext4fs_dirhash+0xb49/0x10d0
[  875.349118]  __should_failslab+0x124/0x180
[  875.353382]  should_failslab+0x9/0x14
[  875.357200]  __kmalloc+0x2e0/0x760
[  875.360757]  ? rcu_softirq_qs+0x20/0x20
[  875.364750]  ? rcu_softirq_qs+0x20/0x20
[  875.368735]  ? unwind_dump+0x190/0x190
[  875.372642]  ? ext4_htree_store_dirent+0x8d/0x5a0
[  875.377508]  ext4_htree_store_dirent+0x8d/0x5a0
[  875.382202]  htree_dirblock_to_tree+0x56b/0xae0
[  875.386898]  ? dx_probe+0x1120/0x1120
[  875.390717]  ? save_stack+0xa9/0xd0
[  875.394360]  ? save_stack+0x43/0xd0
[  875.398002]  ? ext4_readdir+0x2734/0x3c30
[  875.402171]  ? iterate_dir+0x48c/0x5d0
[  875.406072]  ? ovl_dir_read_merged+0x3c1/0xbf0
[  875.410685]  ? ovl_iterate+0x87e/0xe20
[  875.414587]  ? iterate_dir+0x20c/0x5d0
[  875.418489]  ? ksys_getdents64+0x228/0x450
[  875.422744]  ? __x64_sys_getdents64+0x73/0xb0
[  875.427256]  ? do_syscall_64+0x1b9/0x820
[  875.431339]  ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  875.436728]  ext4_htree_fill_tree+0x40c/0xd60
[  875.441249]  ? do_split+0x1bc0/0x1bc0
[  875.445071]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  875.450637]  ? check_preemption_disabled+0x48/0x280
[  875.455677]  ? __lock_is_held+0xb5/0x140
[  875.459766]  ? ext4_readdir+0x2734/0x3c30
[  875.463935]  ? rcu_read_lock_sched_held+0x14f/0x180
[  875.468973]  ? kmem_cache_alloc_trace+0x353/0x750
[  875.473847]  ext4_readdir+0x1ca1/0x3c30
[  875.477861]  ? __ext4_check_dir_entry+0x350/0x350
[  875.482718]  ? fsnotify_first_mark+0x350/0x350
[  875.487332]  ? lock_acquire+0x1ed/0x520
[  875.491325]  ? iterate_dir+0xd8/0x5d0
[  875.495152]  ? lock_release+0xa10/0xa10
[  875.499145]  ? perf_trace_sched_process_exec+0x860/0x860
[  875.504616]  ? debug_lockdep_rcu_enabled+0x77/0x90
[  875.509575]  ? fsnotify_first_mark+0x350/0x350
[  875.514192]  ? down_read_killable+0x90/0x150
[  875.518623]  ? iterate_dir+0xd8/0x5d0
[  875.522438]  ? down_write+0x130/0x130
[  875.526270]  iterate_dir+0x48c/0x5d0
[  875.530020]  ovl_dir_read_merged+0x3c1/0xbf0
[  875.534452]  ? ovl_dir_open+0x300/0x300
[  875.538452]  ? ovl_fill_plain+0x320/0x320
[  875.542629]  ? ovl_iterate+0x787/0xe20
[  875.546529]  ? rcu_read_lock_sched_held+0x14f/0x180
[  875.551557]  ? kmem_cache_alloc_trace+0x353/0x750
[  875.556414]  ? lock_release+0xa10/0xa10
[  875.560415]  ? ovl_test_flag+0x12/0x20
[  875.564323]  ? __sanitizer_cov_trace_cmp1+0x17/0x20
[  875.569363]  ovl_iterate+0x87e/0xe20
[  875.573114]  ? ovl_iterate_real+0xda0/0xda0
[  875.577458]  ? down_read_killable+0x150/0x150
[  875.581983]  iterate_dir+0x20c/0x5d0
[  875.585728]  ksys_getdents64+0x228/0x450
[  875.589808]  ? __ia32_sys_getdents+0x4f0/0x4f0
[  875.594405]  ? iterate_dir+0x5d0/0x5d0
[  875.598331]  ? trace_hardirqs_off_caller+0x300/0x300
[  875.603457]  __x64_sys_getdents64+0x73/0xb0
[  875.607803]  do_syscall_64+0x1b9/0x820
[  875.611710]  ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
[  875.617100]  ? syscall_return_slowpath+0x5e0/0x5e0
[  875.622054]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  875.626924]  ? trace_hardirqs_on_caller+0x310/0x310
16:09:16 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
pipe(&(0x7f0000000180))
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  875.631954]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[  875.636988]  ? prepare_exit_to_usermode+0x291/0x3b0
[  875.642025]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  875.646899]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  875.652113] RIP: 0033:0x457569
[  875.655326] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  875.674244] RSP: 002b:00007fc9ace21c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
[  875.681966] RAX: ffffffffffffffda RBX: 00007fc9ace21c90 RCX: 0000000000457569
[  875.689247] RDX: 0000000000000506 RSI: 0000000020000140 RDI: 0000000000000003
[  875.696525] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000
[  875.703800] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc9ace226d4
[  875.711091] R13: 00000000004bdea9 R14: 00000000004ccda8 R15: 0000000000000004
[  875.787364] binder: 4707:4710 ioctl 2270 200001c0 returned -22
[  875.867412] binder: 4687:4715 ioctl 2270 200001c0 returned -22
16:09:16 executing program 2 (fault-call:4 fault-nth:6):
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

16:09:17 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x3f000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  876.070263] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:17 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6400000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:17 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x8000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  876.115536] FAULT_INJECTION: forcing a failure.
[  876.115536] name failslab, interval 1, probability 0, space 0, times 0
[  876.128033] binder: 4720:4723 ioctl 2270 200001c0 returned -22
[  876.138443] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  876.148703] CPU: 0 PID: 4722 Comm: syz-executor2 Not tainted 4.19.0-rc7-next-20181015+ #94
[  876.157137] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  876.166501] Call Trace:
[  876.169113]  dump_stack+0x244/0x39d
[  876.172764]  ? dump_stack_print_info.cold.1+0x20/0x20
[  876.177977]  should_fail.cold.4+0xa/0x17
[  876.182049]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  876.187186]  ? save_stack+0x43/0xd0
[  876.190819]  ? kasan_kmalloc+0xc7/0xe0
[  876.194715]  ? __kmalloc+0x15b/0x760
[  876.198437]  ? ext4_htree_store_dirent+0x8d/0x5a0
[  876.203282]  ? htree_dirblock_to_tree+0x56b/0xae0
[  876.208141]  ? zap_class+0x640/0x640
[  876.211863]  ? ovl_dir_read_merged+0x3c1/0xbf0
[  876.216452]  ? ovl_iterate+0x87e/0xe20
[  876.220348]  ? iterate_dir+0x20c/0x5d0
[  876.224242]  ? ksys_getdents64+0x228/0x450
[  876.228480]  ? __x64_sys_getdents64+0x73/0xb0
[  876.232978]  ? do_syscall_64+0x1b9/0x820
[  876.237051]  ? find_held_lock+0x36/0x1c0
[  876.241142]  ? __lock_is_held+0xb5/0x140
[  876.245225]  ? perf_trace_sched_process_exec+0x860/0x860
[  876.250679]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  876.256223]  ? ext4fs_dirhash+0xb49/0x10d0
[  876.260474]  __should_failslab+0x124/0x180
[  876.264716]  should_failslab+0x9/0x14
[  876.268525]  __kmalloc+0x2e0/0x760
[  876.272082]  ? rcu_softirq_qs+0x20/0x20
[  876.276063]  ? rcu_softirq_qs+0x20/0x20
[  876.280054]  ? unwind_dump+0x190/0x190
[  876.283960]  ? ext4_htree_store_dirent+0x8d/0x5a0
[  876.288814]  ext4_htree_store_dirent+0x8d/0x5a0
[  876.293500]  htree_dirblock_to_tree+0x56b/0xae0
[  876.298189]  ? dx_probe+0x1120/0x1120
[  876.301994]  ? save_stack+0xa9/0xd0
[  876.305624]  ? save_stack+0x43/0xd0
[  876.309255]  ? ext4_readdir+0x2734/0x3c30
[  876.313408]  ? iterate_dir+0x48c/0x5d0
[  876.317303]  ? ovl_dir_read_merged+0x3c1/0xbf0
[  876.321889]  ? ovl_iterate+0x87e/0xe20
[  876.325786]  ? iterate_dir+0x20c/0x5d0
[  876.329675]  ? ksys_getdents64+0x228/0x450
[  876.333920]  ? __x64_sys_getdents64+0x73/0xb0
[  876.338424]  ? do_syscall_64+0x1b9/0x820
[  876.342497]  ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  876.347874]  ext4_htree_fill_tree+0x40c/0xd60
[  876.352388]  ? do_split+0x1bc0/0x1bc0
[  876.356203]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  876.361747]  ? check_preemption_disabled+0x48/0x280
[  876.367239]  ? __lock_is_held+0xb5/0x140
[  876.371325]  ? ext4_readdir+0x2734/0x3c30
[  876.375481]  ? rcu_read_lock_sched_held+0x14f/0x180
[  876.380507]  ? kmem_cache_alloc_trace+0x353/0x750
[  876.385371]  ext4_readdir+0x1ca1/0x3c30
[  876.389376]  ? __ext4_check_dir_entry+0x350/0x350
[  876.394230]  ? fsnotify_first_mark+0x350/0x350
[  876.398831]  ? lock_acquire+0x1ed/0x520
[  876.402813]  ? iterate_dir+0xd8/0x5d0
[  876.406625]  ? lock_release+0xa10/0xa10
[  876.410605]  ? perf_trace_sched_process_exec+0x860/0x860
[  876.416067]  ? debug_lockdep_rcu_enabled+0x77/0x90
[  876.421014]  ? fsnotify_first_mark+0x350/0x350
[  876.425618]  ? down_read_killable+0x90/0x150
[  876.430030]  ? iterate_dir+0xd8/0x5d0
[  876.433840]  ? down_write+0x130/0x130
[  876.437657]  iterate_dir+0x48c/0x5d0
[  876.441388]  ovl_dir_read_merged+0x3c1/0xbf0
[  876.445815]  ? ovl_dir_open+0x300/0x300
[  876.449803]  ? ovl_fill_plain+0x320/0x320
[  876.453970]  ? ovl_iterate+0x787/0xe20
[  876.457865]  ? rcu_read_lock_sched_held+0x14f/0x180
[  876.462891]  ? kmem_cache_alloc_trace+0x353/0x750
[  876.467740]  ? lock_release+0xa10/0xa10
[  876.471721]  ? ovl_test_flag+0x12/0x20
[  876.475615]  ? __sanitizer_cov_trace_cmp1+0x17/0x20
[  876.480646]  ovl_iterate+0x87e/0xe20
[  876.484377]  ? ovl_iterate_real+0xda0/0xda0
[  876.488705]  ? down_read_killable+0x150/0x150
[  876.493220]  iterate_dir+0x20c/0x5d0
[  876.497136]  ksys_getdents64+0x228/0x450
[  876.501210]  ? __ia32_sys_getdents+0x4f0/0x4f0
[  876.505802]  ? iterate_dir+0x5d0/0x5d0
[  876.509703]  ? trace_hardirqs_off_caller+0x300/0x300
[  876.514819]  __x64_sys_getdents64+0x73/0xb0
[  876.519158]  do_syscall_64+0x1b9/0x820
[  876.523057]  ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
[  876.528442]  ? syscall_return_slowpath+0x5e0/0x5e0
[  876.533377]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  876.538228]  ? trace_hardirqs_on_caller+0x310/0x310
[  876.543255]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[  876.548280]  ? prepare_exit_to_usermode+0x291/0x3b0
[  876.553308]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  876.558176]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  876.563372] RIP: 0033:0x457569
[  876.566570] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  876.585475] RSP: 002b:00007fc9ace21c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
[  876.593203] RAX: ffffffffffffffda RBX: 00007fc9ace21c90 RCX: 0000000000457569
[  876.600475] RDX: 0000000000000506 RSI: 0000000020000140 RDI: 0000000000000003
[  876.607745] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000
[  876.615019] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc9ace226d4
[  876.622288] R13: 00000000004bdea9 R14: 00000000004ccda8 R15: 0000000000000004
16:09:17 executing program 2 (fault-call:4 fault-nth:7):
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  876.705551] binder: 4707:4731 ioctl 2270 200001c0 returned -22
16:09:17 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0xfffffdef, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  876.896119] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  876.897701] binder: 4720:4742 ioctl 2270 200001c0 returned -22
[  876.980110] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:09:18 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

16:09:18 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x700}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:18 executing program 4:
r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$KVM_GET_REG_LIST(r0, 0xc008aeb0, &(0x7f0000000180)={0x6, [0x100000001, 0x7, 0x200, 0x3ff, 0x2f0e, 0xc7b]})
write(r2, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r4=>0x0})
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r4+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:18 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x505)

[  877.216590] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  877.233450] binder: 4747:4752 ioctl 2270 200001c0 returned -22
[  877.243876] binder: 4745:4753 ioctl 2270 200001c0 returned -22
[  877.258670] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  877.363874] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  877.398716] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:18 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x50a)

16:09:18 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c5}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:18 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x14000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  877.626443] binder: 4747:4748 ioctl 2270 200001c0 returned -22
[  877.683150] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:18 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000340)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$PERF_EVENT_IOC_RESET(r1, 0x2403, 0x11)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  877.737206] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  877.782790] binder: 4745:4777 ioctl 2270 200001c0 returned -22
16:09:18 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x502)

[  877.826867] binder: 4774:4779 ioctl 2270 200001c0 returned -22
16:09:18 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1000000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:19 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0xfdef, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  877.986877] binder: 4781:4783 ioctl 2270 200001c0 returned -22
[  878.016785] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  878.071262] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:19 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x20000646)

[  878.164138] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:09:19 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x700000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  878.289552] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  878.298399] binder: 4781:4786 ioctl 2270 200001c0 returned -22
[  878.351295] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  878.363467] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:19 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x18)

[  878.396953] binder: 4791:4796 ioctl 2270 200001c0 returned -22
16:09:19 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:19 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x10000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  878.582420] binder: 4774:4780 ioctl 2270 200001c0 returned -22
[  878.624257] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  878.693063] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:19 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x503)

16:09:20 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0xe, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

16:09:20 executing program 4:
r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r2, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fadvise64(r2, 0x0, 0xa1, 0x5)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r4=>0x0})
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r4+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000180))

[  879.019922] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:20 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x504)

[  879.116857] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  879.124343] binder: 4791:4798 ioctl 2270 200001c0 returned -22
16:09:20 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x7000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  879.177829] binder: 4818:4822 ioctl 2270 200001c0 returned -22
[  879.200995] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  879.275208] binder: 4824:4827 ioctl 2270 200001c0 returned -22
16:09:20 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000240)={'filter\x00'}, &(0x7f0000000040)=0x78)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)
write$binfmt_elf32(r0, &(0x7f0000000300)={{0x7f, 0x45, 0x4c, 0x46, 0xe7, 0x4, 0x5, 0x5, 0x2, 0x3, 0x3e, 0x8, 0x275, 0x38, 0x33d, 0x6, 0x0, 0x20, 0x2, 0x8, 0x0, 0x40}, [{0x5, 0x6, 0x1000, 0xfffffffffffeffff, 0x6fbff8b2, 0x20, 0x28, 0x6}, {0x7, 0x28b, 0x8, 0x7, 0x6, 0x3, 0x5, 0x401}], "b201bbb1d1cdbf9cd09aa4f3772921bcd1d520c464f51af7a2e0dc51923ab5e8273b012c2f0d1cdb22eba6ff0ab6c76d7ecb186e95d140af99ba26582aad67e1ed76a966b1c9495af2f048cf0ce7d49d33cd6efa3f39f5cfd718a0e0e749c2d71434a9b7d0eeba18d4e2adb0d5b95ec28740a407719af55413a7582e77f6bfc519ce307b98a35072330159bd6314266b76", [[], [], [], [], [], [], [], [], []]}, 0xa09)

[  879.349825] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  879.368449] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  879.439747] binder: 4818:4828 ioctl 2270 200001c0 returned -22
16:09:20 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6400}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:20 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
getdents64(r0, &(0x7f0000000500)=""/193, 0xc1)
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
openat$ashmem(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ashmem\x00', 0x1000000000000000, 0x0)

16:09:20 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x7000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  879.635439] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  879.680985] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  879.682585] binder: 4824:4829 ioctl 2270 200001c0 returned -22
[  879.696341] binder: 4844:4850 ioctl 2270 200001c0 returned -22
16:09:20 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000300)=ANY=[@ANYBLOB="35c88bcb2faa1a703794bbc67e0f9932af454fbbfeeda5f591dd2a6df2ad0b9804b520d3a12b1f56ffc0a0d11f6155a0b5edb2bd0b9bee9eab68369578e5b47fb01ebc23ef328393552427e6ecb0512b2ad154c52a159d625916cd7e55747b5c8dbbf5d773ff3b2e426638eb1e62d6c54a3239423453d5947d2a3bce1f7190c28697f5dc449a17c3e8143394340e9fda3a156672aa2f7efe0eeeff6d7b1446ed5c33719a9ace570844204b186159d5a9e38a", @ANYBLOB="5434e43fb0f6eb4cbeda611ab6b58675cb0a49dafbaf8a9371470694c6997786cdd10f3ee109f514b8ecac9dcdae95439e0b781ac001d5ac5daac860be2e898e8a256aee0e41514b6064ee5d7798eafe39d3acf75de30d4b23ef6d85687e1ea3f4aa0b3135ee6cc275ecf0dadfe35aa34e4f7cb526d9958b5d11b416bbf0ea540336c738d40c32c71101ef27e68146fbfcfbd9afc95fa304ea45e83128da266c4ecf84681faa89108ce9702e0c98a45b44f5a52617", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYRESHEX=0x0, @ANYRES64], @ANYRESDEC, @ANYRESDEC, @ANYRES16], &(0x7f0000000040)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

16:09:20 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x4000000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  879.941169] binder: 4858:4860 ioctl 2270 200001c0 returned -22
[  880.072256] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  880.073603] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:21 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x68, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  880.150228] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:21 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  880.279735] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:09:21 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040), &(0x7f0000000240)=0x14)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)
ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000280))

[  880.398687] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  880.426029] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  880.439978] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:21 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  880.480238] binder: 4844:4857 ioctl 2270 200001c0 returned -22
16:09:21 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x5802}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:21 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
write$FUSE_NOTIFY_INVAL_INODE(r1, &(0x7f0000000180)={0x28, 0x2, 0x0, {0x2, 0x6, 0x3ff}}, 0x28)
setsockopt$IP6T_SO_SET_ADD_COUNTERS(r1, 0x29, 0x41, &(0x7f0000000440)=ANY=[@ANYBLOB="72617700000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x78)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
setsockopt$inet6_MRT6_DEL_MFC(r0, 0x29, 0xcd, &(0x7f0000000340)={{0xa, 0x4e22, 0xeed, @dev={0xfe, 0x80, [], 0xf}, 0x4}, {0xa, 0x4e21, 0x9, @mcast2, 0x7}, 0x800, [0x9, 0x6, 0xc7, 0x8de, 0x1f, 0x2, 0x6, 0x10000]}, 0x5c)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  880.690003] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  880.738065] binder: 4858:4885 ioctl 2270 200001c0 returned -22
[  880.747441] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:21 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="2c6c6f77651b630a013d2e3a66696c65302c776f726b6469723d6ef8be2af20d6b34724a7f6e4207e9367a9a0dd9a52b2e963085767a65df1387c0079127d390a860720a5490c21d085e89b69c6606491140f42a3aec49eae28b61525d6716098834e6da8501959e087acca40799b3fd61a62a065237d0186580091cbe4b31b1bee0e68382b1bca5958cc7f6df1f5ed3314b4cd88327f5b48591a668897d2f568ea5a80cdfca4d450b2007e53647fcbef8aa196230c5f9a70f1baf173820581365e7431831"])
r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x0, 0x0)
write$selinux_attr(r0, &(0x7f0000000240)='system_u:object_r:public_content_t:s0\x00', 0x26)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r1, &(0x7f0000000140)=""/65, 0x506)

16:09:21 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x8701000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  880.860775] binder: 4887:4892 ioctl 2270 200001c0 returned -22
[  880.999482] overlayfs: unrecognized mount option "lowec
[  880.999482] 
=.:file0" or missing value
[  881.005472] binder: 4894:4898 ioctl 2270 200001c0 returned -22
[  881.080059] overlayfs: unrecognized mount option "lowec
[  881.080059] 
=.:file0" or missing value
16:09:22 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)
open(&(0x7f0000000040)='./file0\x00', 0x101102, 0x8)

[  881.228027] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  881.267880] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:22 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x200001e7, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

16:09:22 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="2c6c6f7765726469723e753a66776f726b6469723d2e1e00000000"])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  881.338042] binder: 4894:4901 ioctl 2270 200001c0 returned -22
[  881.385589] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:09:22 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x64}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  881.496032] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  881.574638] overlayfs: unrecognized mount option "lowerdir>u:fworkdir=." or missing value
[  881.611786] binder: 4887:4893 ioctl 2270 200001c0 returned -22
16:09:22 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x10}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  881.666715] overlayfs: unrecognized mount option "lowerdir>u:fworkdir=." or missing value
16:09:22 executing program 4:
r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffffff, 0xc0106426, &(0x7f0000000280)={0x3, &(0x7f0000000180)=[{}, {}, {}]})
r1 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(0xffffffffffffffff, &(0x7f0000000340), 0x10000014c)
write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000006c0)={0x1, 0x8}, 0x2)
r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f0000000340)=0x3)
r4 = syz_open_dev$sndpcmp(&(0x7f0000000480)='/dev/snd/pcmC#D#p\x00', 0x5, 0x101000)
ioctl$TCSBRKP(r4, 0x5425, 0x80)
ppoll(&(0x7f0000000380)=[{r0, 0x4001}, {r2, 0x1000}, {r2, 0x4408}, {r1, 0x100}, {r2, 0x2415}, {r2, 0x8000}], 0x6, &(0x7f00000003c0)={0x77359400}, &(0x7f0000000440)={0x4}, 0x8)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000700))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x941ce1b}], 0x10000137, 0x0)
fcntl$getownex(r2, 0x10, &(0x7f0000000500)={0x0, <r5=>0x0})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r4, 0xc1105511, &(0x7f0000000580)={{0xa, 0x1, 0x100000001, 0xae8, '\x00', 0x9}, 0x6, 0x120, 0x7ac5, r5, 0x4, 0x0, 'syz1\x00', &(0x7f0000000540)=['/dev/binder#\x00', '&systemeth1\x00', '(#\x00', '!system\x00'], 0x24, [], [0x80, 0x80000000, 0x42, 0x2]})

16:09:22 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x40000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:22 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="2c6c6f7765726409003d3c2bfbd019f6f8dd2e3a66696c65302c776f726b6469723d2e"])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00000002c0)=<r1=>0x0)
tkill(r1, 0x28)
getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000040)={0x3, 0x7f, 0x200, 0x83b, 0x6, 0xaea5, 0x9, 0x90000, <r2=>0x0}, &(0x7f0000000240)=0x20)
setsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000280)={r2, 0x1}, 0x8)
accept$unix(r0, 0x0, &(0x7f0000000300))
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  881.900272] binder: 4925:4928 ioctl 2270 200001c0 returned -22
[  881.947922] overlayfs: unrecognized mount option "lowerd	" or missing value
[  881.985413] overlayfs: unrecognized mount option "lowerd	" or missing value
16:09:23 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0kdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
iopl(0xfffffffffffffffc)
getdents64(r0, &(0x7f0000000340)=""/65, 0xfffffffffffffde5)
ppoll(&(0x7f0000000240)=[{r0, 0x100}, {r0, 0x20}, {r0, 0x4000}, {r0, 0x40}, {r0, 0x1000}, {r0, 0x5002}, {r0, 0x1}, {r0, 0x280}, {r0, 0x400}], 0x9, &(0x7f0000000040), &(0x7f0000000300)={0x8}, 0x8)

[  882.157687] overlayfs: failed to resolve 'file0kdir=.': -2
[  882.195968] overlayfs: failed to resolve 'file0kdir=.': -2
16:09:23 executing program 2:
r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x40000, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x1f)
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r1, &(0x7f0000000140)=""/65, 0x506)
socket$nl_route(0x10, 0x3, 0x0)

[  882.390704] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  882.407896] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:23 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

16:09:23 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x4000000000000, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

16:09:23 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  882.544657] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:09:23 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setrlimit(0x8, &(0x7f0000000380)={0x4, 0x3})
write(r1, &(0x7f0000000500)="6126556cb373c261960584a48008719496003e050636bbd1ec09f2f3854e054c6f3b1068b9f5b181df572bd4a302844b7f44e4e4448df5360c4418bb21a78e69a480162d263dc81f8979635a370db3476a5c29d20ed63b386ac03d12bb916f2d7001f511d4a1c9ab0e039c129dcc7564ea182716be195ef486538cb478876b38360a000000000000a2e0aea1a2ae9c5acea26d15e580fc34cb0f1b476db86f4cc413a19af82b57a31ae371a5f10125bb7273c5e088d571255b8cbb6d05695d0000000000000000000000", 0xca)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
getsockopt$bt_BT_POWER(r1, 0x112, 0x9, &(0x7f0000000280)=0x314, &(0x7f0000000340)=0x1)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
mq_unlink(&(0x7f0000000180)='wlan1+wlan0*cgroup+securityuserwlan0selinux.\x00')
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  882.649162] binder: 4925:4932 ioctl 2270 200001c0 returned -22
[  882.674000] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:23 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x14}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  882.714644] binder: 4954:4955 ioctl 2270 200001c0 returned -22
[  882.725226] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:23 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x64000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:23 executing program 2:
mkdir(&(0x7f0000000280)='./file0\x00', 0x2)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYRESOCT])
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.stat\x00', 0x0, 0x0)
write$FUSE_INTERRUPT(r0, &(0x7f0000000240)={0x10, 0xffffffffffffffda, 0x1}, 0x10)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r1, &(0x7f0000000140)=""/65, 0x506)

[  882.904983] binder: 4961:4964 ioctl 2270 200001c0 returned -22
[  882.950935] overlayfs: unrecognized mount option "01777777777777777777777" or missing value
[  883.049398] overlayfs: unrecognized mount option "01777777777777777777777" or missing value
16:09:24 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
chdir(&(0x7f0000000040)='./file0\x00')
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  883.356375] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:09:24 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="2c6c6f77657264696b6469723d2e0000000060cd324b07a9ea7c00"])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

16:09:24 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0xfffffffffffffdef, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  883.494207] overlayfs: unrecognized mount option "lowerdikdir=." or missing value
[  883.504975] binder: 4954:4975 ioctl 2270 200001c0 returned -22
16:09:24 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200), &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000240)={0x3, r0})
vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000340)="0a8625a29b2ae3fb41f15f5e6dada06cdf84e7e02efc70a9872252f06c55789dad86addfd2e21b9abe1dc23fe3a588f8f83825cac42a4d557de78c1a689bbd135924ff7fffffb5c8786889de1721b48826c79eef2edcb2f65eaa00046a79660b4feb1fe051231dd33fefe7341279b1ae84a42f72d3552d9c3000921818f85b5d9d4ded17a2fb6358ae2a539f5976aa049b23d2f8980000000000000000000000", 0xffffff6e}], 0x1, 0x0)

[  883.562905] overlayfs: unrecognized mount option "lowerdikdir=." or missing value
16:09:24 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:24 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x800000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:24 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000040)=ANY=[@ANYRES64, @ANYRES64=0x0, @ANYRESDEC=0x0, @ANYRESOCT], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqeee\x00\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  883.696102] binder: 4961:4987 ioctl 2270 200001c0 returned -22
[  883.709976] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  883.731382] binder: 4985:4989 ioctl 2270 200001c0 returned -22
[  883.863132] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:24 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x87010000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  883.914844] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  883.971187] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:09:25 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getsockopt$inet_tcp_int(r0, 0x6, 0x11, &(0x7f0000000040), &(0x7f0000000240)=0x4)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  884.070640] binder: 5003:5005 ioctl 2270 200001c0 returned -22
[  884.171485] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  884.219313] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:25 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getsockopt$inet_sctp6_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000000040), &(0x7f0000000240)=0x8)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  884.497865] binder: 4985:5012 ioctl 2270 200001c0 returned -22
[  884.595196] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:25 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x58020000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:25 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
symlink(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)='./file0\x00')
pipe(&(0x7f0000000080)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$DRM_IOCTL_FREE_BUFS(r0, 0x4010641a, &(0x7f0000000280)={0x7, &(0x7f0000000180)=[0x1, 0x9, 0x10000, 0xfffffffffffffff7, 0x0, 0x80000001, 0x80]})
write(r0, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000340)={0x0, 0x3})
ioctl$SG_GET_COMMAND_Q(r1, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r1, &(0x7f0000000000), 0x0, 0x8000000)

[  884.646282] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:25 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)
openat(r0, &(0x7f0000000040)='./file0\x00', 0x3, 0x89)

16:09:25 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  884.795657] binder: 5025:5028 ioctl 2270 200001c0 returned -22
[  884.819645] binder: 5003:5030 ioctl 2270 200001c0 returned -22
[  884.947769] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  884.962441] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:26 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x6000000000000000)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

16:09:26 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x3f00}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:26 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="2c6c6f77657200000000000000000000d643847e370ee54744b8d87e8522816de4026a690000000000000000000000"])
getpeername(0xffffffffffffff9c, &(0x7f0000000240)=@pppol2tpv3={0x18, 0x1, {0x0, <r0=>0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000040)=0x80)
setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f0000000300)=0x5, 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r1, &(0x7f0000000140)=""/65, 0x506)

[  885.070316] binder: 5040:5044 ioctl 2270 200001c0 returned -22
[  885.098307] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:09:26 executing program 2:
r0 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x40000, 0x0)
ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5387, &(0x7f00000003c0))
mkdir(&(0x7f0000000400)='./file0\x00', 0x102)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00')
sendmsg$IPVS_CMD_DEL_SERVICE(r1, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x1c, r2, 0x400, 0x70bd28, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x4c040)
getdents64(r1, &(0x7f0000000140)=""/65, 0x506)

[  885.178705] overlayfs: unrecognized mount option "lower" or missing value
[  885.195582] overlayfs: unrecognized mount option "lower" or missing value
[  885.246258] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  885.298854] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  885.320363] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  885.335471] binder: 5040:5046 ioctl 2270 200001c0 returned -22
16:09:26 executing program 2:
creat(&(0x7f0000000040)='.\x00', 0x20)
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

16:09:26 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x7}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  885.485621] binder: 5053:5055 ioctl 2270 200001c0 returned -22
[  885.549177] binder: 5025:5059 ioctl 2270 200001c0 returned -22
16:09:26 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x258}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  885.615946] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:26 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$P9_RREADLINK(r1, &(0x7f0000000500)=ANY=[@ANYBLOB="1000000017020007002e2f66696c6530318a77a90eaaa649883153ea9f5b0455ff34c72a9a7c8313a857454ee7131503e0879627cd705a4f6fea840b137b1089536b71fdd4bbbe970a0efb0980f78cd2ee0dd9fa8ca579dd4915a2209bdfb34801cccd22f4a6dbf4a74b620943128eefa8b1f025a7cecf3db8be3f8374d5bceeed64ff8776ad23ad7f331541b17ae21e3741387cf5942ee57ca06a103c8cf85833dee70472c9cea2227cddf1618cd3fb45fcdb2a29713f4fc4b19e921b22cb7c08fe27fa1993cd131148eb73d5cb7117b92deda55e512a62722ce93d2d5b7bb687f5955b7c1825f0e44f2e6f82ad957d4e998e7d9a"], 0x10)
clock_gettime(0x2, &(0x7f0000000340)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
setsockopt$inet_sctp_SCTP_RECVNXTINFO(r0, 0x84, 0x21, &(0x7f0000000180)=0x101, 0x4)
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  885.662499] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:26 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
getdents64(0xffffffffffffffff, &(0x7f0000000140)=""/65, 0x2b79c86b)

16:09:26 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:26 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x200000000000000)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  885.827815] binder: 5069:5079 ioctl 2270 200001c0 returned -22
[  885.855745] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  885.957516] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  885.990323] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:27 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
setxattr$security_selinux(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.selinux\x00', &(0x7f0000000480)='system_u:object_r:adjtime_t:s0\x00', 0x1f, 0x3)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)
setxattr$security_smack_transmute(&(0x7f0000000040)='./file0\x00', &(0x7f0000000240)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000280)='TRUE', 0x4, 0x2)
getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000380)={<r1=>0x0, 0x100}, &(0x7f00000003c0)=0x8)
openat$zero(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/zero\x00', 0x80, 0x0)
getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000400)={r1, 0x100000000}, &(0x7f0000000440)=0x8)

[  886.129329] binder: 5053:5057 ioctl 2270 200001c0 returned -22
[  886.234145] binder: 5069:5086 ioctl 2270 200001c0 returned -22
16:09:27 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x8}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  886.285583] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:27 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
ioctl$FS_IOC_FSSETXATTR(r2, 0x401c5820, &(0x7f0000000180)={0xe4, 0x4fc3, 0x10000, 0x3, 0x8001})
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x2, 0x0, 0x0, 0x50d, 0x8000, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, @perf_config_ext={0x1f90000000, 0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r0, 0x2270, &(0x7f0000000440))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  886.342710] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:27 executing program 2:
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000300)={{{@in6=@loopback, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r0=>0x0}}, {{@in=@multicast2}}}, &(0x7f0000000240)=0xe8)
stat(&(0x7f0000000280)='./file0\x00', &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, <r1=>0x0})
lchown(&(0x7f0000000040)='./file0\x00', r0, r1)
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
utime(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)={0x1237, 0x9})
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000580)='./file0\x00', &(0x7f0000000540)='overlay\x00', 0x0, &(0x7f0000000500)=ANY=[@ANYRESOCT=r0])
r2 = openat$ppp(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ppp\x00', 0x10100, 0x0)
getsockopt$inet_sctp6_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f00000005c0)=@sack_info={<r3=>0x0, 0x6, 0x9}, &(0x7f0000000600)=0xc)
getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r2, 0x84, 0x13, &(0x7f0000000640)={r3, 0x6}, &(0x7f0000000680)=0x8)
r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/backup_only\x00', 0x2, 0x0)
ioctl$TIOCLINUX7(r4, 0x541c, &(0x7f0000000100)={0x7, 0x1ff})
r5 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r5, &(0x7f0000000140)=""/65, 0x506)

[  886.399160] binder: 5090:5094 ioctl 2270 200001c0 returned -22
[  886.514649] binder: 5096:5100 ioctl 401c5820 20000180 returned -22
[  886.666499] overlayfs: unrecognized mount option "01777777777777777777777" or missing value
[  886.750501] overlayfs: unrecognized mount option "01777777777777777777777" or missing value
16:09:27 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x64000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:27 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x800000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:27 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x80)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
statfs(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)=""/208)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  886.858409] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:09:28 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x100000000000000)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

16:09:28 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0xfffffffffffffffe)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="2c7f797765726469723d2e726b4469723d2e226cd61d2dfcca384f3f642d5a1da4e2a05efecb000ecbf6773d26b0ead8611397bb40ade990dc088ec121d6867c4a6e595a8361f226891a901ff9ccd297b483b2d4097da802289a7d8bda2de46a3676f27b7a1fc966dea8c7a98aa03951aad5c5bcae735a7fb43cf9f960c5321c7654c735685c2974628092924f8ca4ad2342414e0b77d1ec68b171f146a51da2d8d89cd0985171f3d7e9c745c96ee0983a55e6be00115a19d80fdc1e1858bcb0d082a11edb905d"])
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x20000)
getdents64(r0, &(0x7f0000000300)=""/65, 0xffffffffffffff05)

[  886.943316] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  886.962904] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  887.030325] binder: 5090:5094 ioctl 2270 200001c0 returned -22
[  887.122191] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  887.129687] binder: 5096:5100 ioctl 401c5820 20000180 returned -22
16:09:28 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x8701}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:28 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$EXT4_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000180)=0x8)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000), 0x0, 0x8000000000000001)

[  887.224639] overlayfs: unrecognized mount option "ywerdir=.rkDir=."lÖ-üÊ8O?d-Z¤â ^þË" or missing value
[  887.256926] overlayfs: unrecognized mount option "ywerdir=.rkDir=."lÖ-üÊ8O?d-Z¤â ^þË" or missing value
16:09:28 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
readlink(&(0x7f0000000040)='./file0\x00', &(0x7f0000000300)=""/149, 0x95)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x400100000, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = accept4(0xffffffffffffff9c, &(0x7f0000000240)=@nfc, &(0x7f00000003c0)=0x80, 0x800)
setsockopt$inet6_int(r0, 0x29, 0x35, &(0x7f0000000400)=0x4, 0x4)
r1 = getpid()
getresuid(&(0x7f0000001900)=<r2=>0x0, &(0x7f0000001940), &(0x7f0000001980))
lstat(&(0x7f00000019c0)='./file0\x00', &(0x7f0000001a00)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
sendmsg$netlink(r0, &(0x7f0000001ac0)={&(0x7f0000000440)=@proc={0x10, 0x0, 0x25dfdbfd, 0x100000}, 0xc, &(0x7f00000018c0)=[{&(0x7f0000000480)={0x1410, 0x19, 0x100, 0x70bd2c, 0x25dfdbfc, "", [@typed={0x8, 0x67, @ipv4=@local}, @generic="9857c9f64bb5a7b9aae3d99b13a6e42eff181be9df80b532a0cf6a75debe85de7aa72c38ca01a2f34ecf5064f45c11329a1fa6d4f01725923826bfc3d7c2873a93dc36f9af3a67e7d7a827fe59c5fa5019e74166968dd4f92284c87ae9c97208dc02609ccf7568ab04ec78789dd2e9de97932ce7a37d96ca84f092fcd881616895d58b52c9e0fa4bf42e9ddf145065cf7339f611b3ba4b4bad59e8f3fb223cd441bf0a04a53991c7dba305075197aaee627e546d1769e68d7082f7c5b73bfe8c4c1fe6f22048b27cb84e36b9d487277089eef8ae5d17dcaa9292783072cc2f58c00805a332e706677c46be50447d6ee369a807718538706adfc7301355761eaaf86d55ac54e44d89cbfaeae61eff71c1bf15a23850a63908acd16cf32b33a0b10197cd9e9cb48a32daa2f704f36a98b3c3e4dea22a467bc2bcb5aef82b9ee6b16bebc97b99acc699ecb8dafcbcd1234d6daf528bc0e4a3c4104bc75a60fcf3277a7b6854f8e61a79a645c609c8f54044f445b3d28e67c6da9fdcd58d496640ca77d1e913a5588ef0e35dff6f1bf0da1d1865582d71a571582c7bc41cc08206a7723920390527f1d24b7ee51fec41c859761a97a6d54d447a24d136994bc23fd93b02a43b96b07a2575eab65aa4d398974550d6adb89a44950562f1ea58e439eb978686f5f840113387b409a9186213f1775664950844027b156a8dae5d48350199d7a93136a7ee9e5aa089b2876594976b5a51cc04c17b1d6910d9a34a96de82fa7d84026539e880e01509793ae88e5544efa748cfe602d426f297350ea979231652c9b714c9253426d992e7f025ab7ba504a8f288758e30a6ca47194ba70abca436a69e41679e4ea7e9e7db00452af340956548d5ae18ba4811bba5c74dd4baec207d7ed3305a15a9ef41caea5a99dbe91da6d92acaeac717a320d731a32b6dfa4f5e0767d88c4901537a1de2bad31f8fb4a0b6c7da20135713f9cfe85f49a45bd7b7671b3ef949669c49d36c35a0d76d68e947b92d7aff1608e78edb063b2d6dd0a29f8db2e539c3a242053bbdb3ac248d983ab0448bbf8d6fa705cc543655b1815b09cf990cdd1e1b71de460836977fee45c09a1c345f20516640ed85f1e1b7514c7215b73e336ba0caae2a71076871f32be11942e37b1259457c456a404f5d4992d930d54d7f1be542dbb27c8ce2cb1dc44ef0843304fc56ede75d0fd0a4e8fbb1fcd7d5ff592a90b06619bc69c9d1476ef6447a704a1f14dd120ea1f62c8a0d3402fc5fe0f35c3f15ae0f6001979ecac2a8c54ef217ca57e76c68d00c04c7b2994085f164d67ff29fdda854f0981d4dda1fec0b9c9d95c9aedb1ad5e24d9bf708999ce253c7591d1cc1c428a43de90fa945cee21898253c2a933aadff18a9577b8fa0471e5d5c1578037fb5245493c6fe1345ff0b11b588bf0288426526e645c79d61a117d73e728e944794adad7049283157141430af55b4bca086e2729a2429dc701542aa4ad7ab0b13861d36318dfe050c594c43965c8b2392645c9eeff8e924212b756a2f1c035dde595cb8a6c2df9a1e335062e9a8949f23e77e25ba744efaf5df238da48509744df2a63bff3ac7b5be52f2696a0334fbfcf73f6446554ad42f2dfa5060298d18fa9df63a1c325603e8ff3407e5f4742457888317e96782d671ea8219f15d3fd792144bb1096fa521b614210aa1c70bea84b21095cec4eb1c868b5944867ca4ae2045c923e2013fdd47b59c9bd814c3e40f98e2905e678d7c7629f8c287660715edd388e8354f31a55a8b0f35007ceca9a6aa231ea3f2cd66ecd1480c652fa5a1bd5b61f4da86fc8e7882b56eea374276f39039088427b0446f505d7bcdf82820f2415d4fda846ce30aea1458b3326687114eb38b07d32d8cb7f29310e6d861c6e04611812c87329a68adeb03dad722cfb114ae0e3a01cbaf342a106f7d5a87daa85a7ffd130035e9162a3f43de0bc6f6fa3fd35e8c4cacdd6cfc855d0a34b15f6c0360b1577236641613a80daaa5a5d2823bed5484ae0c86d9357e50ed28d027a0e46b4f34adb6725ba5ee7f6fde449ce662b934adbb6c7df6b66d4b9b512d24a7ed7ce2dc3dbb3096f7d67958648eb34f1671543017033c3d28a9f9dbeec3d2451030815a210f52ca6941c31a6ed370e5f9d8509bce90b797be628e289f5a95fe9643416c7e11ba71896eddd5130abf779fa8fdece31f9970cc490e8c07f8079f98ce23172e6d7e2788e983b7f88c63cef25906a755140c2b2848706e2b35e53d35a3475105e7728bc3044898a5dae908466df7c6f325943c80842976686c69645ec21e57633222c3485bc0c4311728608acc1a213ddca5fe59d5891b8a16d97c187604ec8b51b936b93f1bb9955744c3c9a24faa419658908c7ed829ad03832cdff4931664492aba2a9767f881c8f40f1e0925c483a7ab527e3293047853928f8d9db86e75702bcfe81fd74fcf4c2a1ce752c3372711ea5e914736a2e57c895146518d86871beb3b722f8eed50121b5bc92719e9dcf7803c4d8232205946668530abe2bf41ef47cbb8c80356338ade480f2b1205589a9845cbcdf5597ac22a0441c28bfe2cc0674e0d6822234fec07a081282c8aa5aae3a8204b71eabf0d793757da8f56d8fb6e973a5e48ed5bd5db906154473a1f6cd444d4d069773e4797456a3b477ec3829d16f1ee6e60b8df60f99d67474608a7a27321c328b9ed520a6abedaa69f8d20e68f12b188bb8111282830a37ed81a1709abc9c926f31b5b388ad44bced7dcdbff057b8f58b04b7db498daed2e95e2137e55ca9915c2805c704e8f1c1d26f96dbed692c2119eca6f4dd163ec2a041b52dd275546290b012eb92d7d99a9356e8b27fe069ef2dc48b8fec53e9bd63c920ef421bac21db7be78b3ffc6185cc79f4f53252bccf21165f62dc83e65589d2cbee6fd38036355835832ccc4f1084fc088318f1b452659e82d12417695f3a30268fe8ff7074310e6223118d003824d99f8754de9e365e0be30f3730fa7765ee78f922cfac886e847f0d372d3a2c0c54cd9dd5db3b1a57c82fdbf37ee67282a9e5cf36a60007a7659bf7ef8c8c17f75b387cf2a5da47b21455021fcc4c481fcb39a4b0fd78320b3f1674f5dcb78f484c08ca3ccaf1262ccce05647ff8cc12c1fc71177f89a405c11cb4e1135bf94592c805d6c7b08b5e47daa8bdfa1ba93e5a029e6b17ab1bdd9bb5a4ec654868d8b655d588976771ffbf6345f283d0cd43ebcbc61bb37ddfc79fdfcbe4deb9d2b13a86bdc81eb921bb9e7fb287d209ecdde06f4aa2d258bed16b64f786bb66f7d4cd0d578ece1d0f5333a2ad75191e87292f61abe6c2d752e80bd6717e5893031c7bbeeea470bf86f59423027dfa3feaec5f451a34c2d01b04bf2624b5231ff167b84e2e5a4bf5fd1eba732638e39ee5a71860e41ea92ba80a203fad0200f9796655eb05aa00d28323ca62615f0020f54b2420972fef76ce8f3b2fbf8778d7531b59f82232856d20707b88ccf7b0b113b213f094d1779c1989a013664aceba3f4ad5439a88096df805bda07cae7f7ba23f4d396a79f78ad9444b99e4137bd4c249cc7be92e7ec933d75fadddcd1d08c640f2cd5e8052618d641a1a9cd0c6ce9ea420c6cbcc9643d58f131d9464bfcbe867944d041293b8cee43bfaef0116ee2612d64d2d203495695c9cdbb1c9e9a791fcef1feb7fe415471a54615cdbf2b3c8bd97ba89aaed60c92e30c4d536bdf46940ae89b3105e32dc3db30cd60143139cb28baf9940608fc22c69b654edf489788e9377352c924f5953a212a6f3fdd5a63568a192743aee5102f34d51ee7896ed1d69bdea94a20816940aec93793003a343e51c95e418d3dbae4d6b2232971f4db202e98a4e2c4ef409b86b5c3fcb5271d8feedcef1842942960c9ed39d3836e36ae8313604e809e86e5e7d1f747740fa18f3d40995d69c06fa899cbae0d74055befd66c6f80602e9e7c8c6fd3b9995fd4a017f712b3064c359331f7f1bc892e160a091de4a553a4897abc7ffa7bfb8107a2f9923ccc21e1615bee4b7e91cc02c811575b945cc5073051240c71612517f4752c4a882e65514067e9a53dfacbff6b4885ed63d27cd28690efca9b3f08fa6a3c66c52d1c980ee7abc6594a80b30f07c21d6516b991e612e90613c0f54ec5d469ceb06044aa1a28cf55088bf1184fed6971488544b8dd65dd964ccaa827cb268db57625a5329fdaab70c698eb91aef0389005158b434d79bd572214552898606013143d5442a6dae7ddea440ddb0fa8a39e30c771d2d3463d5b9a1d497b29d3856eddc37d76c2cb3d0bfdd1f956c8c1f388a03f80ba42b4129482433b72a5bafb61f994c662773647095beadecac48113a9550e9c849ee636d996a4ed608dcb6a43b1ae8b84e3f063828767f2262f85db499121b579b6261afa3f733bdde0af9fcffa4370e0027d2b3ef0ee51fd8927215b145fbe373ba2f211a6a1aae4a64177b532a6c80fc5d3b87a260687ed8f63af1cb7ee58998652975ab67ab973243c6c94ff78600037afd09422b25b6e6e84c66886aea1991bcf6ed522c7a73da41969120be75b515bc0721ae9b8a9eebbc61f28e68c18d2f67b1b68e0eada155cc7bb22241b1e877614151296015ceca181a7e365ed6259d7e0fc123d1a11584e6632bcb5746666e3027b026a8196b84cf06f640827e40ed00379f64390d2238af723cce6f1ccce75379ad4b7bbb5205dd5e98416ec69a5b312bd0cdd489005e8446fe0887d5120bdffa024136a284b972c5e7db3f03f1a0bc9e84579cedc01d7aeb32bd2fe8b75d96ebfe6a83ce73139d0760c3f8ab3af8e7f099b02ba77a1d2393f287dc7660a7cced4fa03633ac8faa04a9599e80a7c8940803864a1f218f5326d315974103a0ad240d2d95836cc3b3583c8294c3d674088d3ed1593d77362e3a110f0b503f2d983b914131d83a6a8ecaf5675de543de7fca03cb618c19448f82cd446031427baa23174b3719de91d1ed51048edad049a5f2a38d38b5012c11b506843aa878c729746049e3e326145a7d77b31fa3d43dcb098c7dd12a961dedab5e589ad6a83d97b84309f2f227123c39728d272451a38228ecce91cd45d90bde90dc17b2f10809ae0a750db13afbe8bd2a0a80a402476eb4b4a315ce5422f1c8b2c413166f1e548d5d617632594c3cb37536b63b8de39fbf34229d3af9cfc25427f90f5ed2ad5c5886575e1753c22e5e294271a5bf4e0b3a86b9ee0c3b89464f40c34256cee7cfcc3179056d8119ed07bfe630eedc66015dc70560526276bdb058e0baa3c3fe46bc7d4cb6791609a943eb570aefc4f95db956fc5be0229f810a1e20d4dee2a01a066c6333e065107f804e4b29eac9a7a51fcf7ef6ce4b21589a3d488a8fdd4b47af34cfb3ef9bea78773d706e533a34be16c68cc456be68abeb9e3529d5b99044edb727077016537edf39c61a28050fee4e4651b79347f48dee5cb43f0f9bb2e5d3524ce460985df38914efb23c4f6f18cbd1dc162336205e13898151e613336e1fdb5cbc80522429e708354353046f55f3f1966e996a09bf7882e5528222e15c4c0bafdef03fd62e5b9595bfaaba03d92d255ae05e76d8092d67b11883b09f490d7bbd5c73c5ae4e2e2a7fc633f78b855324ce67c58afc0520c4efcfe84b725200c74ad3d365ff7e1d74508cf49babefdf6ca8f33196399d9bcbc8cd6a9691e6ac598c2f0870cda42b63bca07ca676a91d8cb6835570b8365395e58c2d8a77cbb34d64016292ff7a94", @typed={0x8, 0x69, @u32=0x1}, @generic="ae81d2704f58f864ffc04d33a153fc1a6cb3385a47b819b321b5a5d64c239af85ca4b03306997e6b952418e2def3eb8e0f5941a488618a01e68ca912f90e4f982a0378e37814b4bf3d38909ed5c7a9252623de3cfa9dad86539e40cf883fa30beb909b2899fde38896aca6433106a909a326a50a481b9c7d23c94bb5be37ac47b1b3c3b2e3a2320c1a595f963338e7551bca1f54feb0918bb095b77701f23d9635524b18e3b49a00c112c7b07a567b2a5dcbeb3286226585cda22853a51684ae5e", @nested={0x1a8, 0x27, [@typed={0x8, 0x4d, @ipv4=@dev={0xac, 0x14, 0x14, 0x16}}, @generic="647643da979223056f5dbff639c6d369938cd492b8adb763d94fb0d275d874cf5f4aa255d237062334cf0d10e2913886a7de8cc64bb3d8879e425752c128dafc0dce3ec6abecf91831342624974d84c10349d00284904cb7b77db31f267d7a6c5aa0f1d857157a9cd00521506a7da2", @generic="8fa905d90b7da6e37c3d0af07edeb668ccf321a51d9ca61d1f094f59cc11fa7fea6febb476d08a39959fe546b9a5560b795c95fffd1680bcd5caade9e99620cb8f83bfb956433ab7731fb58ace694e393e2f5a6d11ded5bf9e803735909aa5a83f0a7a23346bcad13f3260a9fd4d3e28383d360055c5a3d083e93ad62e69627b2528d01629361ffcf3fe77f6c01e2c03ae462bc2bb5f1ae0e44764b5da0afbe9c967a8ff57ad01747d84e509ae1fdbe68c9cdc8c811d63576c242201cd107a4e290f", @generic="9d5cd16ad8d8affcce178e8be5527bbc4955426dbb0f62a48173b6ebca7d2f416ad16887bc09247a0f39cefd1d6786f2dfb73112d0f032de7e52332572666440a066f590a8992b2b23a5cf11e7a26ad8cbcbd984d039255d321610b0840dd5c6d2427c6943a347b670"]}, @typed={0x70, 0x7d, @binary="18888a745612e6fa94dae796e589bf93b6e4194514ed0f0443a4387ff68ed3d98d3ac8dab0f1478a33dbdce0c0b01fa447de2342202136ce413ced03b9e0110e0346dc694d23f2487153dab3241e10588fba958187e12c145ec75bdd318295b5302be5cd118b3d80015ed7b7"}, @generic="91e2d685faeb2c5514cd7d02a8c06a75b2efd4ff1066", @typed={0x100, 0x82, @binary="83a8d1606f087dc360dabe0c5c62f4984814463db570e2fcf12debe64eff73265c6122d108f7b690835da034b0c8905ec183dd8d0e9c0d61b5ca1eeacb2e670387a865013ec8f488f7aa6d88746f73057239d1b1d30231955d9b7af2770e222b46f913216a0055d75b7107eef80668a101902809b9ba91300a143a0e01189b8c3f0605e0b1b2d8d3ecf06133b58fe1e32061bb1873af9ead487d43fd9c725016972a47b9675a137e5580f97d67ce3ead9638f0531ba0213d2cf163d3441aa7ade98d950ea32e6ba50652d7c9a4dbe6233da47f18a8adbc981e80b1206c3a09d4e5b6b33660c47bb05bcbe9954810b411190c159591d4941e48a13713"}]}, 0x1410}], 0x1, &(0x7f0000001a80)=[@cred={0x20, 0x1, 0x2, r1, r2, r3}], 0x20, 0xd0}, 0x80)
r4 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000)
getdents64(r4, &(0x7f0000000140)=""/65, 0x506)

[  887.297577] binder: 5125:5129 ioctl 2270 200001c0 returned -22
[  887.345017] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  887.368148] binder: 5130:5134 ioctl 40086602 20000180 returned -22
[  887.386954] binder: 5130:5134 ioctl 2270 200001c0 returned -22
16:09:28 executing program 2:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000480)='/dev/rtc0\x00', 0x40, 0x0)
ioctl$sock_netdev_private(r0, 0x89f3, &(0x7f00000004c0)="8b2b47cbbfe4378250deee60154926a52b833cffbcb13330385de3a8f59dc3468c9d3761893891ca3c82b86c27acf060d19d7740f345c7439dc067a57eeaf7578c3c8c9ab5ec5793355c2d36cc5f16d10b4b5a1725993ffbc2b8ca2050ee14962556d4753756848335b8e1b967d849f50170a8868be18981d8dd515fa1e9bb7d01df283a619211ba3f85fd6882e1c03e20e2421fc3e8131a")
mount$overlay(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f0000000300)='overlay\x00', 0x1000000, &(0x7f0000000340)=ANY=[@ANYBLOB="696e6465783d6f6e2c6f626a5f757365723d70726f632c6db68a6b3d5e6f653d6f0065726c6179002c01"])
r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000380)='/dev/hwrng\x00', 0x800, 0x0)
ioctl$KVM_SET_CLOCK(r1, 0x4030ae7b, &(0x7f00000003c0)={0x3, 0x6})
mkdir(&(0x7f0000000640)='./file0\x00', 0x11)
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000240)='/proc/self/net/pfkey\x00', 0x8000, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="2c6c6f7765302c776f726b6469723d2e0000000000000000000000de45ca706cd9de235f245feb10ab5f7f44d4bfa6c3bbe0d93f0010000000000000f5bf633950bf50a887b31ad450ea6d79b67ad3482c37b215e372234c276dd0f5a6d9a4710db092c24efd61e2efd91f22caa5cd1eeaa23d1963def27a2550660992193fd22885381379e7a71ba67931ba65913d17573d72363d3e945acd71af37eed1edf16a1bb12cf89b2c1bc65a39dd159a14b2445c"])
r3 = openat(r1, &(0x7f0000000440)='./file0\x00', 0x0, 0x0)
getsockopt$bt_BT_SNDMTU(r3, 0x112, 0xc, &(0x7f0000000040)=0x1000, &(0x7f0000000700)=0x2)
getsockname(r1, &(0x7f0000000740)=@nfc_llcp, &(0x7f0000000800)=0x80)
setsockopt$inet_sctp_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f00000002c0)=0x1ff, 0x4)
getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f00000001c0)=@assoc_value, &(0x7f0000000400)=0x8)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000680)={<r4=>0x0}, &(0x7f00000006c0)=0xc)
fcntl$setown(r2, 0x8, r4)
getdents64(r3, &(0x7f0000000140)=""/65, 0x506)

[  887.548164] overlayfs: unrecognized mount option "lowe0" or missing value
[  887.600564] overlayfs: unrecognized mount option "obj_user=proc" or missing value
[  887.638598] overlayfs: unrecognized mount option "lowe0" or missing value
16:09:28 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=\x00'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

16:09:28 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:28 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x5802000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  887.738579] binder: 5125:5133 ioctl 2270 200001c0 returned -22
16:09:28 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x4000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  887.866264] overlayfs: unrecognized mount option "workdir=" or missing value
[  887.880285] overlayfs: unrecognized mount option "workdir=" or missing value
16:09:28 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
r0 = syz_open_dev$sndpcmc(&(0x7f00000002c0)='/dev/snd/pcmC#D#c\x00', 0x1ff, 0x2)
fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000440)={0x0, <r1=>0x0})
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000480)={{{@in6=@mcast1, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0}}, {{@in=@rand_addr}, 0x0, @in=@local}}, &(0x7f0000000580)=0xe8)
getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, <r3=>0x0}, &(0x7f0000000600)=0xc)
r4 = accept$inet(0xffffffffffffffff, &(0x7f0000000640)={0x2, 0x0, @multicast1}, &(0x7f0000000680)=0x10)
r5 = getpid()
getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f00000006c0)={0x0, <r6=>0x0}, &(0x7f0000000700)=0xc)
fstat(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x0, <r7=>0x0})
r8 = socket$nl_route(0x10, 0x3, 0x0)
r9 = openat$tun(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/net/tun\x00', 0x0, 0x0)
r10 = epoll_create(0x2)
r11 = accept$unix(0xffffffffffffffff, 0x0, &(0x7f0000000800))
r12 = socket$xdp(0x2c, 0x3, 0x0)
r13 = syz_open_dev$rtc(&(0x7f0000000a40)='/dev/rtc#\x00', 0x8000, 0x2)
r14 = accept$unix(0xffffffffffffffff, 0x0, &(0x7f0000000a80))
r15 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000ac0)='/dev/kvm\x00', 0x12000, 0x0)
r16 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000b40)={&(0x7f0000000b00)='./file0\x00', 0x0, 0x18}, 0x10)
r17 = syz_open_dev$evdev(&(0x7f0000000b80)='/dev/input/event#\x00', 0x8, 0x200040)
r18 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000bc0)='/proc/self/attr/current\x00', 0x2, 0x0)
r19 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000c00)='/dev/ptmx\x00', 0x400000, 0x0)
r20 = syz_open_dev$vcsa(&(0x7f0000000c40)='/dev/vcsa#\x00', 0xffffffff, 0x80840)
r21 = syz_open_dev$sg(&(0x7f0000000c80)='/dev/sg#\x00', 0x200, 0x200000)
r22 = openat$tun(0xffffffffffffff9c, &(0x7f0000000cc0)='/dev/net/tun\x00', 0x800, 0x0)
r23 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000d00)='/dev/vhci\x00', 0x0, 0x0)
r24 = socket$pptp(0x18, 0x1, 0x2)
r25 = socket$nl_crypto(0x10, 0x3, 0x15)
ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffff9c, 0xc00c642d, &(0x7f0000000d40)={0x0, 0x80000, <r26=>0xffffffffffffffff})
r27 = getpgid(0xffffffffffffffff)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000d80)={{{@in6=@dev, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r28=>0x0}}}, &(0x7f0000000e80)=0xe8)
r29 = getegid()
ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000ec0)=<r30=>0x0)
r31 = getuid()
stat(&(0x7f0000000f00)='./file0\x00', &(0x7f0000000f40)={0x0, 0x0, 0x0, 0x0, 0x0, <r32=>0x0})
r33 = signalfd4(0xffffffffffffff9c, &(0x7f0000002440)={0x7}, 0x8, 0x80000)
r34 = openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f0000002480)='/proc/self/attr/current\x00', 0x2, 0x0)
r35 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r36 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000024c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0)
r37 = accept$unix(0xffffffffffffff9c, 0x0, &(0x7f0000002500))
r38 = socket$pptp(0x18, 0x1, 0x2)
r39 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1)
r40 = epoll_create1(0x80000)
r41 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f00000026c0), &(0x7f0000002700)=0xe, 0x800)
socketpair$inet_dccp(0x2, 0x6, 0x0, &(0x7f0000002740)={0xffffffffffffffff, <r42=>0xffffffffffffffff})
r43 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000002780)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0)
r44 = openat$userio(0xffffffffffffff9c, &(0x7f0000002cc0)='/dev/userio\x00', 0x10401, 0x0)
r45 = syz_open_dev$admmidi(&(0x7f0000002d00)='/dev/admmidi#\x00', 0x88f, 0x505200)
r46 = socket$inet_sctp(0x2, 0x0, 0x84)
r47 = socket$vsock_dgram(0x28, 0x2, 0x0)
r48 = socket$inet6_sctp(0xa, 0x5, 0x84)
r49 = openat$audio(0xffffffffffffff9c, &(0x7f0000002d40)='/dev/audio\x00', 0x200, 0x0)
r50 = openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f0000002d80)='/proc/self/attr/current\x00', 0x2, 0x0)
r51 = socket$inet6_udplite(0xa, 0x2, 0x88)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000002e00)={0x0, <r52=>0xffffffffffffff9c, 0x0, 0x7, &(0x7f0000002dc0)='mqueue\x00'}, 0x30)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000002e80)={<r53=>0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000002e40)='\x00'}, 0x30)
getresuid(&(0x7f0000002ec0), &(0x7f0000002f00), &(0x7f0000002f40)=<r54=>0x0)
r55 = getgid()
fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000003580)={0x0, <r56=>0x0})
r57 = getuid()
fstat(0xffffffffffffff9c, &(0x7f00000035c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r58=>0x0})
ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000003640)=<r59=>0x0)
getresuid(&(0x7f0000003680), &(0x7f00000036c0), &(0x7f0000003700)=<r60=>0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000003740)={0x0, 0x0, <r61=>0x0}, &(0x7f0000003780)=0xc)
ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000037c0)=<r62=>0x0)
r63 = geteuid()
r64 = getgid()
r65 = fcntl$getown(0xffffffffffffffff, 0x9)
getresuid(&(0x7f0000003800)=<r66=>0x0, &(0x7f0000003840), &(0x7f0000003880))
getresgid(&(0x7f00000038c0), &(0x7f0000003900), &(0x7f0000003940)=<r67=>0x0)
r68 = fcntl$getown(0xffffffffffffff9c, 0x9)
getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000003980)={0x0, <r69=>0x0}, &(0x7f00000039c0)=0xc)
fstat(0xffffffffffffff9c, &(0x7f0000003a00)={0x0, 0x0, 0x0, 0x0, 0x0, <r70=>0x0})
r71 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000003ac0)={&(0x7f0000003a80)='{ppp1/em1md5sumwlan1\x00'}, 0x10)
r72 = syz_open_dev$amidi(&(0x7f0000003b00)='/dev/amidi#\x00', 0x80000000000000, 0x0)
socketpair$inet6_icmp_raw(0xa, 0x3, 0x3a, &(0x7f0000003b40)={<r73=>0xffffffffffffffff})
pipe2(&(0x7f0000003b80)={0xffffffffffffffff, <r74=>0xffffffffffffffff}, 0x800)
r75 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000003c00)={&(0x7f0000003bc0)='ppp0\\\x00'}, 0x10)
r76 = openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000003c40)='/proc/thread-self/attr/current\x00', 0x2, 0x0)
pipe2$9p(&(0x7f0000003c80)={<r77=>0xffffffffffffffff}, 0x80000)
socketpair$inet6_udplite(0xa, 0x2, 0x88, &(0x7f0000003cc0)={<r78=>0xffffffffffffffff})
sendmmsg$unix(r0, &(0x7f0000003e40)=[{&(0x7f0000000300)=@abs={0x0, 0x0, 0x4e23}, 0x6e, &(0x7f0000000400)=[{&(0x7f0000000380)="68c5d85243a4ccb4932ab25fadd6665c688053e662b5f0e9e20b28598b89cc355108de9c9a7b584c868b9572d5a6c94b3473cd1603eb552670d7e7ff92093a58791e96c96fb8b314e2ff7323ef4b96b82151a8687308395f5e84bfc3d6c39bb0203e2a5fb1f6b7123a867a1a40cfc83c94c783", 0x73}], 0x1, &(0x7f0000000840)=[@cred={0x20, 0x1, 0x2, r1, r2, r3}, @rights={0x18, 0x1, 0x1, [r4]}, @cred={0x20, 0x1, 0x2, r5, r6, r7}, @rights={0x20, 0x1, 0x1, [r8, r9, r10, r11]}], 0x78, 0x800}, {&(0x7f00000008c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000a00)=[{&(0x7f0000000940)="e8aec3fde8e3d081bf597fc9e77dd5ca1d68aaf48fe0e52abdf7821854e68729598ec17b31e165b7484c76f7c1dbcdb496f811290b0c781f2327626be0c203ad80acff328d0a24d6d659775ea990e499bd716c7cf587d4418487e45deb744f42e062b8d2ec3cdd872f48aa2379b679f6f91ed35e82c3a6f8d128adc9f5dfa6a8bd9062ccd03b304a847443ef94bb058bab3b053164f645ee4dc4dc91160396f7ae", 0xa1}], 0x1, &(0x7f0000000fc0)=[@rights={0x30, 0x1, 0x1, [r12, r13, r14, r15, r16, r17, r18, r19]}, @rights={0x30, 0x1, 0x1, [r20, r21, r22, r23, r24, r25, r26]}, @cred={0x20, 0x1, 0x2, r27, r28, r29}, @cred={0x20, 0x1, 0x2, r30, r31, r32}], 0xa0, 0x800}, {&(0x7f0000001080)=@abs={0x1, 0x0, 0x4e20}, 0x6e, &(0x7f00000023c0)=[{&(0x7f0000001100)="45580bba1957c7c6bc5a1b0c3bc92fd2a1af265b58d4ce2deee0ce16e98f212dc01d888b6c91d535031899a2ac0b5527f2511e432d958c2ebe1678d71211ca965e37e5444ae39c58acb590e62ea3743356bccfe5138f8dce6290af799aad606cef04c04c8deb3f81c6177db11098c050ba38ad71ff256e624bac858374cb2428fe661e47", 0x84}, {&(0x7f00000011c0)="67da93b681b4e86d81b6df1aec0e6b432a5856fc88c1f8973c53411ccccee2ee99ad12a2912809ef3498", 0x2a}, {&(0x7f0000001200)="9987959a083b0b20d797342323e8b3d3cf59fcc9f309b8ab297e", 0x1a}, {&(0x7f0000001240)="0bf324fe6541cc43b9812a5190edae3d2c7fdb5cbce4de52de3f", 0x1a}, {&(0x7f0000001280)="7d93b557a03866ec37b0dd5ed5e0ec4d96cdc5ef84dfd0c085f2f6b4c8923c03f46830458a98c53d2e9e1f34b8c59d2062ec440d2b1ce32d1653b4d23db98a38d2029079ef74c84a18057ead3c135825024e45c5b0a107d4", 0x58}, {&(0x7f0000001300)="6ce06eb6b8b98827c103b6807a2d20cdefa525a2332f206e5cee33dc587edb923e22c67c31a40e3dc75d6e2250ca69cfd10b68b48f229d66c305e4796e1fae18870e7610e0cbab178b9dc75df0219f28f884c62e64963577ff9b6a6b44e6d0cc80179d87b69ef846b9d2ec52075e09a7e990390e2a964062fa9fb4b08c3cd1eb041d78205e39c1b70646e15aca285f324765639377a8f8ac49555d0d9e41d58ebdf16b7179169ab55c1a548c36d8651f8c6646c5893a2fc49748ba9bdbee0a6e5028a227f179ed0d9787a177c427f8fe286a6de21a6f3d5d6d611f58d3276856630872e82df4e477908902d604887179dc0b0e0dc460682797fe75f42fda00e39dbebcf68ff2dfa9198af806d6a3e0ba09e6dfb69e3cffe1327c1c0d4840ea7ae8fce0eed106d0cf95b74608ab856dbb60540b559e5f652cc553c900f886cd816974b8740ab714ef8407337a059ddec4915f2087db7729e2fccfe8aafa48ce55b9dfb36aa297edf247e4aef9f91249617cf9b24be8238efd060660d791882520259aa0d1ce7a50780f6c9fd91fef877e7187914445863728d64e5871843203f2e9c81a4c01f85fd8c73563c850c8992c8a46b26408b56adbd128e9367bcf8577c21d8e4fb5bdd2ca3cb2e1423176f7467a71003a5c159dd6c06a57fa738e1a01b6d494ecd3e0894850916084999f6a21d78d5a02d5db3211f76ce6bebae3da50b8592a678a5715bfc7d065612ce0b75eb87eab0a8c5db7ce2df95bb98cc89995829c23e3ab066d446bcb425a3be6601e32ad990151be4adefab29a731efe3a40f91adf4428a0efdf1c3a1b1319fe047bbe7dccde7759fdda9f250e070963f44aa4ff16d841639eebe6b35063d81b16befade81e799c20649e17bc10777d4a588834276e3eff760555a7528b0a2fa57f72b8d4f2ff46ce0147ef4e50df9cd080f8ce798710ff09ec3c69dac4993245afc77b0f67fe337705e7331a1a8af20951a4328cd690201fc24aebe7af09584776f08fb2cb9e6f520cd69f0626e7f0362fb63f2925f731dcda41ca2c52223d2c0626719670b94cb8dd29dae9efec56f2e281243ffd3196f908e2c4cf81c96200366b7ff1fb4a1ba1cad07826b4150364e08875ba69c837a6a4f56ce701fe084c7c100f07e3d52e864daa58b231581a43cc327a595c6f63536da67fd889ffb9078164c0827a3a490c787dd922f4bee19e1a23a7b735cd056021665972ce5aaea1efe3184b5b4154044d16803c198a3c395ffbadbcc53ed69919c0027836c8de49006dc8f981443552325a9247521376f7cc16be4025ae6085b651cb26febaad791996fad6e73e939d39b92ae48a792617914db2a1a9816d029b742222b9abaf9821113f573b58c90fe032a0e950b78bba49c09a8cdfb33376e303908ca815e0681d383f437d7e6aa45a3f275134a5426c5aa2a81666904f4a454080176efc75f9bb96ec5a70789844b62b6158374ec1c98c684454fd5727484595fe9c59db7477cc97a889502b221502bbaaec9e3aefb857d9694dd521edb30b56c050fbdb5ecc5145181a86ba128462d464ebb4382d6e03070766fb2fbba4f8f5743f45b2ca6779921e58500ba88253010c050b8ae437fa09a556761bb8285b09caa5dfc7e04e2c8ad53dc1d1137478c4e9a9ba16bc7258a20bbd4c0b433343f60c5388f1f3beb3a3e38c279b3e3e3fb8b2bb9784f9f2236998586b0d68724b94ee21121c2a82073f25d11b35b1d190a32042aa36f6081065489d963acece6597853bf3706d0b2d02a59d8c168144ced241f16c34e66160eba1b6646c8846d0c419fbea76eaf223c5a210049a074521886a9a926105d79dfe13c2eaa0985a9f921310518f8638ba0c1b1ff35cb9342ee4ac25744a01a42dfbc0ce708207fc56dce80d0edb66f5dec97fea0721eacaece630a04d52de314d8585055c2db32b672793f6a5263863c9730902b106d18685611c38444917baffff5c781097a25d77cff80e0313c750580911992ba49205c2b3bc0bfdea1bbc8096e421ad2534811af89d7399731e3de7192485f78507cba12d28f1126a800de25b6b19593d0b5fa4893b71063626d9d53ba4f399bf11b598cbc0f7bb5e457a7db4fbfb0fe1decba1932b671b787ff665d96ec9e1cb8d0118f7dee74f6a782911db52cb3bfcac479689f940bc19ae00085bb298e507f9b1f00ba89465009e8c3fe6775b91719ca2c953ab143641f926e8dd554f2ba3b0788d308b63d7ed49d0095498fac326d39c37bf61443b54a22edc5d4f3e4cdb36623b7e2e1ca24137b19886efd67a566c200b6cfdaf9cc35c99d839e0058de4626956d88fcb3576ffb4cc1dd7f669e85f171c73fd6613c8b0e4429878ac9342acb51922ac9638e2dc2f39b156e6cb19679d5c8314b7e75cb67cf1a8b16aebcfb9a7558fe451bbc6d12144fe801fb5b33a00b1255c6ea3dcd209aff0a3cb14f1bf6e60a08e370bea7e20e38a822b0f51e76ccf637190cf9bac620542f2cdcc236657909b4cd58dc7ead8a87196aac534fed107154b67d943292bdd05577a566a3adbf0593590c5a60bd169a0a41d965d8a4546de3ccaa08f8295cb55b7928153532d55f996454b3c4a099c217afb79fa622610127c8ee434e866e2aee21501447b927e89b0dd7921c6130a8e13b3aac5221726457a18939d336b874a96f460719b8da875f79010a29aea97ec0ccaa6164ef20b69e8d15acbbfa9b0e72dcb53131c7e0bb89971a0156ceed00356f93eab4ef381f12fab619fd8baf8b99b6e08a5d444739d33621ab58e03f276ae0d889efb10def9868987e42a9aa44e0131168739bf71cd6da0a7cb87c1f8fc68c452c75f372e58be915ac34ac629f523bdcf9157ba207b6f7f8adb582cf8e9749ff300b481403e0ee648ac05c1e1cd079e3fdcf0a00e20165dd269410b87482eb0a751c9ef552bca3bc6fc7fe10d1ea44ddca813131117c5e818e60a004ab740c784601ef4c07160b1cdcb22bfe2fafb5cb7070b8b1def09cbf96c6e0a32456a1e11ad9c121c77ca6ce72721de7ecd16f8bb94771212cee9ef1922196341fe9638660d2464d1538a3dd209c983b7ed3b287e669ecc3296ddc0be94abb8fe59d1e0f226bf543d7cfcd4d65244494c2f4193d4650d7a71b00dc1fc99517131d88015b464c5efb1714cd035675f663dd28c3bf1fb0841f95ec4bc0077a8e6a87c446b2975ae46337f33717968afca5a71a90c070f7c6859dafee77426f2748780dbeed7373eb44d453356cc314849c5ba44605facb81a01248fbaad19cd4ab061dccd4169dda1d56a8eba3aa462f10c2b0333b256b02a8fe362c626352d537b9f39a3afc414d27682b89583b5481f534d751cfaeab7bf801d56ee89a893cb318995c081b5e802a06956e30f12984b0f99bfc0784c798c6b52089002f2f89b7f22eabd4635e9cdf05f899a7eabb7e4c90991278bc92a7a6e77a8d56a2c1355b532d8b522e08cbeeebf15b1f5a70b9e57e06ed3357db93dddee4a75f6ac755ec75fd2ec68f67c23cffbd8a16f3ff4d8cbd8ccf0974ff27e65b9015d72c041e7424aad325230fd03abe2302f87b02169cdc647977e45e3aa0ecce0e396e6577fddb16ad7b746030e59798650875ce1fb2e22eee494bb7bb24180a74e0c5a354ac073c7dcff4acd871387be07aed7b46198b192f3447b195f7f330b3675b2666bed74ef660b019dee833e84bd99610b57489f5d0944f77e454de5f23360dbe240f8d7dd682daf6c07ed9ef3af8a8f7a75984917c59d8265e622b6c7295c502e1f832e4a6712322bdeb8358ddf9c72d405aa1370c7655948fae5c647a27078bc029c19c11587aabdfaebcf3966909cec0650a08f9fcc2e6baa9df87b0f2e63a13dd3b1fe7070c18fd5a5a84b219d287ae41bee589e80d0089ef2a9daf1c388a346d76201330dbbb4d3c1eff6e3674c5409c48d731b98f10d3f9a89a2fec433691fb3afb749be3d9a11170ba1c735db2f93af1f553f3cb4c084ce674b72f9d8de13c3be3893595aab3d239e60dca56bb0732d5cbfb9d8079cb6e5d843be7f47ce6ceddd2ccc68f2c14cceb2b4749f258cc0ed9670f6658769e7c97225f8e49be582d8248e243083abcb8a813cce74b925a80b4d383d14d5c97d2c6d59a0c957da2ad76506692f7b343b40b170f1cdcf412a3a8661fccdd26cbbc21afbb404b9d64fa4d3c7108b8a3bcf8d9e5bcb57c8980f401136cc004f5a4e1842adb30f34682d8fe6611145a4211c03f4eb7a21b6aeb0d7937266ccfa5dfb27be384e2495b3fa0706ab9ec46aadf8ee8c34499d7b6d6c4078998cfc3826234b7ac5510f8aa2093cad32960c25affbeeb04ba8a5cfd1b0f01272fcb7676b680f5181a863bb29f6f371fbbe35b8e880809708aaa2feb199ec90bedfe34bd900e634ebe3acf74302cdca8f11eac51b48a92607db6ea0a19c233564ab025c9cd019af965b6ae6a55a72586e384c7895c3514fc2bd55c68703b5b70912dfbc35fd4c31cf4918b9f3f62bc32a3787d26cdd04ea74f8888dc972ec7a685ad448caa37e4be7f6b4342b3e9f29ec7d0e5bc0effa46d8951500011eeef1ed1c0809cf79a58fd1cca74a1980e72d89547b7c4747dd0be2384279a9f066a7ac0e93bb8a53d2db1e37ca4fc621ef21fa94a8e8d90620b58dc4c0f89b5e0d77ce00f81d5583cf362eb4c2598df986119e1137ba2311e284d155fdeb80f2a9cc3d0ec467c04de459bf6a1c570db572fe92f3ce374d11004a831ec0de9f45d54c007c9e4e47db3a5b88cc234635890bfdd3bc8ba81faae0dd18532ff0f1178030e61802e804b5c25c14dc0ed7b0553bea7f22d89c7db3dbbb76dc268a8a4479d787aaed0d0d543a9cb2bc8623ea5ac1ee5a527d8ae9698bad1e64a4d93d1142db8cf23f149952b548a8f43046eaa7401946c15da585996632c0871c30f518c5101051f478338a62104fbd20fa92d9437d261d9fb3c559fad24e5675cce214de1f5a9e3a34f963b526bcbb801ca481657d00db89c7e6db1543dcdbf70b79f0b8512eb8770594ab212c69827e97483031d488599b23dcd3121af1868d5a68de1abced9e5081f83b649037e08a661910e91add82a2f583d432dfd3e110bb07e548e5656fee1c2264cf4898a7b474c8a64c70ead4e73c4736577ea5264780b27601957adfe4b1cb6b15a63e17ddd20a3db4c2d6e23db2d3e3660e04baabe088b077aed7269a44047d055d53da8750717dc67585cd53c59d8dfb334765ab47cdc6fb80be3dae468bdf9e7790cb5be7ebfaebc1ed77c74a5d3278bd241794e1d31decb4b4492dea75af490c8e2b6db18b776133485cda8a3b94da34cda583a80e48905c8005c9d5b1119bca1b670079b31de7f846d2709701fe5e2a2f3539499f910bcdd7e514547b65270d4a8110224a191a94ce2d0447f59ef1f9b18e928fb637321ef090536aad8262f3d7a8c096eb4ffba401591a97c9d54746d87a6a34568fc89519713e3d5956af41079e30d6ecf707438a0e48c722531a4d0d69a04fd2d61e1a81e2e23cc0066c8623678fc58a38979fb6b28a17c3adeff70c3c035ed4a409f1d19b5a0df0c83d25681101a995fbbf1a92956dd75514c7987c24b9269656b9d6f2140b9b90d7e9840f6abbe0d0d9c4cf3d49d5cde17cbca6cab0bc5cff7c2bd1e9f05fcbf01f8e9d9932ef55370ef86be79ce59b9e516abfd8a4b5f7f6054ef8de3569d7ee66318cf153d96e02d036eaaf0d80b33f4cceaa2ec0403d9b05e964fa85e709f9b746f72e6f8c13f0efaa4", 0x1000}, {&(0x7f0000002300)="aa9edd1a7e78456b2053b0f393ae6c29547c267af31b6e289355909a4583c805428b4a854a14a5d65b2bbb96f46324b9e040b7f0c040258971ec5cc0cd960933925086e9a7c2d0ea9aad7955835fbf113ed62437f73df8c0", 0x58}, {&(0x7f0000002380)='K', 0x1}], 0x8, &(0x7f0000002540)=[@rights={0x28, 0x1, 0x1, [r33, r34, r35, r36, r37, r38]}], 0x28, 0x4040801}, {&(0x7f0000002580)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000002680)=[{&(0x7f0000002600)="eba46fb6e66d26f3f9f21fb91290712face9892b69ab43ef2c417a333af662d834835137815bebddf9271d0ea18a3bebe8a60052765cc7ac4b621faf765e9a978f2ac9ba734fe50f5285d440c92cdb45f658aa82c2886c7d6dcb1c0443c62746b0eb3415f21dda46", 0x68}], 0x1, &(0x7f00000027c0)=[@rights={0x18, 0x1, 0x1, [r39, r40]}, @rights={0x20, 0x1, 0x1, [r41, r42, r43]}], 0x38, 0x80}, {&(0x7f0000002800)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000002c40)=[{&(0x7f0000002880)="199d4be84e7b49a2f6bd4fd3d30f3c3f22a26530049097c544d2102720bc72fb223ab46c777b44182d5f906ed47ad289f48f6ce48bf0e679a7f16a251daf8ac3842c858b2b1da247184afbf375fb910a6126b12b347d3e346716ac9e0707c67eafd49879e1610492e8e79f63a1c75a6fe6215f22949cf4f190e2f26d1f7676a94a6109e2e25a40bec8b85a459eea963c4c95064f059360ed03c2ae343969b7e2f936ce8b1bd9bcf4f7da8e3ae8d7c70f9cd9e3efe1b35794f748f1021e7a7985468a1d73c8dc063caf00d9dfe18886e2a498bfb7158be51b3d6b6dac8ea1e42cb8500c6f1994b470e298dd0b0989d67a4d3f531deb9955208fa91305", 0xfc}, {&(0x7f0000002980)="eba08ac3c1fbcdc574950c79ab55f93165a04290a492ec5863216e03bbf427bf30d2", 0x22}, {&(0x7f00000029c0)="8481b712b95f4038ba764c0c40a503b9af03c6c962410566c9ff35697e58b325c5cca8d739e817f396090b4a901b36b91e7ba48cefdb1be58e2275e68dc1e6c26a0ba2762ca50e6dac8f081128161669e5d35f26a8c9b1ab812b01a8c63902d26bb9cf79d30e5c5b8fe7725297c2a851efbf7e7a40d920e70737d8854d943d12690856a5c307c5b8cc5538e45c43f3", 0x8f}, {&(0x7f0000002a80)="f9415de27ffdf1ce44ed0396cb03a9f344c9c3a4327a2e8726bd7472cc98a703d26815e4842b1662e471bf9dc0ddc6b715210726126dff04fdabd904b32b1f90f24e0872c3a7c67c", 0x48}, {&(0x7f0000002b00)="9fc4275eb4c531658502be874b0f8f690e55dfc53f93edbb46f8adc148170bac89fe61a5977fc645839d243fccf18358eb4d245d924b80da87d3e9e13155e16f8686691a03a7ccf164c6b2d956097083e0e3e14fc5f2426aed7bd116010624e8dc038434681e9b4a3faeeff5cb619788f2f1ea5302d0e7483ccc2f291f8a2b4cdd838de429eb8d863837", 0x8a}, {&(0x7f0000002bc0)="b5f538331d8dc35133776b3d33790a1aaaf77f1d4ed46f920796c53bcd95e299413aacffc07290a83dbebb70a5cdc092d4e7b9f5bcd5c594dbe228fd4621c54b3e2a0f62b860a09ee5d4abb61251f1a431711e7e", 0x54}], 0x6, &(0x7f0000002f80)=[@rights={0x20, 0x1, 0x1, [r44, r45, r46, r47]}, @rights={0x28, 0x1, 0x1, [r48, r49, r50, r51, r52]}, @cred={0x20, 0x1, 0x2, r53, r54, r55}], 0x68, 0x40000}, {&(0x7f0000003000)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f00000034c0)=[{&(0x7f0000003080)="0a4efaa316b4fb34699782766b0a148a47897586a6752bcbd14f963390aaf34dcf8b9f01855bbd334deb59e2596b286d5f8231ca8316643b12b5d66d50141ff6", 0x40}, {&(0x7f00000030c0)="5bb8577fcefc92c22a7e331e6a63cade525cc8a4fcfecf5ea1a824bb83abdaa8c8", 0x21}, {&(0x7f0000003100)="0464123424197017b9e20811a23963f6c933c7cf446d7062027542563259ee32ecc545d856cec7cb6820a96d27a00f9c443ad60b2017ff1de3cca9949e7ac37b8e0a607139991f7f0c62abd0b6a85fbe45c7e51f29218f34912772c03c3c1ab9e958634908cb02acbae444203030c3d0d2ae87907af7ab600ba0dc5f59594b723643e6ea0226c7a188bc78c4f19a488babb85027661d4202f6cf48915a19e252133066da262ef05411c3a8733a7007385420b7bbdf08b68bef121a7356b8fb579b5257b8b1363877e4b1963e79588fcb411330cda8a84cae925adb5348cb893b4d18163a0bd56eaf693620d016271aef08c1ee7d", 0xf4}, {&(0x7f0000003200)="1a67a72ffa0771e7f4f0da825d42cb93b141bce360ce1d02bc2c3881a0f8764ce782f716811cbce35b76e6829b3fd67407273d42d838cb9b28dfec85b868fe0b8687d9c6762db975f75539f6abd0b5", 0x4f}, {&(0x7f0000003280)="e013ca59eab8ee8bf0c3c011d77ff32ac275fdc25bd9d0dcc31c941111e42b56005294d6eadc4bc1b04528ba2e701b906f3f8ff8e718bab27a3e5796567c958aa24d88dee7", 0x45}, {&(0x7f0000003300)="a4d28cc6b86f85", 0x7}, {&(0x7f0000003340)="99fdf26b9da4323a6ee3329985f08bf522c7a2439df67f727bc7b1e1ae86c5f3d4395e69b10db97b1f74f00be4a4a7a5f7e60d659e785ef6c9ba22596feeea1be577759a38", 0x45}, {&(0x7f00000033c0)="0f7bbde3d4fe76f4ac1e903330a2c599adab98a1aeb9b831c3e6ca224e599f4464e92141d961f11cb6a07d9db3c54071b5ededbee181cd5be5e629da350a189164fa649eb9470429e00533211f6e2bbdefeb53f56b79085e9e90904a6a2571aeb0369b1d76e951b719d3f65e72f525979853f570768d2089db1820dfbd529d25e8da81ee38d633d417362652a304a49360018274e6a0985684eec41cc91006889cf682fad93c39dd663007845cf488855e6f9674", 0xb4}, {&(0x7f0000003480)="36ec02a16274cb68160b26e6377ce8c6affb415db0b0648a51649073672aad624b325fe25c2df559c87a46c95d9c92cae62304", 0x33}], 0x9, &(0x7f0000003d00)=[@cred={0x20, 0x1, 0x2, r56, r57, r58}, @cred={0x20, 0x1, 0x2, r59, r60, r61}, @cred={0x20, 0x1, 0x2, r62, r63, r64}, @cred={0x20, 0x1, 0x2, r65, r66, r67}, @cred={0x20, 0x1, 0x2, r68, r69, r70}, @rights={0x18, 0x1, 0x1, [r71]}, @rights={0x18, 0x1, 0x1, [r72]}, @rights={0x28, 0x1, 0x1, [r73, r74, r75, r76, r77]}, @rights={0x18, 0x1, 0x1, [r78]}], 0x110}], 0x6, 0x40015)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[])
r79 = open(&(0x7f00000001c0)='./file0\x00', 0x4101, 0x7)
bind$nfc_llcp(r79, &(0x7f0000000240)={0x27, 0x0, 0x1, 0x0, 0x100000000, 0x7, "0a2af5781f5279d79f76ebccb987c492fe93c8c6ff6edb5065fd7f866c00bc0b120220b8205faab1e2e9b544e021f93657834205eef3845a88d7532f9e3293", 0x28}, 0x60)
r80 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0)
getdents64(r80, &(0x7f0000000140)=""/65, 0x506)

16:09:29 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x60000000)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  888.002353] binder: 5157:5160 ioctl 2270 200001c0 returned -22
[  888.110242] binder: 5130:5169 ioctl 40086602 20000180 returned -22
[  888.129256] overlayfs: unrecognized mount option "/dev/snd/pcmC#D#c" or missing value
[  888.145024] binder: 5130:5134 ioctl 2270 200001c0 returned -22
[  888.168912] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:09:29 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000180)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
getsockopt$inet_buf(r1, 0x0, 0x2f, &(0x7f0000000040)=""/1, &(0x7f0000000080)=0x1)
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  888.300600] overlayfs: unrecognized mount option "/dev/snd/pcmC#D#c" or missing value
[  888.379750] binder: 5180:5184 ioctl 2270 200001c0 returned -22
[  888.410329] binder: 5157:5160 ioctl 2270 200001c0 returned -22
[  888.444192] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:09:29 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x6400}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  888.621338] binder: 5186:5188 ioctl 2270 200001c0 returned -22
16:09:29 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:29 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x7}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  888.838401] binder: 5180:5184 ioctl 2270 200001c0 returned -22
16:09:29 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x6)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

16:09:30 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$sock_inet_SIOCGIFPFLAGS(r1, 0x8935, &(0x7f0000000180)={'veth0_to_bridge\x00', 0x1})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
write$sndseq(r1, &(0x7f0000000340)=[{0x2, 0x3, 0xfffffffffffffff8, 0x2, @tick=0x400, {0x1, 0x400}, {0xaf4, 0x100}, @quote={{0x21c, 0x4}, 0x5, &(0x7f0000000280)={0x484, 0x6, 0xf17, 0x1f, @time={0x0, 0x1c9c380}, {0x1, 0x2ee}, {0x6, 0x5}, @ext={0xce, &(0x7f0000000500)="59d9436ad0e0f361ae020546c7a7108bb9bff1c8e7cd0e9b59b3a3cec2f7d60d5c1cdd2af9d10085f2c842bdbfdc3560eca224d816e0ab8907dd4dba2c2fa116a2c8a1c5885b20e279f409b303b9c44f3d747134af6550f8dfaf68ce5da8fd57e3be3cc1af9775ecdcd120d1903b5bd9cd70c3eda47bb1782795f52bdee3af4272948a2b2ba2ddc3726994cf453008f81510739e6fef82e5612b4d883f2236683a03c4789db6036e67b8b8fdf42d20f18344f39959d7ffcd140cad408ed91a344b3c3ee602e0bd2e6c1e8d6cef3f"}}}}, {0x8, 0x4, 0x80000000, 0x7, @time={0x77359400}, {0x760, 0xfff}, {0x6, 0x100}, @quote={{0x3b7, 0x401}}}, {0xfff, 0x0, 0x7ff, 0xcc2a, @tick=0x9b2, {0x80000000, 0xcf67}, {0x6, 0x4}, @connect={{0x4, 0x55}, {0x6, 0x8}}}, {0x9, 0x8, 0x1aa27965, 0x1, @tick=0x78e, {0x7}, {0x7ff, 0xe5ba}, @time=@time={0x0, 0x1c9c380}}], 0xc0)
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:30 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x2000000)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  889.008742] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  889.075421] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  889.111508] binder: 5205:5210 ioctl 2270 200001c0 returned -22
16:09:30 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x20, 0x0)
r1 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000280)={&(0x7f0000000240)='./file0\x00', 0x0, 0x8}, 0x10)
ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r2, &(0x7f0000000140)=""/65, 0x506)

[  889.176763] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  889.334430] binder: 5186:5190 ioctl 2270 200001c0 returned -22
[  889.347809] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:30 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000380)=""/65, 0xffffff8e)
r1 = gettid()
ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f0000000040)=r1)

16:09:30 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x64}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  889.394013] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  889.421596] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  889.516107] binder: 5217:5219 ioctl 2270 200001c0 returned -22
[  889.546842] binder: 5205:5207 ioctl 2270 200001c0 returned -22
[  889.663398] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:30 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000380)='/dev/userio\x00', 0x101004, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:30 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x14}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  889.737792] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:30 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc501000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:30 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="e2306f7765726469723d2e3a66696c65302c776f726b6462723d2e"])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  889.887837] binder: 5230:5237 ioctl 2270 200001c0 returned -22
16:09:31 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x60)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  890.062382] overlayfs: unrecognized mount option "â0owerdir=.:file0" or missing value
[  890.096964] overlayfs: unrecognized mount option "â0owerdir=.:file0" or missing value
16:09:31 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x2, 0x0)
bind$bt_sco(r0, &(0x7f0000000240)={0x1f, {0x200, 0x1f, 0x10000, 0x401, 0x2, 0x2}}, 0x8)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000280)={0x0, 0x3, 0x6, 0x1e})
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r1, &(0x7f0000000140)=""/65, 0x506)

[  890.152774] binder: 5217:5219 ioctl 2270 200001c0 returned -22
16:09:31 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x800000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  890.212535] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  890.224945] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  890.247683] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:31 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x40)
r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000480)='/dev/vga_arbiter\x00', 0x626800, 0x0)
fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f00000004c0)={0x0, <r2=>0x0})
getresuid(&(0x7f0000000500), &(0x7f0000000540)=<r3=>0x0, &(0x7f0000000580))
stat(&(0x7f00000005c0)='./file0\x00', &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f00000008c0)=<r5=>0x0)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000900)={{{@in=@dev, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0}}, {{@in=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000000a00)=0xe8)
fstat(0xffffffffffffffff, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0, 0x0, <r7=>0x0})
sendmmsg$unix(r0, &(0x7f0000000b00)=[{&(0x7f0000000240)=@abs={0x1, 0x0, 0x4e24}, 0x6e, &(0x7f0000000440)=[{&(0x7f0000000300)="83d905dac95016b0b678e18b8a7703aad1deb0951375fa98a9be323207e120e6ea5b3f558184e5e739043e2366d77906a3902227e8388be58f7aaa6a3cfc5b76c1f3170eefbf0c8749aabe", 0x4b}, {&(0x7f0000000380)="11f6e9dbf1a5706d4108b09cc230cb8f1607b5f1f113b0cbc8b24d3693338e4dca31ce5adc3e5e893b61f9d9fea57ae047ef65900ad2df91c57d00711cace1f6d5370827c2bb3bbb7c424b1e9fd255197820b8c9be57af579476e5261f1ad4900fad4e197b1f433e91ad425f67ea4d93e579924f4a94daac3f87126174cd88e019962ec55b3f8b6393dc77f098240ac1467e942ef5d2ceca78489265717559103a852a8c849d7ef746aba0ed1f265d28237a433d960b1f2aa83eeccd636c8108", 0xc0}], 0x2, &(0x7f0000000680)=[@rights={0x18, 0x1, 0x1, [r1]}, @cred={0x20, 0x1, 0x2, r2, r3, r4}], 0x38, 0x10}, {&(0x7f00000006c0)=@abs={0x0, 0x0, 0x4e20}, 0x6e, &(0x7f0000000880)=[{&(0x7f0000000740)="8d0d7f97c71738104d197fa2b6d04c1a4e69e2c55c363e10434f2e068ba5721cf20ad2e703e06b14cfb512f68117bb66ae983c94", 0x34}, {&(0x7f0000000780)="909c915b2ddaa44049dddcc578fc7087b2d097f2a8343fe7e934bbe7ba689ff197cb58e9673e64682e57c17f499e14beecf29f3c01cef8c191e155a8092e4c538f521a1ca85efee327dc08262c15c25ffa70b33d255f2c82520a3b0eae6b8a3396966f6cb93699a5d6fea144cc5806a49943a86a71a08ee8a457fa3e362ea579df909e360e41d95bb2d0db0b67d0ad9d5d209af1d009361ab59bccc2a31c8077e7f4ee022ad10bc4b9666a04293f4e0965902e9c014479742c01a3c7316e62e7a31d1bd7e42af501f9ad435bf5d848d8693e1925dd9397f357fdde", 0xdb}], 0x2, &(0x7f0000000ac0)=[@cred={0x20, 0x1, 0x2, r5, r6, r7}], 0x20, 0x40}], 0x2, 0x4000000)
r8 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r8, &(0x7f0000000140)=""/65, 0x506)
socketpair$inet_sctp(0x2, 0x0, 0x84, &(0x7f0000000b80))

16:09:31 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  890.381738] binder: 5251:5257 ioctl 2270 200001c0 returned -22
[  890.524855] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  890.616980] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  890.628069] binder: 5230:5267 ioctl 2270 200001c0 returned -22
16:09:31 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/vs/backup_only\x00', 0x2, 0x0)
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffff9c, 0x8933, &(0x7f0000000380)={'vcan0\x00', <r1=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)=@gettclass={0x24, 0x2a, 0x4, 0x70bd27, 0x25dfdbfd, {0x0, r1, {0x3, 0xffff}, {0xf}, {0x0, 0x1c}}, ["", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000085}, 0x800)
setxattr$trusted_overlay_redirect(&(0x7f0000000040)='./file0\x00', &(0x7f0000000240)='trusted.overlay.redirect\x00', &(0x7f0000000280)='./file0\x00', 0x8, 0x1)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r2, &(0x7f0000000140)=""/65, 0x41)

16:09:31 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x1000000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:31 executing program 4:
socketpair$inet6(0xa, 0x80a, 0xfff, &(0x7f0000000280)={<r0=>0xffffffffffffffff})
sendto$inet6(r0, &(0x7f0000000340)="21bdde46d74c07bb1bb4405a3d7c5b", 0xf, 0x40000, &(0x7f0000000380)={0xa, 0x4e20, 0x8, @ipv4, 0x7ebd}, 0x1c)
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000180)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
timerfd_settime(r2, 0x1, &(0x7f00000003c0)={{}, {0x0, 0x1c9c380}}, &(0x7f0000000440))
write(r2, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r4=>0x0})
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r4+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  890.929033] binder: 5274:5277 ioctl 2270 200001c0 returned -22
[  890.993754] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  891.060496] binder: 5251:5282 ioctl 2270 200001c0 returned -22
[  891.073736] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  891.091766] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:09:32 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x3, 0x0, 0x0, 0x2, 0x3, 0x2, 0x4}, 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r1, &(0x7f0000000140)=""/65, 0x506)
getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r1, 0x84, 0x1c, &(0x7f0000000240), &(0x7f0000000280)=0x4)

16:09:32 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc501}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:32 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x3f00000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:32 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x2)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  891.332168] binder: 5288:5293 ioctl 2270 200001c0 returned -22
[  891.341025] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  891.354203] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  891.367181] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:32 executing program 2:
mkdir(&(0x7f00000002c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="2c6c6f7765726469723d2e3a66696c65302c776f726b6469723d2ea5ac45ea470193cf"])
truncate(&(0x7f0000000240)='./file0\x00', 0x8)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x100, 0x10000000004)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)
pipe2$9p(&(0x7f0000000280), 0x4000)

[  891.509602] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  891.637703] overlayfs: option "workdir=.¥¬EêG
“Ï" is useless in a non-upper mount, ignore
[  891.693663] overlayfs: option "workdir=.¥¬EêG
“Ï" is useless in a non-upper mount, ignore
[  891.718880] binder: 5274:5281 ioctl 2270 200001c0 returned -22
16:09:32 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x700000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:32 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000040)='./file0\x00', &(0x7f0000000200)='devpts\x00', 0x1008, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  891.753676] binder: 5288:5293 ioctl 2270 200001c0 returned -22
16:09:32 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
ioctl$TIOCEXCL(r0, 0x540c)
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:32 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:32 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x187}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  891.926223] binder: 5310:5315 ioctl 2270 200001c0 returned -22
[  891.975875] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  891.990648] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:33 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x101000, 0x0)
bind$inet(r0, &(0x7f0000000240)={0x2, 0x4e24, @broadcast}, 0x10)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r1, &(0x7f0000000140)=""/65, 0x506)

[  892.033576] binder: 5319:5325 ioctl 2270 200001c0 returned -22
[  892.173473] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  892.244349] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:33 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000340)={&(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000240)=[0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0], &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x4, 0x2, 0x2, 0xa})
getdents64(r0, &(0x7f0000000380)=""/65, 0x41)

16:09:33 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x2000000000000000)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  892.426603] binder: 5319:5325 ioctl 2270 200001c0 returned -22
16:09:33 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc501}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:33 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x10}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  892.506923] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:09:33 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
write$P9_RREADDIR(r0, &(0x7f0000000300)={0x103, 0x29, 0x1, {0xb378, [{{0x16, 0x3, 0x7}, 0xffffffffffffcf52, 0x3, 0x7, './file0'}, {{0xc8, 0x4, 0x4}, 0x800, 0x3, 0x7, './file0'}, {{0x2, 0x2, 0x4}, 0x5, 0x2, 0x7, './file0'}, {{0x2, 0x2, 0x5}, 0x7, 0x0, 0x7, './file0'}, {{0x0, 0x4, 0x8}, 0x1, 0x401, 0x7, './file1'}, {{0x80, 0x2, 0x5}, 0x9, 0x9, 0x7, './file0'}, {{0x4, 0x4, 0x2}, 0x600000000, 0x3, 0x7, './file0'}, {{0x80, 0x2}, 0x235, 0x6, 0x7, './file0'}]}}, 0x103)
getdents64(r0, &(0x7f0000000240)=""/65, 0x41)

[  892.586871] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  892.599134] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  892.634247] binder: 5341:5347 ioctl 2270 200001c0 returned -22
[  892.657310] binder: 5310:5348 ioctl 2270 200001c0 returned -22
[  892.670415] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:09:33 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x7000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:33 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
remap_file_pages(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0xc5, 0x28040)
write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000180)={<r4=>0xffffffffffffffff}, 0x106}}, 0x20)
write$RDMA_USER_CM_CMD_NOTIFY(r0, &(0x7f0000000340)={0xf, 0x8, 0xfa00, {r4, 0xa}}, 0x10)
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  892.845435] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  892.903880] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:34 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0400000000000000723dbc67568e080061c9776f726b6469723d2e"])
mount$9p_xen(&(0x7f0000000040)='\x00', &(0x7f0000000240)='./file1\x00', &(0x7f0000000280)='9p\x00', 0x802, &(0x7f0000000300)={'trans=xen,', {[{@version_u='version=9p2000.u'}, {@nodevmap='nodevmap'}, {@cache_mmap='cache=mmap'}, {@cache_none='cache=none'}, {@posixacl='posixacl'}, {@version_u='version=9p2000.u'}], [{@dont_hash='dont_hash'}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}]}})
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  892.949482] binder: 5358:5361 ioctl 2270 200001c0 returned -22
[  892.965706] mmap: syz-executor4 (5361) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst.
[  893.239694] overlayfs: unrecognized mount option "" or missing value
16:09:34 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  893.282184] overlayfs: unrecognized mount option "" or missing value
16:09:34 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000300)='/dev/audio\x00', 0x1, 0x0)
write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000340)={<r1=>0xffffffffffffffff}, 0x13f, 0x5}}, 0x20)
write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f00000003c0)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e23, 0x1, @loopback, 0x8}, r1}}, 0x30)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
lsetxattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000240)=@random={'osx.', 'mqueue\x00'}, &(0x7f0000000280)='overlay\x00', 0x8, 0x0)
r3 = syz_genetlink_get_family_id$team(&(0x7f0000000440)='team\x00')
getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000800)={<r4=>0x0, @multicast2, @multicast1}, &(0x7f0000000840)=0xc)
getpeername$packet(r0, &(0x7f0000000b80)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000bc0)=0x14)
accept4$packet(r2, &(0x7f0000000cc0)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000d00)=0x14, 0x80000)
accept4$packet(r2, &(0x7f0000000d40)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000d80)=0x14, 0x800)
ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000e80)={'team0\x00', <r8=>0x0})
getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000ec0)={{{@in=@local, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r9=>0x0}}, {{@in=@loopback}, 0x0, @in=@local}}, &(0x7f0000000fc0)=0xe8)
getpeername$packet(r2, &(0x7f0000003400)={0x11, 0x0, <r10=>0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000003440)=0x14)
getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000003480)={{{@in=@loopback, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r11=>0x0}}, {{@in6=@remote}, 0x0, @in=@remote}}, &(0x7f0000003580)=0xe8)
accept4$packet(r0, &(0x7f0000004cc0)={0x11, 0x0, <r12=>0x0}, &(0x7f0000004d00)=0x14, 0x80000)
accept(r2, &(0x7f0000004d40)=@can={0x1d, <r13=>0x0}, &(0x7f0000004dc0)=0x80)
accept4$packet(r2, &(0x7f0000004e00)={0x11, 0x0, <r14=>0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000004e40)=0x14, 0x80000)
getpeername$packet(r0, &(0x7f00000055c0)={0x11, 0x0, <r15=>0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000005600)=0x14)
getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000005640)={{{@in=@broadcast, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r16=>0x0}}, {{@in6}, 0x0, @in6=@mcast2}}, &(0x7f0000005740)=0xe8)
getsockname$packet(r2, &(0x7f0000005780)={0x11, 0x0, <r17=>0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000057c0)=0x14)
getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000005800)={{{@in6=@mcast1, @in6=@ipv4={[], [], @rand_addr}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r18=>0x0}}, {{@in=@loopback}, 0x0, @in=@dev}}, &(0x7f0000005900)=0xe8)
getsockname$packet(r0, &(0x7f0000005a80)={0x11, 0x0, <r19=>0x0}, &(0x7f0000005ac0)=0x14)
getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000005bc0)={<r20=>0x0, @empty, @broadcast}, &(0x7f0000005c00)=0xc)
accept$packet(r2, &(0x7f0000005c40)={0x11, 0x0, <r21=>0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000005c80)=0x14)
getsockopt$inet6_mreq(r0, 0x29, 0x1d, &(0x7f0000005cc0)={@mcast2, <r22=>0x0}, &(0x7f0000005d00)=0x14)
sendmsg$TEAM_CMD_NOOP(r2, &(0x7f0000006380)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x1020044}, 0xc, &(0x7f0000006340)={&(0x7f0000005d40)={0x5f8, r3, 0x18, 0x70bd2c, 0x25dfdbfd, {}, [{{0x8, 0x1, r4}, {0xf4, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0xffffffff}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r6}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r7}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r8}}}]}}, {{0x8, 0x1, r9}, {0xbc, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x1000}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r10}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r11}}, {0x8}}}]}}, {{0x8, 0x1, r12}, {0x3c, 0x2, [{0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r13}}}]}}, {{0x8, 0x1, r14}, {0x1a4, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0xdd3}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x10000}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffff800}}, {0x8, 0x6, r15}}}, {0x3c, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0xc, 0x4, 'random\x00'}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r16}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r17}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x10000}}}]}}, {{0x8, 0x1, r18}, {0x164, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x401}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r19}}}, {0x4c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x1c, 0x4, [{0xfffffffffffffffd, 0xf3, 0x2, 0x7}, {0x9, 0x7fffffff, 0x7f, 0x7}, {0x7ff, 0x6, 0x4, 0x4}]}}}, {0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x14, 0x4, 'activebackup\x00'}}}, {0x5c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x2c, 0x4, [{0x9, 0xffffffffffffff09, 0x20, 0x8000}, {0x6, 0xf22, 0x1}, {0x80000000, 0x0, 0x4, 0x1}, {0x8bf, 0x80000000, 0x4, 0xaf5}, {0x5, 0xffffffff, 0x3, 0x3}]}}}]}}, {{0x8, 0x1, r20}, {0xc0, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x3f}}, {0x8, 0x6, r21}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r22}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x4}}, {0x8}}}]}}]}, 0x5f8}, 0x1, 0x0, 0x0, 0x4008000}, 0x840)
getdents64(r2, &(0x7f0000000140)=""/65, 0x506)

[  893.347922] binder: 5341:5349 ioctl 2270 200001c0 returned -22
16:09:34 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x6400}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  893.458238] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  893.486933] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:34 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x6000)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  893.505168] binder: 5358:5361 ioctl 2270 200001c0 returned -22
[  893.552116] binder: 5375:5377 ioctl 2270 200001c0 returned -22
16:09:34 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/userio\x00', 0x88000, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000600)="74a796bef73e7307495d36466e3e0256380bc9b9d39fd13e25f6900243a9b5139bc077e5f03a0dd1410700c25c43135fa4bd1bfd3258b0f837e659cdc369a248ba93e82e04f47d8ff8094bbfa3c09f34243336aac3cd309789844dd3330281b64809717a2aca2d85480f9f6d855498f268ef652342f2dc243fb9b3f240deea038ceebfcd7a43acc184d5313801e5b64281cc8107c5710fb5a2cb907e5eb5a8cdca7208fa3674a85fe44db2a155b03012b427273f4c81d59f081bc1ea715e84ea2d1416013abc", 0xc6)
r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r1, 0x2270, &(0x7f00000003c0))
getrandom(&(0x7f0000000700)=""/4096, 0x1000, 0x2)
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000280)={<r4=>0xffffffffffffffff, r0, 0x0, 0x4, &(0x7f00000001c0)='#+/\x00'}, 0x30)
ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000340)=<r5=>0x0)
dup2(r0, r2)
kcmp(r4, r5, 0x2, r0, r0)
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  893.631438] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:09:34 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x700}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  893.898439] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:09:35 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc501000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  894.195310] binder: 5375:5383 ioctl 2270 200001c0 returned -22
16:09:35 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x700}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  894.399050] binder: 5400:5402 ioctl 2270 200001c0 returned -22
16:09:35 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x1000000)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

16:09:35 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:35 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
execveat(r0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000400)=[&(0x7f0000000240)='vboxnet1(bdev-;security.\x00', &(0x7f0000000280)='overlay\x00', &(0x7f0000000300)='overlay\x00', &(0x7f0000000340)='%@ppp0}:systemselinuxselinuxppp1cpuset\x00', &(0x7f0000000380)='mqueue\x00', &(0x7f00000003c0)='overlay\x00'], &(0x7f0000000480)=[&(0x7f0000000440)='%\x00'], 0x1400)
ioctl$PIO_FONTX(r0, 0x4b6c, &(0x7f00000004c0)="ab73d79342207a07d69c2ed725f56b58953091dcc7fb2883db81b84d4ff36133d235402724be74802ea128a4d03dae6f519c5584235b1cc37dd3e193eac6900cbf444ca1c7205f44e53247f4d0faa94dc95e90fa4dba36f424c3ae132e9aba0ed3ad5566cf32dd")
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

16:09:35 executing program 4:
r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0)
mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000004, 0x11, r3, 0x5a)
write(r0, &(0x7f0000000440)="3c247cc86d381ce47b081d1709c546fbd5b0ded610c70668249250508e80728614a2bf10b55229e9b921ca0e2437a58109e7e734ba45730613d724379a7127f90c448ceb4642883ae6ef5e2500fe82a25fbda4469b4d84148ff06f2195fb14707a46e05b9e5a23c580240ea027bc20c75fe4dad1df3f94af0528562b8796ba57", 0x80)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r4=>0x0})
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f00000001c0))
write$USERIO_CMD_SEND_INTERRUPT(r2, &(0x7f0000000180)={0x2, 0x8}, 0x2)
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0xdde}, &(0x7f0000000200)={0x0, r4+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  894.567915] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:09:35 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x1400}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  894.717329] binder: 5415:5416 ioctl 2270 200001c0 returned -22
[  894.749524] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  894.805766] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  894.839012] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:36 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
iopl(0x5)
mount$overlay(0x400000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000300)='overlay\x00', 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="2c6c6f7765726f726b6469723d2e0f0d2cf6412c42c1ccf85bd6317a8856d3d2acd2d3eec6dfb595a6fc9e88792b40fdeef70af19ae80100000066f987a62c08270e5b0a3f000000ca83ab94bcb30170fe44abddeb0957f86dc9317dbe0100000000000000007100000059aa"])
truncate(&(0x7f0000000240)='./file0/file0\x00', 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000040))
timerfd_gettime(r0, &(0x7f0000000280))
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)
ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000000)=<r1=>0x0)
perf_event_open(&(0x7f0000000400)={0x3, 0x70, 0x3, 0x9, 0x8, 0x8, 0x0, 0x6, 0x40, 0x1, 0x6, 0x8000, 0x1, 0x60c, 0x1f, 0x1, 0x10001, 0x5, 0x6, 0x9b, 0x4, 0x9, 0xffffffff, 0x9, 0x2, 0x771, 0x1, 0x100000001, 0x8, 0x1, 0x222, 0x4, 0x2, 0x8cc5, 0x7ff, 0x3, 0x5, 0x5, 0x0, 0x2, 0x4, @perf_config_ext={0x7fff}, 0x10000, 0x1, 0x988, 0x6, 0x1, 0x1, 0x6}, r1, 0xf, r0, 0x1)
openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x40000, 0x14)
openat(r0, &(0x7f00000002c0)='./file0\x00', 0x20000, 0x2)

[  894.911332] binder: 5400:5403 ioctl 2270 200001c0 returned -22
16:09:36 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x7}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  895.123654] binder: 5433:5435 ioctl 2270 200001c0 returned -22
16:09:36 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = memfd_create(&(0x7f0000000240)='overlay\x00', 0x3)
write$P9_RLERRORu(r0, &(0x7f0000000280)={0x14, 0x7, 0x2, {{0x7, 'mqueue\x00'}, 0x5}}, 0x14)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
r2 = semget(0x1, 0x1, 0x400)
semctl$GETNCNT(r2, 0x7, 0xe, &(0x7f0000000500)=""/227)
ioctl$int_out(r1, 0x2, &(0x7f0000000040))
getdents64(r1, &(0x7f0000000140)=""/65, 0x506)

[  895.285877] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  895.311986] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:36 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x3)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
r0 = accept4$inet6(0xffffffffffffff9c, &(0x7f0000000040)={0xa, 0x0, 0x0, @local}, &(0x7f0000000240)=0x1c, 0x0)
sync_file_range(r0, 0x6f7, 0x5, 0x5)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="2c6c6f776548f79e7264697204000000000000006f726b6469723d"])
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r1, &(0x7f0000000140)=""/65, 0x506)
ioctl$BLKRRPART(r1, 0x125f, 0x0)
write$binfmt_elf32(r0, &(0x7f0000000300)={{0x7f, 0x45, 0x4c, 0x46, 0x1e72, 0xc6, 0x400, 0x7fffffff, 0x7, 0x3, 0x3f, 0x1, 0x2e3, 0x38, 0x209, 0xff, 0x10000, 0x20, 0x2, 0x6, 0x80, 0xbef3382}, [{0x7474e557, 0xc7, 0x4, 0x3, 0x1, 0x1, 0x2, 0x12}], "b5c283ef4effef20d80552f6decb6732381726dc36631dea1301b24e27718843b9da16af6dd2497a1de9d3279c9cc98efb9098c55e47c6c8e20d93c65c88d8f9745e01e196111cabc15d01bc4d6ea2817018300de675f58e25c936227e6f617fe3812d3dddd9101a7121193f703e20b561e271cd78b57b362cf21b8d42e1ac7580e101fcaa81d8b87e93a889b12b2ee24ff1c3074508c75a3b97111b98f398d84f8f11bb0e1a5ca18ab6a57e73102e08685e8621b68520f90f", [[], [], [], [], [], [], []]}, 0x811)

16:09:36 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:36 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x20000000)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  895.482783] binder: 5415:5422 ioctl 2270 200001c0 returned -22
[  895.489886] binder: 5433:5440 ioctl 2270 200001c0 returned -22
16:09:36 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="2c6c6f7765726469723d2e3ab7665b37eaaa11ba726b6469723d2e52c4f2ad72edc1e9410698850ffcf40ddd22919fea25c823db280fce1bbff545408923998d9a37941217b1233f85"])
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpu.stat\x00', 0x0, 0x0)
r0 = syz_open_dev$sndpcmc(&(0x7f00000002c0)='/dev/snd/pcmC#D#c\x00', 0xffffffffffffff81, 0x20000)
r1 = openat(r0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r1, &(0x7f0000000140)=""/65, 0x506)

16:09:36 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
accept4$alg(r1, 0x0, 0x0, 0x80800)
write(r1, &(0x7f0000000340), 0x10000014c)
ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000180)=<r3=>0x0)
perf_event_open(&(0x7f0000000040)={0x10000000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, r3, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x4, &(0x7f00000003c0)={0x0, <r4=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r4+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  895.526542] overlayfs: unrecognized mount option "loweH÷žrdir" or missing value
[  895.539512] overlayfs: unrecognized mount option "loweH÷žrdir" or missing value
[  895.559119] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:09:36 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x64}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:36 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x10}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  895.672206] overlayfs: failed to resolve '·f[7ꪺrkdir=.RÄò­ríÁéA˜…üô
Ý"‘Ÿê%È#Û(οõE@‰#™�š7”±#?…': -2
[  895.717505] binder: 5461:5469 ioctl 2270 200001c0 returned -22
[  895.720057] overlayfs: failed to resolve '·f[7ꪺrkdir=.RÄò­ríÁéA˜…üô
Ý"‘Ÿê%È#Û(οõE@‰#™�š7”±#?…': -2
[  895.737765] binder: 5465:5471 ioctl 2270 200001c0 returned -22
16:09:36 executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x28000, 0xb0)
connect$pptp(r0, &(0x7f0000000240)={0x18, 0x2, {0x0, @local}}, 0x1e)
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mknodat(r0, &(0x7f0000000280)='./file0\x00', 0x40, 0x7ff)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0xfffffffffffffffc, &(0x7f0000000340)=ANY=[])
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
fcntl$setsig(r1, 0xa, 0x7)
getdents64(r1, &(0x7f0000000140)=""/65, 0x506)

[  895.770392] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:09:37 executing program 2:
mkdir(&(0x7f0000000600)='./file0\x00', 0x3)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)='overlay\x00', 0x2008000, &(0x7f0000000100)=ANY=[])
r0 = openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/current\x00', 0x2, 0x0)
fgetxattr(r0, &(0x7f0000000240)=@random={'security.', 'mqueue\x00'}, &(0x7f0000000300)=""/182, 0xb6)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r1, &(0x7f0000000140)=""/65, 0x506)
ioctl$FS_IOC_GETFSMAP(r1, 0xc0c0583b, &(0x7f0000000400)={0x0, 0x0, 0x5, 0x0, [], [{0x6, 0x22, 0xfff, 0x1000, 0x1, 0x7}, {0x89, 0x4, 0x2, 0x10001, 0x7, 0x8001}], [[], [], [], [], []]})

16:09:37 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000400)=ANY=[], &(0x7f0000000380)='./file0/file0\x00', &(0x7f00000004c0)='v7\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="2c6c6f772c776f726b6469727d2e00000000000000000000000000c6d0a32b4927a2c8cec164dc0f39dded1603fd1a31b1180c498c12a5e2a09b7cdd722cc69b14f9a6849ae64e9c8fd4f6b3fd41dbf10ed45408de598304936c621aebe1976829b2cbca492d621598557feb9bc41f1d74c8ce8236708d345ecfadca8c30bcf05960c100000000"])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
setxattr$security_smack_transmute(&(0x7f0000000040)='./file0\x00', &(0x7f0000000240)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000280)='TRUE', 0x4, 0x3)
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x2)
syz_mount_image$minix(&(0x7f00000003c0)='minix\x00', &(0x7f0000000400)='./file0/file1\x00', 0x7, 0x1, &(0x7f0000000480)=[{&(0x7f0000000440)="fcdf5369b6903a9c0b51237ed73a8642e36ca04d4b01953db9e4510f8a4c94259c8e9146b7faac29203ae9f16ce3816fd18b391786c485a796ad03c235f0a8", 0x3f}], 0x280400, 0x0)
ioctl$DRM_IOCTL_AGP_ENABLE(r0, 0x40086432, &(0x7f0000000340)=0x25)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000500)={<r1=>0x0, @in6={{0xa, 0x0, 0x7fffffff, @remote, 0x51}}, 0x1f0c2000000000, 0x7, 0x8, 0x800, 0x100000001}, &(0x7f0000000080)=0x98)
getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000200)={r1, 0x6}, &(0x7f0000000300)=0x8)

16:09:37 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc5010000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  896.296305] overlayfs: unrecognized mount option "low" or missing value
[  896.313198] binder: 5461:5474 ioctl 2270 200001c0 returned -22
[  896.378202] overlayfs: unrecognized mount option "low" or missing value
16:09:37 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r2, 0x84, 0xf, &(0x7f0000000340)={<r4=>0x0, @in={{0x2, 0x4e20, @multicast2}}, 0x9, 0x3, 0x20000000000, 0x8001, 0x6}, &(0x7f0000000180)=0x98)
getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f0000000280)={r4, 0x2, "27df"}, &(0x7f0000000440)=0xa)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:37 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file1\x00', 0x0, 0x0)
ioctl$KVM_GET_ONE_REG(r0, 0x4010aeab, &(0x7f0000000240)={0x0, 0x3})
getresgid(&(0x7f0000000300)=<r1=>0x0, &(0x7f0000000340), &(0x7f0000000380))
mount$9p_unix(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x1054, &(0x7f00000003c0)={'trans=unix,', {[{@dfltgid={'dfltgid', 0x3d, r1}}], [{@fsmagic={'fsmagic', 0x3d, 0x2}}]}})
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  896.573291] binder: 5465:5475 ioctl 2270 200001c0 returned -22
[  896.595246] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:37 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  896.643460] binder: 5498:5502 ioctl 2270 200001c0 returned -22
[  896.659163] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:37 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x2000)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

16:09:37 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x187}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:37 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  896.952484] binder: 5511:5515 ioctl 2270 200001c0 returned -22
16:09:38 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  897.011427] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  897.028722] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  897.083274] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:38 executing program 2:
mkdir(&(0x7f0000000380)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdxr\x000,workdir=.\x00\x00\x00\x00\x00\x00'])
chroot(&(0x7f0000000040)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  897.455994] binder: 5498:5534 ioctl 2270 200001c0 returned -22
[  897.501006] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  897.531944] overlayfs: unrecognized mount option "lowerdxr" or missing value
16:09:38 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x2)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  897.587798] overlayfs: unrecognized mount option "lowerdxr" or missing value
16:09:38 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000500)=""/65, 0x22)
getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000300)={{{@in6=@ipv4={[], [], @dev}, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r1=>0x0}}, {{@in6=@mcast2}, 0x0, @in=@multicast1}}, &(0x7f0000000240)=0xe8)
lstat(&(0x7f0000000280)='./file0\x00', &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
chown(&(0x7f0000000040)='./file0\x00', r1, r2)

16:09:38 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x1400000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  897.709371] binder: 5511:5558 ioctl 2270 200001c0 returned -22
[  897.755063] binder: 5550:5561 ioctl 2270 200001c0 returned -22
[  897.781867] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:38 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x10}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  897.803984] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:38 executing program 2:
r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x40, 0x0)
utimensat(r0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={{0x77359400}, {0x77359400}}, 0x100)
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r1, &(0x7f0000000140)=""/65, 0x506)

[  897.944889] binder: 5572:5574 ioctl 2270 200001c0 returned -22
16:09:39 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c5}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  898.050066] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  898.111096] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:39 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000300)=ANY=[@ANYRES64=0x0, @ANYRES32, @ANYRESOCT, @ANYPTR=&(0x7f0000000280)=ANY=[], @ANYRESOCT], &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2c6cffc0926bbf9dd27bc81ea4f2f6d9186f7765653e784aeca49e629232360000000000000000000000"])
r0 = msgget(0x0, 0x10)
msgctl$IPC_RMID(r0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r1, &(0x7f0000000140)=""/65, 0x506)

16:09:39 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="2800000010845fc500000000000000000000000010263a1ce7452821ace706cc217947d530567a1b070dc38d0892aa04e103000000e6bede30919b79beb9c150b479f132dce64d155e270eead671c419df9652595dd86666353fdd3a0f404d5462ad3530911b648c08f875759cca1abd58554f6b2b6140f24404efca350900000000000000d3d84a4c180f5cd21c0d1031f4028d769d3d75f7784f9a97f823778aa924ad5533be20061c4e", @ANYRES32=0x0, @ANYBLOB="030000000000000008001b0000000000"], 0x28}}, 0x0)

[  898.440194] overlayfs: unrecognized mount option "lÿÀ’k¿�Ò{ȤòöÙowee>xJ줞b’26" or missing value
[  898.501232] binder: 5550:5586 ioctl 2270 200001c0 returned -22
[  898.515420] overlayfs: unrecognized mount option "lÿÀ’k¿�Ò{ȤòöÙowee>xJ줞b’26" or missing value
16:09:39 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="2c6c6f77080000000000cbce000000000000c95feccfb2c6dedec3bc4b4cf3e5b9934e1060c2faaba722fa3f89b1acff819180acbfe4e7c2c97647c2508e5d7ed1c17d87a38e7e0ca09125eab468f6be9c1aecffb481eadadb8573949d0094820388f566035fa2d235f2f4fcad41ed4df053db0f539cdb98461e7df201c8d3bb14af6e833e3fe15d3ac680aeaf8e81d3dac2ee5066171bbf7c11b536029bddff1f5f18"])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

16:09:39 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r1, 0x84, 0x16, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00\b\x00\x00'], 0x4)
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:39 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x8000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:39 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000300)=""/65, 0x41)

[  898.797561] binder: 5572:5602 ioctl 2270 200001c0 returned -22
[  898.807384] overlayfs: unrecognized mount option "low" or missing value
[  898.826431] overlayfs: unrecognized mount option "low" or missing value
[  898.867627] binder: 5594:5605 ioctl 2270 200001c0 returned -22
[  898.956305] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:40 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:40 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x700000000000000}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  899.001285] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:40 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x101502, 0x100)
getdents64(r0, &(0x7f0000000300)=""/251, 0xfb)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r1, &(0x7f0000000140)=""/65, 0x506)

[  899.153360] binder: 5617:5621 ioctl 2270 200001c0 returned -22
[  899.287869] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  899.326835] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:40 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x1, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

16:09:40 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  899.452186] binder: 5617:5623 ioctl 2270 200001c0 returned -22
16:09:40 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x3f00}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:40 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
r0 = gettid()
sched_setattr(r0, &(0x7f0000000000)={0x30, 0x6, 0x0, 0x40, 0x8001, 0x3, 0x2, 0x5}, 0x0)
mount$overlay(0x400000, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1110c0, 0x0)
getdents64(r1, &(0x7f0000000140)=""/65, 0x506)
r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000280)='IPVS\x00')
sendmsg$IPVS_CMD_DEL_SERVICE(r1, &(0x7f00000003c0)={&(0x7f0000000100), 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x80, r2, 0x200, 0x70bd2b, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DEST={0x24, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x401}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e23}]}, @IPVS_CMD_ATTR_DEST={0x40, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x4}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x902}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e20}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x10000}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}]}, @IPVS_CMD_ATTR_SERVICE={0x4}, @IPVS_CMD_ATTR_DAEMON={0x4}]}, 0x80}}, 0x8000)

[  899.565895] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  899.573739] binder: 5594:5636 ioctl 2270 200001c0 returned -22
[  899.585779] binder: 5631:5638 ioctl 2270 200001c0 returned -22
[  899.593664] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:40 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f0000000040)=""/39, 0xff00, 0x0)
r2 = dup(r0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000200)={0x7, 0x0, [{0x942, 0x0, 0x10000}, {0x7fc, 0x0, 0x3}, {0x20a, 0x0, 0x3ff}, {0x214, 0x0, 0x8000}, {0x89f, 0x0, 0xa630}, {0xfff, 0x0, 0x1}, {0x0, 0x0, 0x8}]})
ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r2, 0xc1205531, &(0x7f0000000340)={0x9, 0x3, 0xa2, 0xfffffffffffffffc, [], [], [], 0x5, 0x10001, 0x101, 0xfeb42a7, "fba3b87805335b83cf89003c58647e70"})
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)
getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r2, 0x84, 0x66, &(0x7f0000000280)={<r3=>0x0, 0x9}, &(0x7f00000002c0)=0x8)
setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000000300)={r3, 0x400}, 0x8)

16:09:40 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x14000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:40 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
setsockopt$inet6_tcp_int(r0, 0x6, 0x3f, &(0x7f0000000600)=0x7fffffff, 0x4)
open_by_handle_at(r0, &(0x7f0000000500)={0x82, 0x625, "e1688959cec64aae59ec14524d034f8cdd8d6a4f2bf0dd655ac2a1ebd3beeadd890f433400b7e88c8a173f8b7a2f7340b2d864947f3f4bd77f142d2f302551b116b44cb7d532be1427b92f71fd4e49c4dd82a293f669f9307429de42ea9bf7d9d8bcd7bbdf6cc6bbf274f0feac39b1058d2cf79678c6e75ba840"}, 0x0)
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f00000007c0)="dd4244986ac8331a619ff26d8fdb68aad09ca0430cc9f5022da7de0348efabda832d9324c1eef78bf224b37d80af22238bd440937987645ba5fcbf31b55b112bb18ced21a23974235ba62710fc830c20df5777c9b858911eb745132a1511e54b7ddce995e6c9fa5e36531d47ca21efddd5a5002b8d17bb040d4853a43ce268044a82b8ce418a8fd62be5516a2200c446ddef07d91fbce0220eee5b16904e019920b3c40d850454659f8b6eda416a29cdb82da4a7c5064a46c801e276d7797bb83e551531d4e0e85fb59e97f0048f99e94cae65ed593efec56bcaf36bc06739d211c8757d4a70f96bd3", 0xe9)
r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCGETA(r0, 0x5405, &(0x7f00000005c0))
restart_syscall()
pselect6(0x40, &(0x7f0000000180)={0x29, 0x4, 0x4820, 0xff, 0x2, 0x0, 0x0, 0x8}, &(0x7f0000000280)={0x3, 0xff, 0x0, 0x80a, 0x3, 0x100, 0x8000, 0x2}, &(0x7f0000000340)={0x8, 0x7f, 0xffffffff, 0x3, 0x1, 0x1, 0x3, 0xda}, &(0x7f0000000380), &(0x7f0000000440)={&(0x7f00000003c0)={0x3}, 0xfffffffffffffe29})
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r4=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r4+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
tee(r3, r0, 0xfffffffffffffff8, 0x4)
ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r1)
ioctl$RTC_PLL_GET(r1, 0x80207011, &(0x7f0000000680))

[  899.777028] binder: 5647:5650 ioctl 2270 200001c0 returned -22
[  899.792434] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:40 executing program 2:
mkdir(&(0x7f0000000480)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000600)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000300)={0x0, <r0=>0x0}, &(0x7f0000000340)=0xc)
mount$9p_rdma(&(0x7f0000000040)='127.0.0.1\x00', &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x4000000000000000, &(0x7f0000000740)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@sq={'sq', 0x3d, 0x7}}, {@rq={'rq', 0x3d, 0x40}}, {@rq={'rq', 0x3d, 0x401}}, {@sq={'sq', 0x3d, 0xe0000}}, {@timeout={'timeout', 0x3d, 0x9}}, {@common=@dfltuid={'dfltuid', 0x3d, r0}}, {@common=@version_9p2000='version=9p2000'}], [{@appraise='appraise'}]}})
r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000680)='/proc/sys/net/ipv4/vs/conn_reuse_mode\x00', 0x2, 0x0)
r2 = openat(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', 0x0, 0x44)
read$FUSE(r2, &(0x7f0000001300), 0xfda)
r3 = accept4(r2, &(0x7f00000003c0)=@un=@abs, &(0x7f0000000440)=0x80, 0x80800)
r4 = add_key$keyring(&(0x7f00000005c0)='keyring\x00', &(0x7f0000000700)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9)
openat$dir(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x4c000, 0x20)
ioctl$UI_SET_FFBIT(r1, 0x4004556b, 0x12)
openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/thread-self/attr/current\x00', 0x2, 0x0)
getsockopt$inet_sctp6_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f0000000200)={<r5=>0x0, 0x7fffffff, 0x7, 0x1, 0x7ff, 0x8000}, &(0x7f0000000640)=0x14)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x1f, &(0x7f0000000840)={r5, @in={{0x2, 0x4e20, @loopback}}, 0x9, 0x1}, 0x90)
add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)="ac4fba55c444e657950d1dc2206a38637f50511253d7eb24f30067c3c3d0f928e5358a7b511f395088281c365bc2c40d95765d970ceea965d01f3c3388855b3ee5e518457e95c9204d756283bca1e9ec7ecf06d7f2fbda71526fe512f972b812f24dd44eefc97ea9dff3171036cbbff2b26eae66b2589dbf4c8f5d76b3b62b0c927545bd50f2", 0x86, r4)
getdents64(r2, &(0x7f0000000140)=""/65, 0x506)
quotactl(0xfffffffffffffffa, &(0x7f0000000900)='./file0\x00', r0, &(0x7f0000000940)="032fe23af794a11e689dbcaf68a64f25905b4da9492329dddf526b0a08d93aa36df8a68af4326c562d18a84b7bccf0ed43e37c2f08d11d71dd38123a9952f1e993601b70101117aa1b21cb6e402e1aff08cd44f099e3b8f36778104b31eb875573843875ebdbff73ba8bff0337e68f68b0e16f6253b9276560ac25603beb8e47d4a43955df462016717a7f80314d37583d6f9bebc8e68751cbcd505ee0af8684c204c8dc3b761335f32a01c990c2dd33811f4023dd4f0fa9c02c87396391b43cc9b7c0dc7f5e59819565f7ac281e75dad8b6117ebfa705edf1590e1ec93f6d891222a46491076a35d54f1a2233e79ee58da1dd22d39c1545")

[  899.824207] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  899.886806] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  900.077958] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:41 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000240)='/proc/self/net/pfkey\x00', 0x80000, 0x0)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000280)={{{@in=@multicast1, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r1=>0x0}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @local}}}, &(0x7f0000000380)=0xe8)
lstat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
r3 = getuid()
r4 = getegid()
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000480)={0x0, <r5=>0x0}, &(0x7f00000004c0)=0xc)
lstat(&(0x7f0000000500)='./file0\x00', &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0})
r7 = getuid()
stat(&(0x7f00000005c0)='./file0\x00', &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, <r8=>0x0})
getresuid(&(0x7f0000000680), &(0x7f00000006c0)=<r9=>0x0, &(0x7f0000000700))
getgroups(0x2, &(0x7f0000000740)=[<r10=>0xee01, 0x0])
stat(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0, <r11=>0x0})
r12 = getegid()
r13 = getuid()
getresgid(&(0x7f0000000840)=<r14=>0x0, &(0x7f0000000880), &(0x7f00000008c0))
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000900)={{{@in6=@local, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r15=>0x0}}, {{@in=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000000a00)=0xe8)
getresgid(&(0x7f0000000a40)=<r16=>0x0, &(0x7f0000000a80), &(0x7f0000000ac0))
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000b00)={{{@in, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r17=>0x0}}, {{@in=@loopback}, 0x0, @in=@multicast1}}, &(0x7f0000000c00)=0xe8)
lstat(&(0x7f0000000c40)='./file0\x00', &(0x7f0000000c80)={0x0, 0x0, 0x0, 0x0, 0x0, <r18=>0x0})
write$FUSE_DIRENTPLUS(r0, &(0x7f0000000d00)={0x5b0, 0x0, 0x2, [{{0x3, 0x3, 0x20, 0x101, 0x2, 0x3, {0x5, 0x1ff, 0x6, 0x81, 0x8, 0x36fe, 0x401, 0x80000000, 0x9, 0x5, 0x8, r1, r2, 0x7, 0x7f}}, {0x4, 0x8, 0x8, 0x1, 'overlay\x00'}}, {{0x0, 0x3, 0x1, 0x9c15, 0x861d, 0x3, {0x6, 0x2244000, 0x1, 0x6, 0x40, 0x800, 0x6, 0x5, 0x6, 0xa0e7, 0x3b, r3, r4, 0x100}}, {0x4, 0x3, 0x8, 0x3, 'overlay\x00'}}, {{0x1, 0x1, 0x7, 0x4e, 0xfffffffffffffff9, 0x80, {0x3, 0x1, 0x8, 0x2de, 0x6, 0x1ff, 0x40, 0x0, 0x4e, 0x6, 0x8, r5, r6, 0x7, 0x6}}, {0x5, 0x6, 0x7, 0x0, 'mqueue\x00'}}, {{0x2, 0x1, 0x1ff, 0x3aa, 0xffffffff, 0x3, {0x1, 0x3, 0x8, 0x80000000, 0x9, 0xf7, 0x1, 0x2, 0x0, 0x81, 0x5c70, r7, r8, 0x4, 0xf0f}}, {0x4, 0x6e65, 0x11, 0x8, '\\prockeyring*bdev'}}, {{0x2, 0x3, 0x7fff, 0x5, 0xfd96, 0x3f, {0x6, 0x8261, 0x0, 0x3ff, 0x1, 0x9, 0x6, 0x0, 0x80000001, 0xff, 0xd2, r9, r10, 0x9a}}, {0x6, 0x1, 0x0, 0x6}}, {{0x1, 0x2, 0x9, 0x3, 0x100000000, 0xffffffffffffff95, {0x0, 0xffffffffffffffe1, 0x7, 0x9, 0x0, 0x80000000, 0x0, 0x1, 0x10001, 0x7, 0x100000001, r11, r12, 0x20, 0x8000}}, {0x0, 0x100000001, 0x0, 0x3}}, {{0x5, 0x0, 0xff, 0x7fffffff, 0x3, 0x9, {0x4, 0xcae5, 0x8001, 0x6, 0x10000, 0x800, 0x5, 0xfffffffeffffffff, 0x5, 0x1ff, 0x8, r13, r14, 0x5, 0x20}}, {0x4, 0x7, 0x7, 0xf3, 'mqueue\x00'}}, {{0x3, 0x3, 0x3ff, 0x0, 0x3, 0x3, {0x6, 0x9, 0x20, 0x1, 0x64a3, 0x10000, 0xd804, 0x8, 0x0, 0xffff, 0x53d3, r15, r16, 0x3, 0x6}}, {0x6, 0x7, 0x7, 0x498, 'mqueue\x00'}}, {{0x4, 0x2, 0x6, 0x8, 0x401, 0x7fff, {0x2, 0x100, 0x7, 0x0, 0x20, 0x80, 0x400, 0x35, 0x8, 0x7, 0xbdb5, r17, r18, 0xf7ca, 0x1}}, {0x3, 0x5, 0x8, 0xffff, 'overlay\x00'}}]}, 0x5b0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="2c6c6f7765726469723d2e3a66696c65302c776f726b6469723d2ef271c25394d1"])
r19 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r19, &(0x7f0000000140)=""/65, 0x506)

[  900.128695] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  900.150189] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:09:41 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  900.269664] binder: 5631:5638 ioctl 2270 200001c0 returned -22
16:09:41 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x3f00000000000000}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:41 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)
write$tun(r0, &(0x7f00000013c0)={@val={0x0, 0x88fb}, @void, @arp=@ether_ipv6={0x1, 0x86dd, 0x6, 0x10, 0xb, @random="f6edeb057820", @dev={0xfe, 0x80, [], 0xc}, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}}, 0x38)
truncate(&(0x7f0000001380)='./file0\x00', 0x7ff)
bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000280)={r0, 0x10, &(0x7f0000000240)={&(0x7f0000000040)=""/27, 0x1b, <r1=>0xffffffffffffffff}}, 0x10)
bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000001340)={r0, 0x10, &(0x7f0000001300)={&(0x7f0000000300)=""/4096, 0x1000, r1}}, 0x10)

[  900.396253] overlayfs: option "workdir=.òqÂS”Ñ" is useless in a non-upper mount, ignore
[  900.415795] overlayfs: option "workdir=.òqÂS”Ñ" is useless in a non-upper mount, ignore
[  900.456720] binder: 5675:5678 ioctl 2270 200001c0 returned -22
[  900.563508] binder: 5647:5658 ioctl 2270 200001c0 returned -22
16:09:41 executing program 0:
perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x6, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x28304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r0 = socket$nl_route(0x10, 0x3, 0x0)
pread64(0xffffffffffffffff, &(0x7f00000001c0)=""/39, 0x27, 0x0)
r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/ip_tables_targets\x00')
ioctl$TUNSETNOCSUM(r1, 0x400454c8, 0x1)
sendmsg$nl_route(r0, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  900.673979] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:41 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x58020000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:41 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000380)='/dev/userio\x00', 0x4000000, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0xaaf4e4e7)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
ioctl$sock_inet_SIOCGIFNETMASK(r0, 0x891b, &(0x7f0000000180)={'tunl0\x00', {0x2, 0x4e23, @loopback}})
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  900.715037] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  900.774619] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:09:41 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  900.831766] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  900.849970] binder: 5693:5697 ioctl 2270 200001c0 returned -22
16:09:41 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000240)='/dev/sequencer\x00', 0x80000, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
fcntl$getownex(r1, 0x10, &(0x7f0000000040)={0x0, <r2=>0x0})
fcntl$setownex(r0, 0xf, &(0x7f0000000200)={0x1, r2})
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

16:09:41 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x64000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  901.027007] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  901.045941] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  901.073450] binder: 5675:5679 ioctl 2270 200001c0 returned -22
[  901.094436] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  901.143317] overlayfs: failed to clone lowerpath
16:09:42 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x8701000000000000}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:42 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
r0 = syz_open_dev$midi(&(0x7f0000000240)='/dev/midi#\x00', 0x80000000, 0x0)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f00000003c0)={&(0x7f0000ffc000/0x2000)=nil, 0x2000}, &(0x7f0000000400)=0x10)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r1, &(0x7f0000000140)=""/65, 0x506)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))

[  901.220354] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  901.286853] binder: 5714:5716 ioctl 2270 200001c0 returned -22
16:09:42 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x64}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  901.391324] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  901.430586] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:42 executing program 2:
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@loopback, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r0=>0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000400)=0xe8)
syz_mount_image$msdos(&(0x7f0000000040)='msdos\x00', &(0x7f0000000240)='./file0\x00', 0x5, 0x0, &(0x7f0000000280), 0x8000, &(0x7f0000000440)={[{@fat=@nfs='nfs'}, {@nodots='nodots'}, {@dots='dots'}, {@nodots='nodots'}, {@nodots='nodots'}, {@nodots='nodots'}, {@fat=@showexec='showexec'}, {@nodots='nodots'}, {@dots='dots'}, {@dots='dots'}], [{@fsname={'fsname', 0x3d, 'mqueue\x00'}}, {@context={'context', 0x3d, 'unconfined_u'}}, {@defcontext={'defcontext', 0x3d, 'system_u'}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'overlay\x00'}}, {@mask={'mask', 0x3d, 'MAY_WRITE'}}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@mask={'mask', 0x3d, 'MAY_READ'}}, {@euid_gt={'euid>', r0}}]})
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r1, &(0x7f0000000140)=""/65, 0x506)

[  901.595915] binder: 5693:5728 ioctl 2270 200001c0 returned -22
16:09:42 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x10000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:42 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff})
r1 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
ioctl$SG_GET_COMMAND_Q(r1, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:42 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="2800000010005fba000000000004000000000000", @ANYRES32=0x0, @ANYBLOB="030000000000000008001b0000000000"], 0x28}}, 0x0)

[  901.711284] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  901.776135] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  901.781609] binder: 5733:5737 ioctl 2270 200001c0 returned -22
16:09:42 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
ioctl$EXT4_IOC_ALLOC_DA_BLKS(r0, 0x660c)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x1)

[  901.835724] binder: 5714:5717 ioctl 2270 200001c0 returned -22
[  901.897902] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  902.050154] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  902.119874] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:43 executing program 2:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0xfffffffffffffff9, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

16:09:43 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  902.196107] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:09:43 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x8000000}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  902.417101] binder: 5752:5756 ioctl 2270 200001c0 returned -22
[  902.444666] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  902.500287] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  902.556418] binder: 5733:5761 ioctl 2270 200001c0 returned -22
16:09:43 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000240)='./file0/file0\x00', &(0x7f0000000040)='vfat\x00', 0x3, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

16:09:43 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
getsockopt$inet6_tcp_int(r1, 0x6, 0x17, &(0x7f0000000180), &(0x7f0000000280)=0x4)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
getsockopt$sock_int(r0, 0x1, 0x3f, &(0x7f0000000340), &(0x7f0000000380)=0x4)

16:09:43 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x5802}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  902.770732] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  902.788459] binder: 5766:5772 ioctl 2270 200001c0 returned -22
16:09:43 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,worodir=.'])
syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x0, 0x80000)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x41)

[  902.825987] Filesystem requires source device
[  902.844647] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:43 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:43 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
socketpair(0x5, 0xa, 0xff, &(0x7f0000000040)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000200)={0x9, 0x3, 0x3, 0x10000, 0x5}, 0x14)
r2 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  903.005966] binder: 5752:5756 ioctl 2270 200001c0 returned -22
[  903.018490] overlayfs: unrecognized mount option "worodir=." or missing value
[  903.055594] overlayfs: unrecognized mount option "worodir=." or missing value
16:09:44 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x40000000}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:44 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000040)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x20000000, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='\'lowerdir=.:file0\fworktir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  903.125041] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:09:44 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x200, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x101000, 0x0)
dup3(r0, r1, 0x80000)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r2, &(0x7f0000000140)=""/65, 0x506)

[  903.205716] overlayfs: unrecognized mount option "'lowerdir=.:file0worktir=." or missing value
[  903.217386] binder: 5792:5796 ioctl 2270 200001c0 returned -22
[  903.238723] overlayfs: unrecognized mount option "'lowerdir=.:file0worktir=." or missing value
[  903.315320] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  903.343512] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:44 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = shmget(0x2, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil)
shmctl$IPC_RMID(r0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0)
getdents64(r1, &(0x7f0000000140)=""/65, 0x41)

[  903.364337] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:44 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6400}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  903.518905] binder: 5766:5775 ioctl 2270 200001c0 returned -22
16:09:44 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  903.655877] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  903.691066] binder: 5792:5800 ioctl 2270 200001c0 returned -22
16:09:44 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0xd}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200), &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r0, 0x84, 0x16, &(0x7f0000000180)=ANY=[@ANYBLOB="06070000000000000004010001000000"], 0x10)

[  903.713911] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  903.816612] binder: 5822:5825 ioctl 2270 200001c0 returned -22
16:09:45 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

16:09:45 executing program 0:
r0 = open(&(0x7f0000000040)='./file0\x00', 0x92100, 0x40)
ioctl$EVIOCGABS2F(r0, 0x8018456f, &(0x7f0000000200)=""/76)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r2 = getuid()
r3 = getuid()
getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000280)={{{@in=@local, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0}}, {{@in=@loopback}, 0x0, @in=@multicast2}}, &(0x7f0000000380)=0xe8)
setresuid(r2, r3, r4)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000440)={<r5=>0x0, 0x64, &(0x7f00000003c0)=[@in6={0xa, 0x4e22, 0x7ff, @remote, 0x81}, @in={0x2, 0x4e22, @rand_addr=0x80000001}, @in6={0xa, 0x4e22, 0x6, @mcast2, 0x10001}, @in6={0xa, 0x4e23, 0x8001, @empty, 0x1ff}]}, &(0x7f0000000480)=0x10)
getsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f00000004c0)={r5, 0x2}, &(0x7f0000000500)=0x8)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r6 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r6, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="2800000010005fba000000000000000000000000", @ANYRES32=0x0, @ANYBLOB="0500000000000500001f00"], 0x28}}, 0x0)

[  904.204832] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  904.239898] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:45 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x10000000}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:45 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
open(&(0x7f00000001c0)='./file0\x00', 0x80, 0x1c)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdirkdgr=.\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'])
r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000240)='/dev/qat_adf_ctl\x00', 0x0, 0x0)
r1 = openat(r0, &(0x7f0000000040)='./file0\x00', 0x0, 0x0)
getdents64(r1, &(0x7f0000000140)=""/65, 0x506)

[  904.365477] netlink: 8 bytes leftover after parsing attributes in process `syz-executor0'.
[  904.379108] netlink: 8 bytes leftover after parsing attributes in process `syz-executor0'.
[  904.404334] binder: 5833:5838 ioctl 2270 200001c0 returned -22
16:09:45 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:45 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'vcan0\x00', <r2=>0x0})
r3 = getpgrp(0xffffffffffffffff)
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000200)={0x0, <r4=>0x0}, &(0x7f0000000240)=0xc)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000280)=@bridge_getneigh={0x15f0, 0x1e, 0x420, 0x70bd2a, 0x25dfdbff, {0x7, 0x0, 0x0, r2, 0x800, 0x100}, [@IFLA_VFINFO_LIST={0x1420, 0x16, [{0x1248, 0x1, [@generic="89b6ed6c7da79122bd8ff9fc728624683fed30f673208dfc5afbd16403c11d5775741b394ccb3dda20c938776b4b22bcf68ee7f92355f323b86cececfb67", @typed={0x14, 0xb, @ipv6=@local}, @generic="4cc2d353807389e542f1a220502fd8449172a7df0ac4e86d389cde2d6137cffd2e2ff40795be85354138415077ff633b62d2daa80bcc7c8641fe5eea308daf13a422f1adc18260b49d24fe9c741c3e6ba99cc787eeb0412b7ff54238cda89173f5d1c070d5eae5d0b45a57ab7b0e8cee883eeaf814b897197dc5fdaa0cf00743c28cd0546585ea43accb07aa9fca532def00a3d16640ddabb5c36e4fb24be9317073479147c6834860c037a3557eb76674c1df665016e097", @generic="7df85da1ff6d86ba46a04eab5cb99f9f19a1fcdc314a12a492b71fab20ae6945315822a76c3be146401797698d9cd3de83dd8f537b68082f95667c8d6b51fb3f12697bc93280cb4bc4371973928280407e7af05f634f4bf1bba8", @nested={0x1078, 0x2e, [@generic="9d41145ee63dc1d0eb2c7ce03a4d86e2cd938d00e1014ac8a6ccbf3c2eed2a036bd4495317ca6ac2cc1a339540bb894b2bf201afacc38728f997f21e8b01c4409375a0340ca52747a75a48b9fe9e975d0f0dc6f8d6cb7605515f61ed2164f978444d122cfc7e2279587a5f7ce69723da01e38b94bf5db1770e0c9375abb858b3d356b9aab0e4ee843a55768323ed9501a15b4753250c5618624f9326299294c26e1fb38ae26e0af1f2ce5aed493365e56e5c2ae34b9ea8069e81658030ba71c33565972c2411ac296cdd39d3f32e9cbec821b78f8a9516bd8ae5f3969949a75faffd4c79f3e33097590222a18407bc37b9b742dfaa965012793cf10015c8a23d7ce72ec8aa906f0bea037c943884afb822d68edf9cc15e8a096298c802f64415cac6b6e2f304b9b7b492c826d1a4d0ecf4c244276addd7a08384ac7c4e8c7d5d9eac658b95eeb42a484ac7cb631d746b1f9e3989a144420574089218b72ccd8b64a5cb4c2e1804b856c95fc4288437d42150198eb23d7c806389070f8f8ab91587c365eb485c81af138328d2e154551f3ac106fbd62fda30bc08fd08f619be557177462d23d967aec3dd5d1f14b2d17fba82d84ba36034089bffbf61310cc0363ad3e21526f86aafb13e4bb9ad20bb14959ba674d8d9d51a791e29230464a2e34f0fe73ad8eb554d60e063aafc0d0b86c5ff142c118f028b14515fc3a0f28e777d5a06ed3c6436ef2c1b39ce325fdb46d03307dae958fab53c432624007465f6f93a6df86c38943d0de6f2ec436bff74ab3043434e4400f8c91e0e915951701bb02cdcb8b9ed5d171ffe750ce09ed76f1846c9f9a0a40754a31b65f305a82411ad33fc20c763152d32f1e9cc663d0f9b1ef1a5ad4d78e0aa8415068db25387a2a86aa430591dff499a971f47cb19d5e507897312afd0857a4706a2b4d3a695e895dbf512a0fd77818b05c2fba68e76cd62376f1df899dfb80d25ca7e840e2b16cccdafd4cac5d98c82fa7ba5f855e6c119c567a172d86f78bc44b3f67105d48e6b4e465659c65e0f6fefa24d109a65443f97620d472e03b89cf4068d3c91d079a67989f69a1b80f5596e3fa9f706d7fcd3a83d518ce46ad571929b6a89a42310ac675f2bec9582669276161a529d322d18b0c9f88d82f51f22007d8b35ebcaae71f7aa36277edc59fbecbf929915882ad3f20b864f0affd75411fe8ad483dc5356460f748a10aff25820af9e77b46046e73c1398e225ed1e8fcab9ebc3aa53d961d5d499b1062f953d4d3cd732823f7c64ed910e0e30be83ce47146dd4487673916d14080063facdc40ed106d14811b487cf649757e203eb8a1d1d79287419db732e839e35fc5135816deaf303bbe24c66e65b611147463d15890a0a2fb26a6d857fb1b0fef48783fce516954bc6250e4f71491c8633f61b186cf79966ceefd6bb85c486e7aedcc796f9131b3f0d108afb7ec52d57ce241bf419d071b5b73c11cfb6bd644af6941b13bd4b488a44b9b8ac53dc3705c1affb85bc991b7ef581823d00eaa2e3e3d056ff86aa7999407190ae8524bbc52a0af1ab5baf6084278c0684d9e047eb85fa2cf28de030eaafcaac875d20f8cc84c5eb357e44b012ddab5a80553480d17663fb0482b6fd57c31ffe09a41922deb2fff8b34bde9528a39ef0a840a64bfb6c48de814453f40cacb78eba5b66b5ac08b89ee82901d6aef559bfe883f02cfa6c1035dd73ea83b7370f38cc18dcd01616a7d64a87fb9c468b5d8bb60b16b57f1190e1d534d1d524059872f6f8916080836ece899e9aea3be1afbaea4584ea1afdb58220da689e27dd9c520e2ba3bd20c666eaec6178972a6a23dd57ab538ff2315ba6166fbec9c79b7956d73757303cba6f5160c7b4bd4e5fd22406f2aa36fd63d11feb2709a9b5e339c119a00d31d0e69b6c4a0514e70b69b91709387cbed746206460eb04a7665c2460aec12b6c2b555a6bbe8ef769d50dbf7714e6890c8e4feb58614c98974e450bc30b4a4ec203c69686fb810dece8217290f6b4db41a1ba0bfae473dd77abb1cd72e3b4c7f555fb449cef80cf2777e8ff0ed5cacff1c55cfa10be98c8798b0f3c41fbfc1cd252e88a9f00965fae2e0a10710ea0b28dd745abe423875e2e1f8508c278471925e63d955e28e9a2a61e9a792adf0b0091c47b5133dd5ba46b324d9536894fdcdbcd1de93f9f3e53901341b80f8191c9d8ba72fbe857d6547c530db78ac3b30c65d6396e7030217aed7c3109fed588e75524c43d6b36775cff83746e2296500e316af47ee98be2c06f77a5baf547de27f4e0adad32655e2153f51cf4b595cf65d38dfb61147d305cb95ea36df4166c267663c0706e2809d782ad8ec66bcaf11e8ece3d4a7014fa67168ccfc749c3f5ec31a6d31d950ca6fba72c59b120161a6fa16cabacb75594d3619f38b7524cc3fbb27b4f273729cfb1b9d74194876cf6c29c758b482f8f0248db573769bc97307cee49b5e38f22b694b6714d091a1627c3903fd63e5e2f021c87d1be75b0031f9315922e1b17a37bddae52d629338546c0ad9a7c193a5dde3152618c0c7eba797bd648dd53c6b38ac20ac8237985285d62e0ee6149467053739a07b1986d95da688b76671a44a502f69ef214a400f666e968d99393c709d06198e1332e58671a3a292f1f779fc3f481e84d14f8c821ea9b47ba46989993def64bbe18f94b60e85f5804e8a178843bfa2354d7f9452b6e9d6230d211d135dcc625e180b2cc5e75271cf2a05c35981da41dfac591e1e9d127bd18423f679b208e0711e670bb5893d946e78c0f0ca2593c3abdc399651378302708d6bbe5c5203986c797b9a96df50351eb60e4aa7b2899962062fa7407e5f37fb4df3bdf1130a37cd8e3deffcef168644b4bd022d10c7ac8389f315865cb15e810d7ca0b9772a3559752e5fffd55378609948dd7d22558bd629dce087ad74ccebfd27d535d1238f115d8948725dbeb392599456dcdce8192200f7311b5af004ec90cc6422d48a815396c3e830bf6f8ade32ac67022ad3c94e5766ab8a744f60746185f17de168494290523795aebc255bab62ef070e75a495876a3bdfe6d4d36917359d299fe2876555ed5cfcd13c4c1276e3d484892dc4a9a4fa2481d6da691117189e818598d1bc3b4bbd8bf11c5076ac674a5c6bc748323059c068bbd66664149a08c3dfe139ade2bb8b0d139ee93e87944e3ef9da3e6148d03839a8c84d18f36d1f9a5e33f2666e8abbe6af3179952d27448850dd7cfd68a04f51a3e93d410f70226b7a56e1a00eff17d1c607d9038370ef4db492b7b972cd951f5c0f1ad1251c41dda1a00aff4cb596539f6c59583a2629f0af1c8aa3f1ef3aaafe96b2b0f63f8756fea56525196c0773048c5927de42369be0bf7faeb639fc4cacca4922afd64234f54009d21f2f52432231b3ee49adf12a1a1214cb7a38a4cd7bccbb1b703fd9e43e38261faf0e3399767f9c49dabb7ffd48f9d1b8bf95ecb35b77b9d54ba354618a92abd7ec8a70a635796d6b188114cdc9941db2fbc7ddcc35a58804e03600783bc07339c1d50fdefea166b4fe3c124c737226871d771e31e6e9c1e65f94a7ac0b6c38467c75a61f9c1a87771ec6c6917490139ebf7c9958f92b030db923a0f691314e9b647455c88f3847a611f04a47ff3df2cde995505f54c888667f31dd41514d0f31250d54647f911dd0df7fb404574b02112ef40604b2c767a75bf8173cfad6ea18e1d1ec29b174db776e086ca81eab28ef182ee25424531d56947efbbdb62608e4cd1629d190153ad27b8d43648a711623aeffb70fc7ef1da1162ee3d25da9237254b2bb027c2f6f04afd70ca6dc476a2716d0299e997b6c2d064eee5477ca5d688ca7d69c22e645fc81b2a57f4553e1034e8814f4e5a5fddee109fef63612e6be05336d7c786b013377df3d0efdd055fa93fda4f6a3d20a7dfa8b55a23f0ae78c647a73ff7e330c38da241920c9d005dd30a1077ce9f53b9e9fbd485c3a564c5eea7d088a655991bf6503700ccde9638ee534ed11aee59c6c401ac41a3938ebd589649273fe4df70ffabd70c71b8fbe48115d46fd3cccba114dff0a124849a1609beadab5463c6c94cea080780a77d452b921238002fec5dae79063e6ff004b37ee3ff0a86c0d66a0d783cca0507ddf7ba2522585e0aaf65ffecd5af514956062e94553466c214757c7301f82eee84d15519f6da9993ed06544372e0b5c416c73831e533e2ae2933a7f4ceadf03f76903a278e483666c18f5c2d3e79abf5f25f022a0db37369994477ce23419185aee60e6ba00d9393376816341c36b3713fff508d7971b66401be5397a78aeac00c3a722413dcf67380857ec2e95a3c375a7f257b1473cf64750442fa48b11f048094816b8393e3ffd5e71e5658bbbcd31133553f503dbb305aa8aa85267479c6fb0095c9796896db034469492698c2343c62acdb76cd317b433d8d804907ea25be860ed3533d3d0593a15b87fa711a9490348c71ee9b2b85aa4d7db31e86324f1de24cd3e8f5570e463d5e2a4d51dfd5fbf048906c6a5170e8bd5cfb2c1a23026a68f56ff5a160dd3c8935fee6d1a69d8f12ef74dc92f2e74a64e6da0df4ca68530849275727781483937b96b0aa1050cdc2629dc5a84a8914e84731648720bd582d4ffe9a0a326543aaa6650b491b23bcd432391cc8d08a83826586ff89fb2914b06d532762096c27d222427cef068f979405ef8ed50b5bd249a0a81adeaf7b478f67a7cb62cd2e416415e1eaac124d6f60e8b7424b1994120c6412264798c233bb722f8ebb7adbd83a515fe04a64283ec2473c08714bc69f90e7abdc3235c392106cbc53456d84352c3861050cac4febac2dde5cfa92d62089f29287c64fb1cd7f87da42098a854b6e4f29f4c219c00d757896fa27da367f45e93637be09daba7c051cff3f361d11fc9c4d9c509ebd197426a31a490427a689743d05677823e2baa402adddc1df45f9ddec197de4ce1bd1eb4932dde74f7e910cb761b5b2ee4888e884f524b2f9ef13d41ce0b5d077c386c1a53201cc47dbc01ea75e3a37a0f512ed2813b55bbd90d7c5d867b44e11f14ce252860a1033a0cec7f0f06d2e7c20d1bc9337c43cccea2e76df22c5d3a2db4ab9755b3fcc6673b93339237b31c1337ecc89c4d6de51fc29418149dab8d8c28348eba145207c9a2cd1f9eaca0a7163b0e65b19fee4cc4c1d52d00519699042b88c812f22a9e2887727811324112ce46c18b0723ffa68be3fe04a4e449961e422bed818fd3ae42df5f4769d6e8815c1a33ff2fe9002dd7be98f0fcef9f3463d66587ce930ba7a5a9e7ce55486765c4327477ae0574e98c801116eaf20fc09576f2b939dd8626b2dc2acfb734bcd02b167a5d43e89ec2e8ddcbb5909408aadde911854ee47949bb64c0f013703b73be0b9f6b74793de09d111be057804d7c7b3e486caba069da52176b2d3cc311ca11a3a74397aff1e94c61b64779a01befc3f826e823c814d50b53260da6643832bd02a48537f8da40f11191f3e823e9fed9565b7e851956162d462af400b4404cd892fd6704daab2474ebc6e4ee8f05aa20668a074302559b615ecc66daeb594b120aa5f58e3fd51eb479e59112d2672818dcc245bfc8cd40d7423510691e706cc1c57524d9392d9121e7e55d4c00296c7d709e047634a57a26e62946c4203bd8557a922abc156b5f0a7930082f201d661097006a375732e6f22bb949834ffd2c988df4a6d9c275daed97ceca1bd8c0cda7729fe9ffb19", @generic="7612f318121a452ae4ad18932564a5975299ac52d5c1d1af065d10004cba8493454ec36cf127ba8158e733a77be5e29fff63cb50b10038720683a617624e9d25d3d3c62d4cef0684270764a6ee7b3d648a4e409037ba46b291d07b544bd580cf2fc17d78badf9400838ecb9eac52f1399a3a17f5"]}, @typed={0x8, 0x7c, @fd=r1}, @generic="bb176d7a73c3fbd8396df144e58bcbe83282586ffbd920ba97af64c5a57ad77c8d5ee7a6ff5a55e931daddd036b6a49ae14abfc8506543f492b30f733ef0773f9fcb74f978be64fa464816a3bfc1339a85ac94003ee32a51ce6b393e67ce14"]}, {0x1d4, 0x1, [@generic="bace212178e26fdbedae0205e2ddcd60b6ec46b7626bd60c8ba3cef38a0f46a2cd7eb71cfd30fef63b550386e1ed", @nested={0xf0, 0x7b, [@typed={0x8, 0x18, @fd=r0}, @typed={0xc, 0x85, @u64=0x9}, @generic="e712a44bfbd6171db3", @typed={0xc, 0x6a, @u64=0x5}, @generic="face979d7cf5ac3b8a3189748b864447729a00a848170f3355a6918d343a8150819379874d48d13b527468ec6d074811fa70308da5fd5b98f2a46d7a8e48607914adfce245375a86bea6764566322bb5ae289a442d9f483cbf75dec4b95abb2c4c7c0cb643a77e933cb233e6f6afdfe61748f827d6909f44fb5e30ad3f6030f96d7a621932951fa0fe2b8f852ee250195db4aa9d3c0e4f205781dcc0e041391985bb86f27c1d04b67c5011000897c9e49a7d0e3f934bf545", @typed={0x8, 0x6b, @pid=r3}]}, @generic="01cd2e23edfe3f475244962bef092a3b75fe99f6b097bf063e1a3de7fdb532825f741b89ac6ab7c08f91ecb96323f82bdb9eb7d6dbf07004528dd444ef21fd24b345b5101b11e121842220dd5c051921a15db94964cab7e8ebe051a12ba90b03eb60bbf4c4b71df174ccb8beb8494a6d77b434bd5faa3617774040bc94508099d50347ec26d5c42231c586f669e6fc60ba6bc082eb1dbd8fa49f4132159ac14dff9a82e153d084764c6dfdeb0935dc31"]}]}, @IFLA_NUM_RX_QUEUES={0x8, 0x20, 0x8}, @IFLA_PORT_SELF={0x1a0, 0x19, [@typed={0x8, 0x57, @uid=r4}, @nested={0x40, 0x40, [@typed={0xc, 0x44, @u64=0x8f7c}, @typed={0x8, 0x6e, @ipv4=@rand_addr=0x1}, @generic="1c8239427f01a086373a5945c75d2a6026d185f57579aad0942c1ffc8f263ca61566583e2f1dc3f9"]}, @nested={0x140, 0x84, [@typed={0xbc, 0x12, @binary="f65b8f821bfcff05f077e2f79be7d4d22bc608d96ec1504879a8a715dcfe5fbbd02535bd1153a68e0a1218229b2299484e3e8c9fde340a252935b1d7e5c8fdabcac23d6fa3cfdc6cfaea85527764c1ef86b0f8a41c47748f1e183651f9f327b1074d96bc4bca3edc81fd090383cfb540c44e1dd9d9c283962e3ad44ce3541da645ed62b97546fd03a60cbf5a78dfe9e121048a02256c748c4a70c483954cf3c0b75b2a1d8e9a1612d1239ebb6aa0107d29c4c0b50ef89aed"}, @typed={0x4, 0x39}, @generic="d0f9d1a612b9e2d26afa62e9d55be26a3bed7b02a06acf78e6c689bae654b3d60ed32e556dd13b6e1de6a71867f6a89158b4d94aebdab47b33e2dc966e11dbc7ff50db7b5e5c63cbcc49e400553237a8a30d7fc7d5e177e26e7437c9b078a2536be2f97b76d538c9fc9e02236acce8015cd1ca8010b1184cb958"]}, @nested={0x14, 0x84, [@typed={0x8, 0x1b, @ipv4=@dev={0xac, 0x14, 0x14, 0x20}}, @typed={0x8, 0x1f, @ipv4=@rand_addr=0x6}, @generic]}]}, @IFLA_PROMISCUITY={0x8, 0x1e, 0xc13}]}, 0x15f0}}, 0x0)

16:09:45 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000240)='overlay\x00', 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="2c6c6f7765726469723d2e3a66696c65302c776f726a6469723dc96d5f569b68b7dd7682931044"])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  904.547530] overlayfs: unrecognized mount option "lowerdirkdgr=." or missing value
[  904.570905] binder: 5822:5850 ioctl 2270 200001c0 returned -22
[  904.576562] overlayfs: unrecognized mount option "lowerdirkdgr=." or missing value
16:09:45 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x14}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:45 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f00000003c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f0000000280)='/dev/binder#\x00', 0x0, 0x4)
write(r1, &(0x7f0000000340), 0x10000014c)
r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x7, &(0x7f0000000380)={0x0, <r4=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
fsetxattr$trusted_overlay_upper(r1, &(0x7f0000000180)='trusted.overlay.upper\x00', &(0x7f0000000440)={0x0, 0xfb, 0xea, 0x1, 0x40, "d7f50512466c2f7902707ab879a74053", "cf6df5ad6a66db3cfc86c613013768363f2944700890e588f7727edfa30137b85d5cbc78e92e44ed9393737012f52f30724cc5cb3d7e725804e93a92fb1f3f15e5f13eafa5dcc0a621dfa7b64c727c6f4484500114083cd4d632a207161f198bf3dcc00ee9393a62704439266f75ec4a0474eaac9f4e56fe6b5c80e93cfec988c5fa224d004833d952932e320e12df66994f9c6246ba3f10e8d2896bbbc9bfa7a7db86ee7f5c81667cc676d5e3e70dd9ae6b778607267a13a7c87ccf6c8d7f8c475060f73577cb49fbab257224dfee17076828c638"}, 0xea, 0x3)
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r4+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
fcntl$getown(r3, 0x9)

[  904.692179] overlayfs: unrecognized mount option "worjdir=Ém_V›h·Ýv‚“D" or missing value
[  904.735432] overlayfs: unrecognized mount option "worjdir=Ém_V›h·Ýv‚“D" or missing value
16:09:45 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
r0 = syz_open_dev$admmidi(&(0x7f00000001c0)='/dev/admmidi#\x00', 0x2, 0x0)
write$binfmt_elf64(r0, &(0x7f0000000440)={{0x7f, 0x45, 0x4c, 0x46, 0x5, 0x4, 0x2, 0x1000, 0x88e0, 0x3, 0x3, 0x1, 0x2fc, 0x40, 0x107, 0x4, 0x465, 0x38, 0x1, 0xce1, 0xa5c, 0x8}, [{0x7, 0x5, 0xfffffffffffffffb, 0x200, 0x5, 0x1, 0x3f, 0x4}], "0b82175f50f2c3c62c701388d052231032147c54", [[], [], [], [], [], [], [], []]}, 0x88c)
flock(r0, 0x4)
getsockopt$bt_BT_SNDMTU(r0, 0x112, 0xc, &(0x7f0000000200)=0xef3b, &(0x7f0000000240)=0x2)
mount(&(0x7f0000000d40)=ANY=[@ANYRESHEX, @ANYRES16, @ANYRESOCT, @ANYRES64, @ANYPTR, @ANYRESOCT=r0, @ANYPTR64, @ANYRESDEC], &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='mqueue\x00', 0x2000800, 0x0)
ioctl$FS_IOC_GETFLAGS(r0, 0x80086601, &(0x7f0000000d00))
r1 = open(&(0x7f0000000400)='./file0\x00', 0x400800, 0x17)
ioctl$FIGETBSZ(r1, 0x2, &(0x7f0000000300))
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0xffffffffffffffff, &(0x7f0000000380)=ANY=[@ANYBLOB="2c6c64690000000000300000002255b1fc382f73090c8378068599cb468c21361c30e5e8e4d863f046e1f7db0bfdb547790a5c22e7922e6356ea13659198d602372a80452d3e0f1396e4f6d0cbbf03052dcc333df2dae700000000000000000000"])
ioctl$sock_inet6_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f00000002c0))
getdents64(0xffffffffffffffff, &(0x7f0000000140)=""/65, 0x506)
ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000280)={'sit0\x00', {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0xa}}})

[  904.802173] binder: 5863:5868 ioctl 2270 200001c0 returned -22
[  904.916790] binder: 5833:5838 ioctl 2270 200001c0 returned -22
16:09:46 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x8701}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:46 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
getdents64(0xffffffffffffffff, &(0x7f0000000140)=""/65, 0x506)

16:09:46 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="2c6c6f7765726469723d2e0566696c65302c776f726bceae905b5ace138c9f3a9b647f4a9da28b62271ed61122703c27f236c046bebc1b555684d4a5ec11cfd87988d685bcd79d3c4d0f19a63b1dd7c731a900637b93db722b7b209c1af8ad5f293759b63793d226d16780e465e4ac80adcc2925188dd95d34b4ddd2abc2a6e903b35de8ab6afbcd03fe9b32c2775d176f12f708446ff1f57ad1301895cf90dddcbf6177fc7ee08a388faa9ed373b35209806f223e54d4d08b0b1913fee8047a40729b35a0d3885438a8b752068bcaa6121c3c6e390f314f48fc55771ffb6f1630443f6b9b343f0fc54e1eb5b296d9dac8b74152fe3440d6f716c5645beda3cc22ae60e29da9e792"])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  905.074013] binder: 5877:5879 ioctl 2270 200001c0 returned -22
[  905.089194] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  905.101452] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:46 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6400000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:46 executing program 2:
removexattr(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)=@known='trusted.overlay.opaque\x00')
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff})
sendmmsg(r0, &(0x7f0000001ac0)=[{{&(0x7f0000000300)=@llc={0x1a, 0x339, 0x0, 0x3, 0x2318, 0x0, @remote}, 0x80, &(0x7f00000007c0)=[{&(0x7f0000000380)="631e5b944c7be8023e8dd67c1066b5020ec260405eaef7415c308884fd17391b13ed26f9cb8bae385b777b75cdcc125bcea4023594ab091594148e45ae11a7f2a90ea58df78dc07919e96b3c9dcfd559a726db1c", 0x54}, {&(0x7f0000000400)="28964dd1eea64c6d79543aba6d7a18cd0ee512b45fc401e6915f6fcc0c21519d26a0919507b100eb94504e554842190312401f75ee1fc047e3d78f5fd8ca61e9d66b47bfc60479696cdb56773f348ed225124da5536fda2ef34202d2315458bfcd2ca8fb90f5809fd886bd749a8b9606e0789b6fc6873356bd81d80341fb7e15398e02cc6712469a5a0470d931fb86c695613e28d0c08422499b2bdd783967d15adb86afb57f014c45659554c6f5fcb9d4d199443f01d3175229080a6c6324f570d9c349ae1a4cb3c51bb5fe7d1726dfa142bfac1b5f7043b43cb0071ea62bb4e69212af0e48f39e79", 0xe9}, {&(0x7f0000000500)="e7e21459d63eba2c1b", 0x9}, {&(0x7f0000000540)="5cd07bb96833e09173d70195d5386bd3d3f4dae9537abeb2fc209e9141df9bc73fa9ecd08afd58f58d705c0f323f4e39763bfe423fc0745a1d95c2d0e9dc818cf7ae644c3e4c", 0x46}, {&(0x7f00000005c0)="ae75c0487674f9ef9b2a96eba270730513da80cef753c266c1527672ae4abf17657de9da937ea07c12f8b5690a2e20760e7fa630d1cb77b69eea18613d58b8b4415b3818ae1a1822562d3251a2019838e722f2ca7c16adf32b858a70ef5537ff89eea5c2496058fda62ac39e65ad085ae2fbf22668", 0x75}, {&(0x7f0000000640)="b134b7b865568991a6ae44da423004b8ef9c2cd7b5d9346ed0c4aa2c28cd514f35cd66e6a19cf188fa58e3638f19b014c3a15dcfb6659875c6e9064d346f8222ab306bdead8026ab5cc0a0aadced60a97a2b1006e31ce3d000ae7ea53ced6ee196551a470172000e2da8228e5918b7db2dd0e69b15ac915104ebd2dcff52a9081a3e34d7ebca89ef3223087efb8474350553f144cc0c37725f19b25e184ccda11677473e2e8c990952e4c8271b65cc16a17bc0f08b7c59a42a19ddaddb7a1000ecde05d6baa855c008", 0xc9}, {&(0x7f0000000740)="30bd60c804f4325b7a416bf9d4b64958d9f5feefb2b505fcb28cd70380a6e8f644e6828849a3c4befec27b4a4c2e41149d78549b00795b17f7257a3502de8ce7a60829ef8626ce424f6b36012d1575cb0d98ee8691f2de", 0x57}], 0x7, &(0x7f0000000840)=[{0xd0, 0x102, 0xdc, "0efe616c683153c62328a3e8b1634c40a119973787c073fc759e864e80b5e7b700f760db6654f845a1ffa17ef34089b28498742bd98cbd944a5d99f2f0b3899794d3326ee01342cedac382ff9ccdf38b35ef8cc6c9932363b4fa1ad09dcb85ba242517ec44a1c7a95f3f288a41e044b0bfbc25245e7f0f73f5efeac9eb1fc27cffcac1fde089b9a8e426a8c2e2a576037105be49810ac901394b1dfb15f14cff2e1ec64b14c5ea83d88d63d9bdb40e2c51327f18d4b6196f94ffc0ccd2e59a1a"}, {0xf0, 0x0, 0x100000001, "4a064d43dbbf157309bed9e0c83608d5933ef46694b5e26646179c89b4a90e5db31ebec7da9f870c9b081f785c662d24e625ba45b3c3438028ed02fae56367a8d320b652dc4a7eedb7a367bb416be6720340af0a7603407f443fe1a26eee9b07d7b749671c6eb95cb664f8faa7897b41d182ac2f26de5c4d4d5f475d813e778566443fe857fd7b75cf5f690e9ab13d529cb0b19095e905a5f25e3e590d6a012f8a53c077b62603d39712f0fd8849091c15eaeb5a70c1c59f41072e80bdf29a2cd837cdb6189747cb33fdefb661cb737fc07abed246e90c1b6adad30fb5d416"}, {0xe8, 0x11f, 0x2, "04f80e8b5788e74ef2b9621e95fe8b4f46163321f2170c9a74fb116187cf35062fe4cfa6289045171ceebf9bb0a1f0636304f9a5e3e350a33fe044998c9c0e9bd8a42c3b013f1a13e7c3bb0cfa024d0601f42ea5be0619e5156dfbb8c0f60dfff182a1ce5aab8e55a900f5a0097db033edb4e9838084ea58dcaf83d21b37a4bf75e480fbd6421000a7d08eebb108c8ed6525101c5589dac0083e220405b1175f22b8faadfbea488d9afff7555fe7dd00b32f31c3552503fffcf132ae803c2cb3d23bceacf050af403a7778ad86de3aec0b369f88"}, {0xd8, 0x113, 0x10000, "c2ca1a8b8d1c8bc1644bebc9b5ac4640bd90254d721b8e6e49073576d3e4fefe36c3b0eee7e83b2ad830b04bf24e329bad574eb4e2cac892a3781e43b95c0b5eba0b230cbc032c5df0fbdb2384b0bec0d8c8f54eeb73ea8d2060c559f923fa2d653d45c2dff941ef3e0f6360d7b1d4865b7db99edafccf221414ee8c13d6042071882d668bd9fe7f2fb69c612e1c9eeacf8417aea5b1dc9984c00b14123b8913b5eaf25913c2dfbe70656539614f4049298d8f588960cec8816f15f74c10e865c18b3d40"}, {0x40, 0x10c, 0x6, "9f1a59081b6156ce0bfee0774a7643178b45bcf59b18365966b30973f5722ec57c0e5541296ab3c708f9a756e531"}, {0x90, 0x1ff, 0x100000001, "3c56824fc02b4601419ff1d15c741962c66098151655db6fcd78e923cd1e03320cda693223580ba1c5df783aa8b3e1fe3484e3043f2f24f7616ac9ccb52302643ebe85c18b8b1caca650e4f4d0e3768742a75681a07522a33b750f6531bcd3096de0c4d4f609e23954903285164d7a72156df1abb5cd95e7d4428628"}, {0x30, 0x119, 0x8, "1a54927b4572264dfa90913d6b96354c82ba76aca7f3bcceca582070ad"}, {0x108, 0x11f, 0xffff, "0248fd27e475648ece739d4791848e6918455312dc93674a445a21c4020074c25b922d919dfbd6760de524b4ffd61853f3f34a79f9a5781b9c20b143628c4610aad285f1f2d63cffacc3c8afc93541963ad22aa858f7cf15a3a47d13faa89e81ee6ee1727826f3fc2ce87e6c5c6b6fc1ae3e99c945879ec4f37ce920be51b1b248061c045e26b791158fb8751f2b8e8512becf1075ceace1e97a204153030b992e3753854d563738336c70b6352e6151f8549dc25e0547f0ad909dd37bc4088040c5c3d22dcd93273c786eb0ee7e2abd07bc23476325e39bb60c4ebb9201a376634923c2d725779e38489e843ef56cb4c1"}, {0x18, 0x11f, 0x29c, "cb531ead"}], 0x5a0}, 0x8}, {{&(0x7f0000000e00)=@nl=@kern={0x10, 0x0, 0x0, 0x68000}, 0x80, &(0x7f0000001180)=[{&(0x7f0000000e80)="7def4a738365c1cdd51e59a0f4b89dd6f0773018612112841bbe", 0x1a}, {&(0x7f0000000ec0)="bfe12c662f7d5e2fe498d12e5f006fb3c7f27f72f912ce1a806594890d929030384b39e34aba8f6ae4351052523983cffc0e24af8d893b7b94", 0x39}, {&(0x7f0000000f00)="38e75ee3a6e1b2d83a8355bee09fd51d5a2ff293b3c4e078c515724588916b591e8860cc055d99c255f1b7c235e9769ef436a6dccf3f621b7ef87fcb4f98d72904c8e4cf97f5c2e90d6af29dcdd3bfdad15dbcd7aed0e2e972e81bdece9273a076202291edb2afa00cfb526c5a864e6583c271bef64061fb25d5aede84cbc8832c1981fac538130a43bcca17c78625d5fd4d9a1df898fe3e3ec608863d20e35133e6381fb3e6d35b7569ea196a37728892b9cb458e505f32e00c65c716e00640fc6c533185f5086d25c3b3", 0xcb}, {&(0x7f0000001000)="ba78d78c8c15592f8f30dcce0b6c8ab26e7be461c072beb9f4c77020f7447f0e340727552414bea2647f365d9723d22f7a6a73163b8344bf69b6dd1f2737510a952fefece635fbfad5a622b37cfb36fc3cf5ce9d917fd9c46eb2fdb6084881873e2f22cd52960e9c976bedfe4aaf914b8d1b1b08314e7b512dd1fdf071a5bf4cc5bfa87125503e58a30083d6b0793b92c73bc4f11c0e896119e906764742965fa80259ec404d1f72c56d701c7021183c70c885c51674c9906e994eaa230515bdff34f3e34eb05b163068a8051ad0", 0xce}, {&(0x7f0000001100)="b572d1c85e2679d8c30110f3d619655c5bbfe3d4b74a70ee8f7fbccd0ffd05ed7fd74d4ccde804b4a955a2e48b3fb4184ede80aa", 0x34}, {&(0x7f0000001140)="b724c21be8fe839c66d555227bb733d39a5f3080d2d7bfa9603d668aa291d92982a8e5f4a35a738178ff4ae7b1ca87d92053c9aae1fce59f05", 0x39}], 0x6, &(0x7f0000001200)=[{0x60, 0x117, 0x9, "d62654f0ad26a5162861052481e26193082a9cf63e515971593667c5cbd188ae16114cc1b2fe8be2487fe2267d692fe5a19ddf549ed72d5c9f00ba5a396c052e0917fda60754cb32f1"}, {0xf0, 0x11d, 0x8fb, "ff78bccfd301b9c68bb9b845aab8351b5f28dfa60b8fda64ff2ba1e6b32cacec91ce76729dece703fdd8b2e5a51e003ed39ba2e8a41e9305132fa8772f09624bac1defc1688d05d37ce174c269f911fa8bd12827964b6b7141480b430d4a00d97e0481695607374567607a7081b144fae18d32af85a8716423f03f744f3212d826390610f7a2fa93239eaa5577ac85f712cf0e0d91e60a0ab9152c3f1ae60b00602f72f7dcebdf0105174590e92988d5a59bc95817034efde17cc27fd5a6583ed330ed6d1402840ffdb7b00f126621a787bd0f5097e31e38a1e5c7bd2d46"}, {0x20, 0x1, 0x4, "11f690221cedc655deda8170"}], 0x170, 0x15}, 0xffffffffffff7fff}, {{&(0x7f0000001380)=@sco={0x1f, {0x1, 0x800, 0x1, 0x5, 0x2, 0x7fffffff}}, 0x80, &(0x7f0000001900)=[{&(0x7f0000001400)="f66d307a1c37e1fdaadd027335be62ac90742229f13e491e83158315de7a6b5a57f6303d31d849f368c1f35f8521118f5ebfbc2f93352f678217fcf341630614f03658bdd5d37be34f83a1099727563c2b28b611d686b219ec00fb5d9167b95de435ec4e66ed28f514e91a0f207554feb976f856f5c5653c04b4dfdf0c137f65e15805e21544ce8f60a345bab2acf53abe81af61e3c9a04e4bf18d994cf47dd9a41f5c34f6536f0589be", 0xaa}, {&(0x7f00000014c0)="16743fea9a9f488939940f069b2b1783d20fe3682052b04e964d9a916121b985da63f9d025018443379da83dd45acbb994361729b410325378270dbdd5746168d4b8f2fdbd1056a8b7cba7e1a267907054685ef28e9368320f61244a9f83dabd128f78fe95455ed6bb389c57e34908a23fd6605298c9ee5ce37027a25caa142fef2a8dc50d7b000f9bb128f2e17ec23286dbd71b187801da4c6a4ac7aaf6a2ffd03e6b141cd83e71027f6874", 0xac}, {&(0x7f0000001580)="a7840e593903db9cb7f487f0ed88a3e402b0fa", 0x13}, {&(0x7f00000015c0)="de637e705073a131d8dc77ad7b277a9beabbc0ee", 0x14}, {&(0x7f0000001600)="d6dd0776587ef0a72a6348ef5f45a80d6424af11bae43ba21ffc20e2940d9b30d8233d1ff466e2fd945fd1832866472cc2c5b6ff4e1008638945f4c036be8c22d6aa38a869dd1a9c7d4d92ca35a24efac0d3189671ba65fee86b926d6dc0734dd89eb2e2bde234f8a6779007f9d165e0edc2e1756a58c8f0b46e20680ed8722f9eb1b8285372a0ffd756509678d718640840be381d1ea06f8fb7614b9c111676d95307196678dd4adfd419b4647cc4b9a23176a285f6a94cc243d99550b688bdfaa2bc1944b7b66c", 0xc8}, {&(0x7f0000001700)="e31c718d6471826794977b34d84596f47552ff2945779130d20a309ece5c2dcdda01130a05719d815e6d0b51b5a152103cc763b93495905efe893ddae736ca7e", 0x40}, {&(0x7f0000001740)="5978c4ca1e6a7d6c6f27ffe8391c6b42942bae6ebbd667f60f645830d2a695aefa9b2b36b5a4d8524b18e9e3c6beab1e7a3146d1e52c544dca7f5cdf3aba2573c34002b6b64c27cebf72a26062d799c403f1407b86c5", 0x56}, {&(0x7f00000017c0)="e7ae494e5c0ebc0b64db72eaa76097875455da6ee377ff5a2387f56ff8eaaa426390fdf859fd1edf0e5ab5358a3836dac05288a4e7e413687985c2c6999c16efc67113fb99e9444eebd0a50d9b4f7ea1915a112892db71399a2d049a4a5b77f4675c19eb9161f7972a258b121081a3a944ff619a4f4540bc", 0x78}, {&(0x7f0000001840)="3f7a241079c91ea36db0aeee570d8f7f336fa86a8336984a89b04a29b567b086cc7189fbd15f30a261abedef569ab357c3e4d96059f26038a4cb5b3a1e046e67c9efa9e8808cff3d5a3b9cd4", 0x4c}, {&(0x7f00000018c0)="c2153fe4c1301340f4e7c72e859b823e0f38669e97c45ff64d61360e1ec0ab09234993a77bc7", 0x26}], 0xa, &(0x7f00000019c0)=[{0xe0, 0x115, 0x80000001, "1875ead6eb50c11c41d16816ef8c40a9c84e98e3ce2ce36aaaece3881891df0e42941bb4265d9749be2c1ce83ef4be09f30ecba885bd2e188941b5b9935d9e6852d3580de553d98a330d294d9e5838530215d7320380695a5c9226898387cb7e84774709ea1922634152265c0f7904a32367a8d57c81fa69d42736dcddb3668222a2819a50f813265da5c46ea6845c99c57f09817fef0ac1c4653161969999e785b4620bb2ffed2c0fe2579926285167334793a20a37b26275ad513c6f71089c8fcc525ba01bc13de89f90"}], 0xe0, 0x20000004}, 0x1}], 0x3, 0x80)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqu%ue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r1, &(0x7f0000000140)=""/65, 0x506)

[  905.296444] overlayfs: unrecognized mount option "workή�[ZÎŒŸ:›dJ�¢‹b'Ö"p<'ò6ÀF¾¼UV„Ô¥ìÏØyˆÖ…¼×�<M¦;×Ç1©" or missing value
[  905.308801] binder: 5877:5890 ioctl 2270 200001c0 returned -22
[  905.317749] overlayfs: unrecognized mount option "workή�[ZÎŒŸ:›dJ�¢‹b'Ö"p<'ò6ÀF¾¼UV„Ô¥ìÏØyˆÖ…¼×�<M¦;×Ç1©" or missing value
16:09:46 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x8}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  905.430744] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  905.464371] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  905.470828] binder: 5898:5902 ioctl 2270 200001c0 returned -22
16:09:46 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
r1 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r2 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)
ioctl$PERF_EVENT_IOC_REFRESH(r1, 0x2402, 0x8000)

16:09:46 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='overlay\x00', 0x1000000000000000, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
openat(r0, &(0x7f0000000040)='./file0\x00', 0x80000, 0x100)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)
modify_ldt$read(0x0, &(0x7f0000000300)=""/142, 0x8e)

[  905.550318] binder: 5863:5871 ioctl 2270 200001c0 returned -22
16:09:46 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x8000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  905.639598] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:09:46 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x81, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = socket$inet6(0xa, 0x1000000000002, 0x0)
r4 = socket$inet6(0xa, 0x3, 0x3c)
connect$inet6(r4, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x9}, 0x2c5)
mmap(&(0x7f00000db000/0x2000)=nil, 0x2000, 0x3, 0x40010, r2, 0x1000)
r5 = openat$md(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/md0\x00', 0x80000, 0x0)
fcntl$getownex(r4, 0x10, &(0x7f0000000100)={0x0, <r6=>0x0})
ioctl$EXT4_IOC_RESIZE_FS(r2, 0x40086610, &(0x7f0000000280)=0x9)
setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r3, 0x84, 0x12, &(0x7f0000000240)=0xcc9, 0x4)
ioctl$BLKTRACESETUP(r5, 0xc0481273, &(0x7f00000001c0)={[], 0x7, 0x5, 0x4, 0x9, 0xffffffff, r6})
write$binfmt_script(r4, &(0x7f00000002c0)=ANY=[@ANYBLOB="2321202e2f66696c73cc0a60ab51ed05df8e0ba85312a0187080fa4242515e54035359f38670106700c423bbaae6cf9f4b0d4620b7d34b273b0faf499d4208dbc3632c12345e217448ac0eb0da74ae86b32d11860888ea9e9ad25d8852f678a3ada658d3bf28cbd8fc757500f060228e4e3eb9065ec692effb7b672bb80ddd9b771998bd552b025a7921ca879aea20b94cd46c86d62cd0031946549676abe595d0ddd694602bd742d6d37854b26b0448a798b558298981bbdc3807d89e85ce637811d85b0a0e70503103b4e6ee31212e53bfa236d785b227096d0838c0567315c46573ed8cf834048fe9b140"], 0xec)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
r7 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r8=>0x0})
ioctl$SG_GET_COMMAND_Q(r7, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r8+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:46 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x200000, 0x0)
r0 = creat(&(0x7f0000000240)='./file0\x00', 0x100)
r1 = openat(r0, &(0x7f0000000280)='./file0\x00', 0x1, 0xfffffffffffffff9)
getdents64(r1, &(0x7f0000000140)=""/65, 0x506)

16:09:46 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  905.831312] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  905.846679] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  905.870988] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:47 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="2c6c6f7765726469723d2e3a66696c65302c776f726b8869723d2e6fe085"])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  906.124897] binder: 5898:5902 ioctl 2270 200001c0 returned -22
[  906.192277] overlayfs: unrecognized mount option "workˆir=.oà…" or missing value
16:09:47 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x800000000000000}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  906.237755] overlayfs: unrecognized mount option "workˆir=.oà…" or missing value
16:09:47 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x9, 0x40)
ioctl$KVM_GET_DEBUGREGS(r0, 0x8080aea1, &(0x7f00000004c0))
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
clock_gettime(0x3, &(0x7f0000000300))
getdents64(r1, &(0x7f0000000140)=""/65, 0x506)

16:09:47 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  906.378588] binder: 5934:5938 ioctl 2270 200001c0 returned -22
[  906.386859] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  906.408237] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:47 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
mknod(&(0x7f00000014c0)='./file0\x00', 0xa0, 0x4)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
fcntl$setflags(r0, 0x2, 0x1)
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$rds(r0, &(0x7f0000001480)={&(0x7f0000000040)={0x2, 0x4e23, @multicast1}, 0x10, &(0x7f0000001400)=[{&(0x7f0000000240)=""/25, 0x19}, {&(0x7f0000000280)=""/16, 0x10}, {&(0x7f0000000300)=""/4096, 0x1000}, {&(0x7f0000001300)=""/232, 0xe8}], 0x4, &(0x7f0000001440)=[@zcopy_cookie={0x18, 0x114, 0xc, 0x2}, @zcopy_cookie={0x18}], 0x30}, 0x8000)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000001600)={0x0, <r1=>0x0}, &(0x7f0000001640)=0xc)
mount$9p_tcp(&(0x7f0000001540)='127.0.0.1\x00', &(0x7f0000001580)='./file0\x00', &(0x7f00000015c0)='9p\x00', 0x40, &(0x7f0000001680)={'trans=tcp,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@access_user='access=user'}, {@dfltuid={'dfltuid', 0x3d, r1}}, {@msize={'msize', 0x3d, 0xe7}}], [{@appraise='appraise'}, {@smackfsfloor={'smackfsfloor'}}, {@fscontext={'fscontext', 0x3d, 'sysadm_u'}}]}})
r2 = gettid()
sched_setaffinity(r2, 0x8, &(0x7f0000001500))
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

16:09:47 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x5802}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:47 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
r1 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x40000, 0x0)
socketpair(0x1f, 0x6, 0x8, &(0x7f0000000200)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
ioctl$KVM_SET_NR_MMU_PAGES(r5, 0xae44, 0x0)
ioctl$NBD_SET_SOCK(r3, 0xab00, r5)
pread64(r0, &(0x7f00000001c0)=""/39, 0x9f, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0xffffffffffffffff}, 0xc, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[]}}, 0x0)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000004c0)={<r6=>0x0, r4, 0x0, 0x12, &(0x7f0000000240)='Rposix_acl_access\x00', 0xffffffffffffffff}, 0x30)
stat(&(0x7f0000000500)='./file0\x00', &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, <r7=>0x0})
getgroups(0x7, &(0x7f00000005c0)=[0x0, 0xee01, <r8=>0xee01, 0xffffffffffffffff, 0xee01, 0xee00, 0x0])
sendmmsg$unix(r5, &(0x7f0000000680)=[{&(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000000140)=[{&(0x7f0000000340)="18cd16b28ea896d2c8f03845188ac20a171e1fca2817882e7ed83ec658d156e43c3a575c719f7f53c14a2811fbdc6f27270ce44c7bcc2424fc2680f8fcb1ab8d3954e31b5be73aebc1d0d62e0848810a4136da691645f6e5e530e7abb54e0da3852b95c34bf180573f53d5fdd6", 0x6d}, {&(0x7f00000003c0)="559a8931f66f3858d8c710cff13d6213334adb0d5c716d00976d29047aa56c7a52d401107d8f112df396821c29a73ec46abac1960eea4a11577e6fb30d9a9edce57256b9eae09a76f2b2710596daec4fcae7521f943df6dec9924026d55ea4eecc2b51bacb778b65b5774bc7a358db9dff3550e57348aa21c9e0f1762fdeb285ccb621524d77af64ed5d336f475b65f9b0a425463421d1a70d05c953bbb24e0c7bebfb6b205fe404f0ae9851ac0e325362ccf86ab602cc036161b4d53469ac1de38d16d2bbce024b200a2e29662d1318ca358bab225c430793715d49a87554fff91c4e5f91312003e760d2", 0xeb}], 0x2, &(0x7f0000000600)=[@cred={0x20, 0x1, 0x2, r6, r7, r8}, @rights={0x28, 0x1, 0x1, [r5, r2, r2, r3, r1]}, @rights={0x20, 0x1, 0x1, [r2, r2, r3, r4]}], 0x68, 0x408c5}], 0x1, 0x2000c010)

[  906.660859] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  906.748359] 9pnet: p9_fd_create_tcp (5948): problem connecting socket to 127.0.0.1
16:09:47 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
ioctl$KVM_S390_UCAS_MAP(r1, 0x4018ae50, &(0x7f0000000280)={0x6, 0x800, 0x8})
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x3, &(0x7f0000000380)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
syz_open_dev$vcsn(&(0x7f0000000240)='/dev/vcs#\x00', 0x11c, 0x20800)
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f0000000180)=0xffffffffffffffff, 0x4)

[  906.807823] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  906.875313] 9pnet: p9_fd_create_tcp (5948): problem connecting socket to 127.0.0.1
16:09:47 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
r0 = getgid()
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000004c0)={{{@in6=@remote, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r1=>0x0}}, {{@in=@rand_addr}}}, &(0x7f00000005c0)=0xe8)
r2 = getuid()
syz_mount_image$jfs(&(0x7f0000000040)='jfs\x00', &(0x7f0000000240)='./file0\x00', 0x100000000, 0x2, &(0x7f0000000280)=[{&(0x7f0000000300)="e3129b620a31d92e6ff53b3d30140dad3364cd924d64c939124949872954392bf7218df37f0e184f4dda4d18118a1057bdb22f7d63fcee095afe9c1549afd03e71b6f1da5c19c20f34b924c9df6d93238860bef39de67335e1363ab95e3ab16d8fd020fa8d56a81cb18d061fd53814a731046f212f89056cd0307caf90b501154ec86f1dac0916bea7be842d6122eae5f0ed295f599b662600c4343f48", 0x9d, 0x6}, {&(0x7f00000003c0)="d7b7eb2af4e73a62bb3f992be8d6f2863fc615ecc6429e751e08e98aff7dd0645296f24b682e7743628e96fb53c2ea3467d9876aaaeba6ead60b822d44f50d7a6c9958ddd23a084596f8164c4c5c6c58548a4cbb7bcbac62b809349428d068c689d88cbf67ded825c141f9e6dc58e4ab6ac6368a9cf0cb0e02244bc6d9db2d83080ef62e7f2b63874493869386752108d889c4dc3fc0c81c835a95e4ca275d12bd479ecad39e6a0bf5ce1df803e76f619749b75034825ef82dc4525f0c4c803f532c0dd9f64fcfafe5469db7465bf297c81d7866808ba9d22739", 0xda, 0x5c91}], 0x20000, &(0x7f0000000600)={[{@umask={'umask', 0x3d, 0x8a}}, {@quota='quota'}, {@gid={'gid', 0x3d, r0}}], [{@uid_eq={'uid', 0x3d, r1}}, {@smackfstransmute={'smackfstransmute', 0x3d, 'overlay\x00'}}, {@fowner_eq={'fowner', 0x3d, r2}}]})
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
r3 = syz_open_dev$vcsa(&(0x7f0000001d40)='/dev/vcsa#\x00', 0xbcd, 0x80)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000001e00)={<r4=>0x0, 0x5c, &(0x7f0000001d80)=[@in6={0xa, 0x4e20, 0x7, @local, 0x200}, @in={0x2, 0x4e22, @multicast2}, @in={0x2, 0x4e23, @multicast2}, @in={0x2, 0x4e22, @multicast1}, @in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xc}}]}, &(0x7f0000001e40)=0x10)
getsockopt$inet_sctp_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f0000001e80)={r4, 0x71f000000000}, &(0x7f0000001ec0)=0x8)
syz_mount_image$hfsplus(&(0x7f0000002000)='hfsplus\x00', &(0x7f0000002040)='./file0\x00', 0x10000, 0x8, &(0x7f0000003540)=[{&(0x7f0000002080)="32486449372dabffec48fdf89c4048cebb938d3e943e790870c2beeaa9d1caa1e5e43ad937e208eecb738d083321f6dbe72dbfde339496465d1e4f481aadc2065d57648174df108064cf3aaf371bda75ed6a0cead49c000eeac29c0a0fdae550145ef302d5f3bd60bbc9d46bcc8749a81e02a2a64f24e27ccbc7a2b4f075555176623322a2dc644d6a274793640a0e035750bde08102852701e2e0f99eef495f957f5ec34b4cc1ffa048e121e3d414f507cd0a17114d41b1ee471ac40af2cae4a30c2a6298ed96c30349fb65aa882cd18490b99ddb08ca7a286b4ec72146b4f0bb8f864e3cad4f69b2838169998df3378ef2c3df30ef0508bbae67ebedb3d2f4d10f990fc1d0d07164da019b3125ddfd2d71d61db345a9567d202d595084c1208b843b62b3362504a10078664c0f87ad621795caf0dcec797531700bd0718bcc023005ac00b5362c6cd725f9f4818a277ddc8ce556990c2766276e860df664890b9438bb0f95a84e7575cc1efabd7c54152e65e083abc2423cab4098c744e5f967fd5a304db60078d3811c3a81edb4bf4b89e99918e8fa06c59eda948767402fa10abae2f003d0b85f5b8bd80e64b2640d8fcefc26182fe0548652b9065856eb225d1f5967ec53547a7436d44fbe893b1950e053f9e1409e18d5af80105c2e11a3c222ea54408fe8337056caf115b0f4fe279e57a8af7c3472b4ca5b92f23bdbad25b34b674a17c9433ad0e60dadea364deb5d3e2a8a02cdfb1cc61cff2966f3e0fcaeb3fd7d5cecd25d1942b1a52455d1214eac196b663d8380193fed18f6921cb3c3a7e339a19af4d80e2f1969fc8f722c0045ac67e46247445cb1a852d2bc6fe126c4120199f97063200ac756c51f1d99d2cdfa899d1910346075efc45f61394f089cc28b998db5c9b473babd1fcd2626dc8ec5e3fd5e9722ca37e843f31116af0a5d7928685ed5ff4d11af61dc2e9aadf48f7ef112ba7afc659bb2f4b5c7c30092a4efe478eaaa29f11e404f0075edc4046f7e4a691e1c1c29274aa410ff9e4d7283305e2fabc66069148b1f60866261a3a3ecda6891ca136af5b93a7445745deaeaa36aae1d7c54d6ad30a7e843a8b73cc499a8fb06115dfedbd9d8928d43784df52bc14d0516f78271a42bfbea83999a89bbc8f8845820243b896695dfe457708a5a69d418c005e9b3cce0508485df93f497e9415d495cc4fce3eb5dcd9f0b3cc1167cd9493c49df8dd7864fff2e45ffd90abc5816199ebd718e897650a459fc85041f8d3e19899aad857772c279cf1af879ae050fbf26d485e5458921fd2bd3dc44fc106935bc1bbeb9726b71eda39460f68550cf8644865b0813eae8c2d269042427408830471b60592e49cbf629e0154fb126b496eac1b9632648687348f552257ec33ca03957ab14fe645b8887e78a6b2a64f449a0f4f07ccc4e01901c4394a7bd92c7ec56ec785a6c9f81d543591102d34a03a4cf0edc0586930aa0c711a3b0ecfd757b47324e9a6214abdd24cc47d76c6066dbc67892cdd33d9eada684efc94bb12bf5afea15503a5b940683ae1939d69d47cd8b607ca508bbfea9382bfa3eaeb384971a43d2aacd22abb9fc49664c1949d5650365dfb73d7930fbdcf9fc5766a82b7332e16f16b3de4772f20516f06a5d11bf33c988c67b0a8e753d77fd311a49f9e7ce55edeee2d5fc4efe717f43285f57ad926ec4108b2fda521367a6628f7ec033a74e4db1cd320882949f638dc24051bc91bc0b25b990821bfec5a2a1e83fdc7e4b5e7c7682f46f8e4fd7bb3522dc5a5f6a713fef080f7a0a92e560b3d48939f497b2a35259fae9af84abc186ba780cc452f29e6d1033628168e748f57abef52c95ed4e2b06fc80cfa5368fee1a0b1a92a46f7cf2aa61b3f950a7fca5061726c645db04b12d59a0ff504a71c932dc7c3f5fa4a450c580d0f2f16e5283e8f41a9ca33990248d4b63b6e6fcc4a339b5c4e296f51caa3d5b662307f17527991f60cce874090bb228fdca9665b5c54feb014c986e6ad6ac92c39ee27c5f80c5831e16a8e6966816008f6e08310ee772779255abcb39d94caf74078abf87fb1c719ca18d1f454b608a5d1f51ed7163bba6985ff118ddd7271dd7617f1aa4831b015ada573e4282977b095235f63f51a6f8ff0252d144c100a4f29b622b1bb7458c12177a282ab25a79fd1e9ff3dbe503a3107d7bf2bbb63d42bcbb1889d0e8c642a854dfb24bcdb6db298b627d37fa1c2f54dfee4e5075746e6fc9c5f75c0eb156ab53e94f837a5705ea3be0db122609fb61c7ba3557d1002feabd43e5f22f5cfac8d32bd8ff10ef4655134b037026ceeb98e9aa7f3f17b798ec2bc78aadb1a1ae300c14e48f7ebfe8398af04ec9e18700fa26457a42dd4851d5a44f862f00767be0b037aebea4314199474dfcb6361e0c50a977258c9e2314a9c799036fbd9af70fac987e7606fcf7697151f10ca145f1d79f076dd783c4918639194e44d80be61acb40602e91b66e8fc966950b0ee02cc08da3df05be8d26f046c93228599aa0dfcd5840bf2696fcf3f00ce16e43179d3aa4853f39b5e134cc118546556b64c3d7b7ccc9a388e945c4515b7c16932917fe3a11ead8055d39f62851041f1f39f8ada03e6ac5d369e4fdbea1812d7fea0bb515c5293f8c8ad1107c20408ee6b043f0f87a5d88b0cbe9de6f69056baca769be1bc5ca450f4352c8bdfb94f8eae4c3182ed7f8ab4514386892615678c8bcbb41d47b91d73ae072e28a32ecf3cff9adc63f014a2c6f36e95126eec04f62ddf2bb3f54dbfe832501338ab5a07f9e2a38a9f3e307491ae987ca90c45ea6a9725ed9a6a1b528b362621b7063c618a6c0a5bebf14117889abc25b1d9fce1494c30c32b239ab37db237a0d7246c616d091fe42697439471bbe1c95f978d8199bd12df68b99911a0cd60b047eb094dd8bb5b33fc8c3cb8a99403e541efef7a91011fc23c9cfaaa0caa5c0a6446cffff319483f25679536d6f80678b2b1f9056c61838fa0071832cc5785b7f5feabc38730bfc23303eefdb990687efb070fb26918ac0c06bea3514c5f388a5f7f839ee31ef50bd9dcd1197fbea6dde2a3b328f151a39a3067d276e20b483012e89bd64291e680f2b24ff0c2e3fcaaec2654513fccb5a758075591b2d9e21a6940ce0f0ac5ca6c6e71754ebedca7a157f8d26c64e89c2225373221f00b3d6b2921a72104858a26aee8b3133e89c9ced0bbe2ca8a0a6bacc043a56eec1db8166aaa3cfce8a0fa3bd6960f750681cbcc25b6efcfc34dde1a7b98e01d86b3068e42efde795b392e1da8f090f9816043f7c5570bc35227d8c5246359a4e4f2ac6786d6c42cfb5f72bc86329fe3b563935890dd9770edf5e551196357e12fa9670ae555e47eaf167f706524131a9c2c26c4b8c4159004f1145a0a87077a5bdcdd29875f6c5678b5562778d348ebdfd0ab8da01730ecc1749ee8ace88a616f534e1952f2f5b52c80dc7d9e27142fbd704b142a2afb73c4f35d47dd455648b96005047ce03f32bc33fbb52efdefd0ae6177d900f99778d97151ac18bb15d632f3f933810138610ab12a2f1fa4c1f6833381c6814e9923acc039977e57f636b135b7e2620f8b1fca24e6cface4e67c525aa2ca7546bf331ab7dcae312445e7b756a4f4777fbee9a276d86d58ac1d71cc1f3faf8a88da49108126b877b4432c3fa791fb0e01c8962f6c83b4c6657ad24f91186e3173b80d692c229de010e61d95fd046a8cfd3ef489fdda1be86d07d99d1172b6a262d77e2bc1e5d839fe35b3d80cec6ebfb211fe4b503500d6473fa10e5fb22f0966ca0d67888782b4738d45863beb1fc46017240619b3c440322f515965cc00cb4c085216a0107c74b659d08733384112c5fe82a484c5805bbc330fd911df001b7ca2a85b68300263d24f2c2fd6fbc74884987a97ce7d3b88f9d49584e9c1ebd7443a29b2ae4b5a86e21ba401cb7394af2d24ebc593412c49ce48b91abde09418b650baec7fcc3ec70276994644650c0b3355b9f8d5243b1fb66304c46f080ced59dc23d24ea8fda49ade1d7cf98a68d131b9dece9aa7c5912ad781b5f96672b6e0cc42908b0943f87bd456fff7a783187e70a0be6367f933ef95fc9f51c92a217ccd0242581855b4d87a8e8ca39fb5a670ec32b749df8ec8daf7b7241c04b1c5bb757416142559643ffc2493bac73905dd93c55cda450db5545732b929948bfd6bd0f519fb6acd2798134f0ac070b156afbab778862075a097d0f60cae07e1152855f383b8eec01753268edcb64b666f87d31b5da18fb8d5acbe1f0cdb549bde797169ef36a71a14135b43e8d30324eedcf956ba8f2be981ab01d9245cdf9dcfaa90f9df22eb2e71900702192fc25d8447f91cfed824fb2cb6d3250ace2d6605a2bc2f2b5a813cf6358ca5f8cd92890e25bae6e4fc6db89266915150feb00ba76a6556aef822262d975188c76ddbc88232008667774ab628eee836b192c22cc9c7a18b688b01991d89d75d43445640a9e0567f891ac57101d24a36adbc532a3e80b9fcb3ee0247431c07276ec61702b38e41a4d0a9d8ebceef024bb5bc2908bcbdeafcf17f78251eab61ed3fcd9411893c605af2e407533a2f61b0507d8713143e2de6896e6e5a73d64bb8f2e91cb7a337169153b8c9c517570434ee9ed544cd39853aa3e524342c52f2445ae7eb18fbe59d877392fae74c4374b4b9b4d3ce70f72f1ff6cb0ba0afdb7b991c5c9de253ce2d457e94a336eaa4afd023f83fddda26e044753eea88cd7bd302fbf68565ea9e1d53eda8860a26dacb119fcaa979cd385f7d952056f49abe0a931cc4936f38dc462af9f0247be476407c46a801f48ed2fcecf633b611b8af783e7b16aedd602f819a608cc6214f708e9bbc4b41339a861438be22186a0bdfefc7302815246bf85f78876ba3a3722a9dbd10d548cdf37fd0d22fe9edc157933602436d3f31772d6e99505978ac04b498014f08f7b58e463ea2b30b39bc2ba4adfe53f0333d940060e52058ed27256b9d7fc5079ad26328ab3cb579122df5137ba7ffa5d7db2250fee214e8e2e9987395ab6def63d874dceaa772ee60127f6f827f752a663a7e3baea7961740ac3870d18837144db31ab9b1b10e6d64ca9a11338c966f5e9f55ad324df604e7c0258b9aefde509263df6bf80c8a94b2aa1d821ea3e492ef8846b69f0a0cb119d89fac873eeffc526309c9c6254dd51e961bfb7859ac0905863c77efebc51b2ed2c89bc482fc987cb4701c4ebce4e1c9cc56cc2677694ec45f59557cf9252bdabad09d2140c5f033cc8ec14efe70b981d13ad3b3552afcadcaf0040648597aa016a03fc9f7a5058a08f918b8d72461e28625ec01eb459549a195e4b5b7bd888c3b9e65eb4baaa72a61be4dfd24c332a030332c930c45ec1a5e50b4cd8bd68e54e10d075f315418ae94990d5de0518d0e0194fa60d5690200fd04e537dd9b8a319a31e11fe2fd0c4d8a68ac1228060471b4828429c46143cbe0ea214b1569c8228c219e56222b6bb41bd8eae7d6232a49041327cfe5c7c9798e596ce37baf757c0eed8236c868c851507f75c695d51861b9b41b35a38b8ddeb621371f44b9f10c094acbdbac51dbe6dfbd2ccc651abfa3fc4eab9ec089820e67429d603c557afbf09711ddb63212c89197a8d302297c107568db304e05696f6c98c4fc38ee953576577b4ff9fd2ce12c9dfcf10c7c0f8c58c6287e450e53d2ea288aa31963fa832206b487be2696d8e427ba2d73e9c5f2981b8e3d2b73cfcb865", 0x1000, 0x3}, {&(0x7f0000003080)="26ad0e9a3d18eba0dde3196fd75c45fbc744309929e934a15c20796be49ca2912c63cfbbfde60b79f334387eae8c5365d4eefdf63e32039e18ad9814280f33ba7202003fedc0c163f19956e008e8bf6179f9d3645c7f346d67cc7ccfccf1603d18", 0x61, 0x200}, {&(0x7f0000003100)="414565a1f97fb6e7001bbf2cef2df8c2e1d6cbd15c49a3a85937cb7c930e96fe2f81da22ecb961a8e58620ba07b4c8cff7ab279f27fd977d98b7d111be5ddc34a99eac108151972a5c5c24921ab0f5826b2dfc33354b011f00a103a67cc79366eea3a0e0d3b4171dfd4fc0302b32da48dd8c627aae254f48aab6aed8b0843067737980b2db6e9fe2d2be10cfae6223994a3429fb470c3354ccef32ba79c4a47a90c374e125800e61e2604a07f59ba11d479e0681", 0xb4, 0x7}, {&(0x7f00000031c0)="818ac432e7adecb202c505efec818414528025d83f90b35737500d4c33a2b8a0b0d91e82f880e547521337ed3b32c49eae66a76e3d711349ee36d031efece9a6e6697efd3dab82e89cd27a8dbe89e3c3fd628b6d39311afd09ba9c9ec7e52feb840495b7bae5613712eda572e645a04b083ba1b1abaf861e5d4baed3470a073ddbfcc443774d59ddcb30692f147cf53468aaa4f4ab6c649604d1702aba97e2e8aaa721a752ecc97e824fd08db5793959e191dfdb055b3a43b1a06860d4d7c26d7f9d2604a60f2f375cba730f0835b34fcfbe25ad066a38d02f71e4dfbdbd36e03c58c8ddb0ca6ccceb02", 0xea, 0x5}, {&(0x7f00000032c0)="b14351f33e1fadc7398af8c3618233191abf7a702d0f5ffe47e91386a9348f27b02d4cdd19432b5b35e570386863ed81e0c2a07a16ce50b660d1c52f0559f59d693fbf5f60c9ecb4b439e4fbd670dd894f438a87ad496f8fe9fe15628916d3db88c59e76a98f1f8a2efedd5c7a87c9cf7756c0a5b8e0a7516e8f8b9bbd2362ee221d4350ce0d706acd60a7722632610d6b2c3a088cb86eddbec4a8a7ac668772486491bf46194b3e0949e4bc485948ee87905836f0d1058f8387572ad6570fd7d7a0e48829b79adb", 0xc8, 0xa06}, {&(0x7f00000033c0)="de0a86355d306b0210465bf77c743366f5fb5136ce5e5952f1a8c006c40e2c9b5957a51749528108", 0x28, 0x7ff}, {&(0x7f0000003400)="49dec79f013604be9b875c53c18f44a94097df00817b50a7f61221b25e4bf40857fc8f890d249632be3d580c40ace094c05799f506c9d5c743f779329ce4045cebae3fca98c29325911e37", 0x4b, 0x100}, {&(0x7f0000003480)="1135c39ac65c2177d324f061d226b3cacd40e9c3f90c73985d9fbaad4c625b92e48f1deb5ee18ed949f54f9550590f17f75ebbc22d545ed43b0ca515c335156084a1ba9bda37c4e0c7b5da6aac1bd5a6a5adf0b49591524df0f045a13d412eb61eb896076e9f0c57ab7af4ca8a51eedac02c214e3d5ac1db146d8f5acaea60c988803ed9bd88374df18ea2d38d90a593a8de3e491b4d98d2793976dd42552e01ffc789666d9df46f6fb221", 0xab, 0x8}], 0x1000, &(0x7f0000003600)={[{@type={'type', 0x3d, "1c94a037"}}, {@type={'type', 0x3d, "c4b938d4"}}, {@uid={'uid', 0x3d, r2}}, {@barrier='barrier'}, {@part={'part', 0x3d, 0x80000000}}, {@part={'part', 0x3d, 0x3}}, {@umask={'umask', 0x3d, 0xfffffffffffffe01}}], [{@uid_lt={'uid<', r2}}]})
setsockopt$sock_timeval(r3, 0x1, 0x14, &(0x7f0000001f00)={0x77359400}, 0x10)
ioctl$FS_IOC_FSGETXATTR(r3, 0x801c581f, &(0x7f0000001f40)={0x7fff, 0x1, 0x540, 0x8, 0x4})
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r5 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
syz_mount_image$hfsplus(&(0x7f00000006c0)='hfsplus\x00', &(0x7f0000000700)='./file0\x00', 0x80000001, 0x8, &(0x7f0000001b40)=[{&(0x7f0000000740)="31c654b398eb61ef0a3d9482ff7ba3332b7bd9c9751a3e539a1db0139676e76cccd63886aae77e0ecdf5778e9a589bc963800bcba33d1c8279acafb33c5f09ed063d7beba22ab0d4450551dfd3f5ad1c0b11f70e56f2ed3032b720acd8b3934677dd01ab5523160553b62ca0947c4dd74083baccb13a4c3957ff7f961f681da6a9a71f90b07d3fbceb0189a16c000a9e4979937078274570bf8f0c3a7285c4dadecea31d661f233fd7f9031e7294d8d34f71a6e06dc541cea4ba5c3891a5ac5ea70f39e6b7fd4ceb68653de7", 0xcc, 0x8}, {&(0x7f0000000840)="1898645fba9b242700a61ed22fd4a68ded68cbad11f0f9de239eb807fa49574fc7cec7deda2418a6e7e739fa35aeb20a2744403f0947b0a3f62602f8cee9ddd06b713faae61d6b607e67ef68cc9385163fef75de7392e22f5ed5d5ccac47a48d24b09fceb871893411b9822f8e50a24621b86980bbf897b5983d3cdcd95158d36d370a582718a793e8da27b8985073eb7f7901dd941b09c3a3d91ca8a0c0e3765a89285e1e4aeaaf42ede0d8ba30950e07872d06f99c0f09b32b4838866d3280ab4f175b18e1ac43", 0xc8, 0x2}, {&(0x7f0000000940)="40c9fb1517117ec2b357014b60f15de6dc994ce64b87c71b8d89b2f809fadc27fa6abdac860aeb2814f21d5bcc09716456d7b08b9cb6f75e345ae0bfab844bb5798068cde7bdb2c8e97a5fb36a536e28d39ac75e1b7dc0d5407cdae514fa921175c72e4e5387ac4b528ee21663a671a661ad7594935b975f2df6551f45ca7d3f6600110712efa08aedf6f1d8d072730db800b7c7ac791704145895af2497a66656a37684a3112644c83d077f10b30f727ab53045", 0xb4, 0x101}, {&(0x7f0000000a00)="0da0a60b6c5998fa62", 0x9, 0x400}, {&(0x7f0000000a40)="293c6099b75478b2cc1c5a1ac1897576f96a2142", 0x14, 0x8}, {&(0x7f0000000a80)="9a89aa3c3a3c60b144a4af7fa64bc2461235353fc4e81e22d6ffeca01e328b16793465650142c297bce9464ac99f6f8b0b9492d8cf5f9232bd62eb9e3df3bc210600d04a7d97f3aca5", 0x49, 0x2}, {&(0x7f0000000b00)="5a3a0276b190f50654f04787b881ffa05bea5ef5fede26f1a8ae3da74dbe035bff248d482211453abaea9ef277c4f4b211b3b9", 0x33, 0x3f}, {&(0x7f0000000b40)="420984e3338e750ab5aa8c19abc180fcc1d446e9ba6a0963fa4657ff6571c1ad14c88b9414c408a51900fa20cc64d99d72f627b2109da96deff62e246b545fc829cd2cb07702b4be661999bff6704f49504ce3cf6bc16bf2ea70127dac037f17cec62b9283cc49ee692b692cd6772be75be12af12fe66ed019041e1bc110c0a8b549d433ccca17fbdf805d191bc45fa7165be40082ee0f86989855552c2e270447b11a663d31cdb6d8ecc13c989a7d61538d4248a8b33453bc46b91b5b1c813689ec35aa02deba01df8b9e7bd9ab0282ed131deb7b93c06fa8313c441eb0082834fb0586e9b5daa8a93ea82107c0bfbc69001604a76015eb2fffab92200571650e044da7ab1bad958b66a3af8f147a082056fca13f0098e66f0b823da54878775af52f27a866ef541973c7bfcc4c2f7376fd42eb477e1876ceed9bc17ee7e29a73b272029724983c7f65bd5c73bfdc0b147b5b0ec7daa82664c7c70e538acce6a97e4338efb08ce93151702484bef320a2bcbc1d6b543fbdfb212c20f383f142eb6f39c0a1537e14366fa894a06522e7ed7e86dbb2dc7d266d5a368e5f1e640894bfc4ac9d8bfcaf2da404afed27918db172457ee39815e1df144c5af4ec122f2e6fe75c0a3128ab4d2668fb23934896f80235d033ac1bf53d403de21f882aa9ceb05a3020b0d38557c65412440b50265bc0127ebb4f1adbea6cd6650b4d0b885bd88c21993939e44ac13169f40ba4ae59cb2553a87b652a2d7f1348b976f28572e08a57dc417649776412d72eeccf31f95a968a11065bed333f65706d0af47c327a59420fd4c73a88142756ac1dda5a5e686484b55088047571474bcd90b71e15985f8e9d3ce55ed1f1e173d0d3868dbaef68fea3f81486308950d695456c07e82d50d0e273f958bef641f885cc20633813224a5e4bc16d0a649314e9ff2d4cb41a2efede669ae34007192dfeae68b555788f2f6e097ee71f4022b0b26d3e6053dd04c84a2d877f0d494022d21fd36e1059611643780241af6b42290ce33cfddfcc35019a4ba7fa759b5959a77e304104b2b0dc1f2f376c1dad1b81416c0f97d875264fb08905f2c7aca86eff88af5e159e2135d4cd8cf52b04dd8d8576412d9b8e752732637d45b6cbfaecf3bbf9e09990cb06eb9db11e7bb3a931873615042cfee08040ebaf052cdc616d302dc75d7d497f00a325bff63a33a6475c1d82e85eab0f109f62e6136b1921d75f4899d875123a9e8f3523556a542f86bb494be183ea161064924d2df9f7491d23c5b9e2052b19974ffbe9c84559b8c0e068669415ab15ba6ff68740d2c8c107d3c50b41c81028f5d9878cffab08156db7cb94113398b17fe0faf2b0389064a66fa68de11c0ffb701c89eb83a0396a34a6c362bfdd4a1a026ac28d38b158ffe28e2fca297b66a8e7dd18711555ab29b8770c86c501c85f4d681bdf6510225c09a8d3f9c10a1df30ae8c66ae50713069d5b12b7ddcefdfb2b67fd78d91b93ff0020cd0c3a2fd05ea8d44e58bb85f3ae19751e65c790f3c1ecb7bf2209e4cfc6ee3cd85d70c43f7c9ccf5ac79a7102416cba3bb62336096a183adc0a0ab86b9c9b5300ccdbb384ffb88b058d13937e61da4d52cd0cb9ff6916e0057f9bba7d2b5d728b7a443b1a752817c080806d5f67b6271741eb5d5e6e286c163672dc6db064ddbac2c4fc7a30cb0af7fbfdb21a138f978be421d9279fc632bee55ef08c7ce6413e594f009b965477f58023398966f9ecdbad760f6ce0dde316e2a979e232f000c6279bd30094784d2c2f979d446ce8e1bb7b7f43aa64864e78fbb21c6ed82867dfc1db3d90f8cd57e602fea532d20f76e7334c9e0fe63e387045782e4836d9bc2f80c8372f143fa4693f28455ebc0ce45ccaeb0765d2f9f37c48cd56df4c5697a65f697a41cfe01cef2b3fb60051075a4c6f35e6eb8e2d25d54d8e461a7140f56a9accc1583e3fe5c6d1350e95f92111952e676a29ac321b094a43df8d6a55964733669c850655b39224fb4e64aeb393888fa7421c9ab514c7c5ad5dcfcc98e4ef75be35dc5e114d2b0c70a582b50c8260a321700c8acf2df10b6616d3f273d730645a3313c62efc561450b21f13372f8c20dd3917acfbe7c5227a1b82a689bea5beb3a228042fd8cdde280332a21258675b3d46e9ba036fd46c025f5f4b40aeecfc438f6ca03d0edb77a7bb32dc90f4fbf0f574ef10d9c74a963b8e09d942b504c84f5c9a7f02c723f3e6b1997cdc9d1eee5e1251317e0131a2f08044404a3baf864651af4daf1165929d798098c3621e6b6032d98e38fcfb543c611309f9db540d7a53d9f577f390ba54a24db7cc53ad4868c9bd84a53d5ea0edc80e9619ef1dd05e38c9d2818073c4d0378da7e073fb0ec35a5e71bd14d59b09ca1552ea8bf0f853e6bfb96a0fdb6237af9e3b87d49a12abc89ff498ee5736c4dc421d080d4e3c57a56fc516d5bb059ee477ad3fc6a53c1e5a9d2aa6337cf1cecdde7c86c2a9d15cf7af40c4bb684690d98239cea000911b11105170450f3fba95b3967fcc1b2b58b777b4c5fa6bd11f1c73efe3cc930ed66b2e33d2fbf339683437181dce4d4bf1910b4388ce486dd0c4f403c51d637ad7bc3c776219a9cc6dc8e3897ca3c4b9c25ea6ca7fab31c94035ed2d2206b72ecaf0b5369b280d18ae0c52a9ffa324faa9f12aa7e51ffff9fa6f342280e00ea0ac8939182ee83908e99dd92773fcd3757f97ddfc280f7c86e64b851b7a76b909d7c30ac3c5fec9411bb083e33e86d26488042a3f8eac3f1552091b1cad36fb26de3e75ecde3f5d6aa85121df31f26e66d30306dfda5fc08d445ad5642f9e3cb6a68052a2e01f1fffe42c4fcd4387f90cd9a360f2dd39577740327b91100e525014789264558b8115a35fa61b1dbd16bec6f870229e9c517fe53d4ac018df703c9c654246e2b606d1e8f20ee7c61431ed41ea315d2f280f43eb88476f47aaef2a85093e062b4df1c288526a7ec26bdc161d00c06b5030f7d1cf9f6af6e1e3ff0100ab19aa3954183329a0802ddc0f03fbbe3790f24477a0b4d4e0e8e29dfa93196f9801046e30b63b88034877d884a95efd46083cdf51dc1fba8219b5c492ea3288d0c95cfe5ab16c072a8cd0572afc005b8710bad42b9067ba9b4847465df233966293623b89017b77651315f701447679b834ece06ffab20cf608ee32de3ad62f9187ac1c3800ae5653f0ef534c6e9bee7052d32254e4f03671d32f403e95bd6638141d07b3d461415585661d0107a537d332fc7430edb8c4419b2defb7cfc18666ec0911f6d2165b285b53ce671cc7e20c2a591b9dbba5b65f9f4ead6c514f47df14d890ab19de10ca05cd31f17c4b21344902c19393819c0b8b391fc2fdf8282d5131b05f70b2678336eac3fd0f57b9775fdea5a42637509c8f64fa6f1dd966ed6a63ee38b009e90bf906b1ea4684ab7adc89d2b69d86ff7d070e953bff811b39be6b55891e49e79e0b9559884cac912f9a48072f23f1a1f458aed60e59c7f110bdace2e1443e730c4547ea6a589b24c10979813b83fbebac8893f606a2f0ffb3d162d51978e34fe51d7cea0654ba6e0c8db0bb99bfe6fadb6e6b660d56465ff83318d1eb95ffa0ba5512b613a21ec29077a3ca47c8266a5d72329c1927e6e4acc0113cd19b9609e620cc1f5e1ea3c58d46c669d2841770308c8af20a1dc24734ae0b793b9d9fd1052de2d5a6782af2a8d1f111e82259108c5c15dc844190c4b4999e8e42a836e04226a9f63581c4f09850f0ce02df56efb1434eca3339abbcfcbe4295ab760e295f8356782b5d5ec3984a9a8cfe7c9c91307a40b1a015cc8ee98007d6c37925d86afbc97a71511c82dca50f9b4d5beee95294ed79588a4c58aad9d49c1f624c92222234bdd90917fe820302238396181f5cefe2427e84c73425c578a937760cff332360189f659f3707f0b0b3b1383266689be20fd538dc8b37698b0a6d05c61187abc595620db1cd70b2074461534f9be9019b70a847398056f3b22ccbc33f8c7d736a33e18fa19e1899a0803683a78d12d452aa5a354d344d3a63ff6980da6a6120e0d760a60b339907d05f5d2cd311a5356e216b63df6307c6d9a4e64964af95f27917e3297863f6b00dcf7cfa6d787b6f1660c6f7082adca161e7a0193a7e4a0512b5e6fa1bb8e755dae050512c6ec8ad31c2ca7aa53dd871db45a6dc8d6697feac322deb3700d7ec419b6a44153164a31a8c7769794ad30d566f0c00c3711f3d57ea89b043c4b8897e79c256b2e921861ca4dbb36f0468e5f23ad48c7f241863a0cd8802304110af982f47be75890641b89b172180d9f572463ad2fa20d172fef46a5b81ca0c268070bb2d5fa7bb693582d3ee2affc28b1c95e988a0c75ce030ec06c8446bfb8acf74eeb0c6aeec14106970d6d18f556f7b6ebaf91ad28dab8fbe58ff14a45ac2fef5fcbe507bb5d9cc86ee2da6050366b2d9bcf45ccd8d67b7eb81c48a256fdaaa90206d0db4c221c88f933fc90e252407edde6a13045399488e757e69bc9670a30a336bb88a6b0bd5f71dd2a9414f66f2ce167df022329bab83d73bf46d4d0fc983c46800ed19c2adda3074bdafeb99767b8444a12557570d9a4f0d3b5a129bc3db584e62f075b56e078b24356d3f83fa1e2af0d07f116d77ff48023977084f0271f1b7701eb09f591440e355901ac118855ba86d96e084d0bb2aed34a35c7e040e9396c0e472665f784df4a8da74e5fb1d8f1d7af1c9de9ef35cdd062881c58d401880a0c0244bc3726a8a8f7890c10279ac64bcc5e10f752909d675099645202f1ff22c803a288d9e9491dca0dcc34e086302856202619e62e9fbde7475b66ef63a0f43f7b68e022794c8fd0b7b628dd75be3ad9a31358bfc7023e06826bec588246112a01628ebf3e9aacc9e0ad0d4a374b44523eb8cebac58c3dedcdb5737512c425002c86709ccef3b1a587414e96e690ecdaf830b3cc4be5aed21a59ca646f77fb119a1c76e6e6046166637b3fdab7c7289e03a7ac724ee853fed54955dda6f7b1c3e48bf9e3ac9c3a7774f792a4818ce44d7b5ae4c8c422c1a55680603b4f0a0bd9efb849e5c3393677f776ad4741a93593104afbd4a01fe376d92fd6475dfe6d0631250fb43ce0f4d0b9066b8c814a4ffc5d987eb91fb6cbbd089405931c16ada46cc23c811412b564ffe098b5b011a13fdf2381df7fa165be8c75c330936c2a941cc37e3725113fba1ff914b587edbd69fd8e77b09efd834f9954bd77b88229199ae429ffcd242b236d8a22c7f813e339f4ca5e744f2fd4e266108c6d061c52ffbfcb812d9d9ffc8e2438d30f3468810dd697f538b90796189321fa409db76c28fd04b9acf0388681245ad8985b10b8305b2e955e3edca03acd7dabe301635fcf4eb1071e4f698c68f54476373575f9e4fdaf3437575be30f58718fceeb118bb5d9962897c00ffdb05efdf8188f891c515f6081eee6a6eee791a3a462dc27c83cee772b7486f376b77f08c1c8f65b065e2d08a5043450886555a93d8a97f85c3af64339c2c7450fdd592a2c5b4d92e01baca9cdff2fe75ceb3cd03181ff2c1fe856352b06beca2f0d0cec279c327b1b3731f6a2b3f50573b7c678cd164d81f9bfaeb9c5ae5947f51c5ba97c584df44e773a8246ba8d2484b487cf9d14c71adbe6ec8d9447bd6ce9e2aeaaf1129d2e727315c9b1afbd5b8733d98b1836b038980c66c6ca7e8548e84ddecbff600ed8810f4c55c470bf2e4f08fd00a36ade6c4ac9a2e9edc3e8eb9690d7c", 0x1000, 0x7}], 0x0, &(0x7f0000001c00)={[{@umask={'umask', 0x3d, 0x4}}, {@umask={'umask', 0x3d, 0x800}}, {@nodecompose='nodecompose'}, {@part={'part', 0x3d, 0x81}}, {@session={'session', 0x3d, 0x8001}}, {@decompose='decompose'}], [{@dont_appraise='dont_appraise'}, {@euid_gt={'euid>', r1}}, {@uid_lt={'uid<', r1}}, {@uid_gt={'uid>', r2}}, {@hash='hash'}, {@smackfsdef={'smackfsdef', 0x3d, 'selinux-}ppp0%vmnet1systemw'}}, {@smackfsroot={'smackfsroot', 0x3d, 'overlay\x00'}}]})
getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f0000001f80)={0x9, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000001fc0)=0x28)
getdents64(r5, &(0x7f0000000140)=""/65, 0x506)

[  906.953829] binder: 5959:5962 ioctl 2270 200001c0 returned -22
[  906.996069] binder: 5934:5938 ioctl 2270 200001c0 returned -22
16:09:48 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x1000000000000000}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  907.148880] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  907.200890] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  907.227705] binder: 5966:5969 ioctl 2270 200001c0 returned -22
16:09:48 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x8}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:48 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
openat$pfkey(0xffffffffffffff9c, &(0x7f0000000240)='/proc/self/net/pfkey\x00', 0x2000, 0x0)
r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x40, 0x0)
r1 = openat(r0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r1, &(0x7f0000000140)=""/65, 0x506)

16:09:48 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x101202, 0x0)
setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f0000000240)={0x0, 'veth0_to_bridge\x00', 0x1}, 0x18)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="e185b212b753706c2d9c9a488aec98c68f8eb7c8c9005653c2ce10b90c95c9ab1ea9c677c924ebc88749fb3d7acc04758c21ca14bd85b6724a144d300b406217f58b6490a3c3523dab642ed5b68ebc4bcc60b9e41c95f282f569dbce023a9a826bf840494fb7bd0c60bdaffd31b1df29d75bca97e927b1fff0ea45b81dc8aa5f45fe82516d86e5f582d50a1bddcb", @ANYRES64])
openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)

[  907.550283] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  907.568852] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:48 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x10}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:48 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r1, &(0x7f0000000340)=""/39, 0xfffffffffffffeb3, 0x4)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)
r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x200, 0x0)
r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r2, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x805fffff}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x30, r3, 0x108, 0x70bd2a, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x7}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2}]}, 0x30}, 0x1, 0x0, 0x0, 0x20008040}, 0x4000)
accept$packet(r2, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000003c0)=0x14)

[  907.712459] binder: 5966:5971 ioctl 2270 200001c0 returned -22
[  907.724006] binder: 5959:5986 ioctl 2270 200001c0 returned -22
16:09:48 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x7000000}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  907.772501] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:09:48 executing program 4:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
fgetxattr(r2, &(0x7f0000000180)=@random={'trusted.', '/dev/binder#\x00'}, &(0x7f0000000500)=""/196, 0xc4)
pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff}, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  907.848898] overlayfs: unrecognized mount option "á…²·Spl-œšHŠì˜Æ�Ž·ÈÉ" or missing value
[  907.880651] overlayfs: unrecognized mount option "á…²·Spl-œšHŠì˜Æ�Ž·ÈÉ" or missing value
16:09:48 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  907.923334] binder: 5996:6001 ioctl 2270 200001c0 returned -22
[  907.975564] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  907.991842] binder: 6000:6005 ioctl 2270 200001c0 returned -22
[  908.022296] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  908.073417] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:49 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x1000000000000000}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:49 executing program 2:
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x121100, 0x0)
recvmsg(0xffffffffffffff9c, &(0x7f0000001700)={&(0x7f0000000340)=@can={0x1d, <r1=>0x0}, 0x80, &(0x7f00000015c0)=[{&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/133, 0x85}, {&(0x7f0000001480)=""/157, 0x9d}, {&(0x7f0000001540)=""/77, 0x4d}], 0x4, &(0x7f0000001600)=""/245, 0xf5}, 0x40)
getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000240)={<r2=>0x0, 0x4, 0xd0192ea01ccca2b8, 0xb76a, 0x4}, &(0x7f0000000280)=0x18)
getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f0000000300)=ANY=[@ANYRES32=r2, @ANYBLOB="2900000057a300a22f58845be13f4d79c1ef57f69869554c483e96da5436bd8ce84052dd383b1ff60000000000"], &(0x7f00000017c0)=0x31)
sendmsg$kcm(r0, &(0x7f0000001f00)={&(0x7f0000001740)=@can={0x1d, r1}, 0x80, &(0x7f0000001dc0)=[{&(0x7f00000017c0)}, {&(0x7f0000001800)="4b341c274a373300d7574c1394c2e772206c1288cac059a47966bc5fb143c2ce9063db1fa75f45490208f4d311ceb2d01d978af39283f09f0511e5116b34f8bca34674143f38df6b518502e8c4d0b2fa938875c635eca33041211b7648cf", 0x5e}, {&(0x7f0000001880)="7f08785212bf25a0501ae4bb1e915cebc996a9267281f8c1f056315bd94347f26ccb0729b836b855bb0734ddca7b5cd0e10d0475cd81ea3aee15701848ae2e4b94bda21b4f555acffcdf7953dea54d75ae846ec9325d3cf634a104adf2b4ed3879", 0x61}, {&(0x7f0000001900)="38e64e268a2dcce21876c7fa5460707568123bf35ac1dd19be4c73d721b27c920baf130a4851833aeb0542a3101ea5172aed7f292f16bd248280d0b87290d8f416b578e5846df46d00616a124c2d8cf8e51ccf2e5e5395a2ce537a1082fbf40e7cd210f8e9d3eafb4c8c4dba282a6aad5e270e49585bb6a22188bf66e743a99d58fab9c3f0da6d5b66727388a7bc0136094c9cf108f74cfd1201bd3af59f6a529a7d47f3945fc6db76a57c8a1dcad5d90cf6dcbb93d20f4e96ec9396854c01a266bcd1af7ffdb7ee0bd775f8d296a263f34f1fe007bbf71e228399257b415303f81fee7020e3984523648cf982b81943", 0xf0}, {&(0x7f0000001a00)="0614aca65f36d5a458cee61c3095d2ff56ccce9f338756c6ee5542d5cb2950c898d130aa56b04784466f259a498064b63516da37130e9202ed240dffd225504585e6a7bfb9d53f6d01559d34e891755d7a0edb7d00f5265981c4067ed07078876ddd86488593906cc506e605fd4afd511253f870909055da1506e01a5fa1537bf90a979824d895b66c67188bf041dfc49f8da528ab0e174627e7602e92", 0x9d}, {&(0x7f0000001ac0)="a979fada0913", 0x6}, {&(0x7f0000001b00)="a5cf0639690a24f43d1b8b0ee48421294d7e6a2aab3ff7adb0f3100a9e4435df653c72341e55f8e4af67e3de00670a2b2179de849206c1e3959068ece6c87abb6de6d5db425fa1a4e2ef7fc8d01d16219a41763fa62961108b972c670b1ec50b01fa0b2b03adfbee20f967c4f192c16eef770c8eb28d93f0adfd297976ce4932b95d6c8e02e1a583a0060e75d10c176553749b68ca6b9fa44b86f280c13cde97aac7294f277f2041", 0xa8}, {&(0x7f0000001bc0)="9d5e22b51b86c4676745ce6b911c128870b4e35ed368e3f6b7b6bf9e119ba96861fc5a8bc026775c6d0f85f0abd330112fdc032dfbc78372250fb55dc34b8dd2832a1a38c78a0d2fb5ddc108f4b64ac9ab2bded0b9b8c054454858c68b176d68da6b7dd70ad531c7ec5638398248d2be5a625f95a325418ce6fdbb37e1819aef5d97ebff5e09cfe9d15c2c9f5040650a0566bfcef26ecb17377f4cc9b2bd02ebcf5e5a5122786f1cdf27de50a99c2fec91c98d580cc0049310bcee1df56f5273a30d87a8e2d6d6d31821df698ec13047feb1852947bbf019734b833d12ed64ec3551ebc71bc95cc05fdd21c2ad3e982430f86a3192a6a6779387b9", 0xfb}, {&(0x7f0000001cc0)="e3cb15e54e35604fc40ab1a9c48534ed0bbf3173037b8301a2f4fc394524385fbb460fc67bd1b3153eaf1f077f57704245ff18a881a1fae6c0c0dcd2c5ba07860b4320c2dff15109c7559776543b446b0a47a7c3971b8e65bff5c02b3a3b16cf334bbfd1846094bf3690c5bdcfc6a3115ff3fc6bd743def0da2f11e9a84b8c7ab9634fb03c749b84", 0x88}, {&(0x7f0000001d80)="3a78b5417819bfc7f24d57677695c02bb020cc2cf66811181dade7b6539d5df61885f542ac970cff941b03f6f17f", 0x2e}], 0xa, &(0x7f0000001e80)=[{0x70, 0x1ff, 0xffffffff80000001, "11e842660d1f490af16d1ac318f6a40e4865bcb04ac09a74ac790c66d2a35551d3fdcca734029e3702be7fc5a59cbe61f44e0f8bcbd41de61ebde8c96758b44bd734aa59375b5bef0d5fa4b3a62d55cfb0c434726afb0e31a68acd35d1"}], 0x70, 0x801}, 0x20004814)
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
socket$bt_rfcomm(0x1f, 0x3, 0x3)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r3 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r3, &(0x7f0000000140)=""/65, 0x506)

[  908.391988] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  908.456267] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:49 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
r0 = geteuid()
r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000500)='/dev/dsp\x00', 0x121000, 0x0)
getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000b80)={{{@in6=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f00000004c0)=0xe8)
syz_mount_image$msdos(&(0x7f0000000280)='msdos\x00', &(0x7f0000000380)='./file0\x00', 0xffffffff, 0x0, &(0x7f0000000540)=[{&(0x7f00000003c0)="c83374d674538135ed7b2d5b15827c2ac7df233622bd86a8a52b77e7d1e1aad2c35a41909a81b33c56528d9ae515b0442332f2e9598e71549201c76023e4bf419cca84ab63981ba945fcb44446c86080b3d02b137067697b74e36d0727d5f6c6dccb24a64c926971f8f07e2a15291b0451e1da2a01adaa20442f4102748eda041edca70b17f26081feb979a2696676d828cfe4b6c37fe5c1578226d6076d9f751583226ca311dd4fc04916b357cb55a70aaf49d4c4d232dda547131c89454ca5b0c80d36289fcf43544e17069d35ca87eb3a616c8f18c722efea02bc73cee979ee866bbbe18fb9cb3045e09f4d", 0x2a6, 0x2}, {&(0x7f0000000840)="66163a4ca67700a67d56a8a8c6b918dc409ac5e9ac791820e12bb0e12919e5bdb93de6383bc7d0c1fc899099837888f5bb5250da2d151ed4a0299868f700f18fcfc3c82127aa8004d2990e8a8ba73431c21badca5c2250314463f4", 0x5b, 0x5}], 0x2, &(0x7f00000008c0)={[{@nodots='nodots'}, {@fat=@flush='flush'}, {@nodots='nodots'}, {@dots='dots'}], [{@fowner_lt={'fowner<', r0}}, {@dont_appraise='dont_appraise'}, {@smackfstransmute={'smackfstransmute', 0x3d, ')'}}, {@permit_directio='permit_directio'}, {@fscontext={'fscontext', 0x3d, 'staff_u'}}, {@subj_user={'subj_user', 0x3d, 'permit_directio'}}, {@permit_directio='permit_directio'}, {@euid_eq={'euid', 0x3d, r2}}]})
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r3 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xfffffffffffffffa, 0x0)
ioctl$sock_inet_SIOCADDRT(r3, 0x890b, &(0x7f0000000300)={0x9d0, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xb}}, {0x2, 0x4e23, @local}, {0x2, 0x4e20, @local}, 0x4, 0x4, 0x7ff, 0x5, 0x2, &(0x7f0000000240)='veth0\x00', 0x200, 0x0, 0x3})
r4 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x40000, 0x8)
getdents64(r4, &(0x7f0000000140)=""/65, 0x506)

[  908.556278] binder: 6000:6005 ioctl 2270 200001c0 returned -22
16:09:49 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x1000000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:49 executing program 4:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/nullb0\x00', 0x4000000004002, 0x0)
openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000380)='pids.max\x00', 0x2, 0x0)
fallocate(r0, 0x0, 0x0, 0x100000000)

[  908.666278] binder: 5996:6020 ioctl 2270 200001c0 returned -22
[  908.758289] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:49 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x64000000}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  908.805195] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:49 executing program 4:
perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
shmctl$SHM_STAT(0x0, 0xd, &(0x7f0000000040)=""/3)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000280)={&(0x7f0000000000), 0xc, &(0x7f0000000240)={&(0x7f00000002c0)=@delsa={0x28, 0x11, 0x11, 0x0, 0x0, {@in6=@mcast1, 0x0, 0x0, 0x6c}}, 0x28}}, 0x0)

16:09:49 executing program 2:
mkdir(&(0x7f0000000040)='./file0\x00', 0x3)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = syz_open_dev$mouse(&(0x7f00000000c0)='/dev/input/mouse#\x00', 0x8, 0x8000)
r1 = getpgid(0xffffffffffffffff)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000300)={{{@in6=@ipv4={[], [], @rand_addr}, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000280)={0x7, 0x3, r1, 0x40, r2, 0x200, 0x10000, 0x7})
bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000440)={&(0x7f0000000400)='./file0\x00', r0}, 0x10)
r3 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r3, &(0x7f0000000140)=""/65, 0x506)

[  908.984202] binder: 6035:6041 ioctl 2270 200001c0 returned -22
16:09:50 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
r1 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a})
r2 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB="2800000010005fba000000000001000000000000", @ANYRES32=0x0, @ANYBLOB="0000ba170ee5f86f0000000000000000843cb6c613a820c7a15e5e8a92e0e20b1d92b2bdb20a0fb8095cdea93dda7e74b87f5da5d9a2eaa4475f449a50dd598554"], 0x28}}, 0x0)
r3 = accept(0xffffffffffffff9c, &(0x7f0000000200)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000040)=0x80)
connect$bt_sco(r3, &(0x7f0000000280)={0x1f, {0x7, 0x3ff, 0x1, 0x6, 0x1, 0x3}}, 0x8)
ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000380)=<r4=>0x0)
r5 = perf_event_open(&(0x7f0000000300)={0x5, 0x70, 0x1, 0x2, 0x2, 0x1, 0x0, 0x6, 0x8405, 0x4, 0x3ff, 0x8, 0x2, 0x8, 0x44a, 0xd3a, 0x2008, 0x3, 0x6, 0x3, 0xe7, 0x100000001, 0x3, 0x2, 0x5, 0x8, 0x7fff, 0x80000001, 0x3, 0xe76, 0x1, 0xa691, 0x8001, 0xfffffffffffffeff, 0x2, 0x7f, 0x1ff, 0x100, 0x0, 0x4, 0x6, @perf_bp={&(0x7f00000002c0), 0x4}, 0x30394, 0x1000, 0xba, 0x1, 0x6, 0x8, 0x1}, r4, 0x4, r1, 0x3)
perf_event_open(&(0x7f0000000400)={0x0, 0x70, 0x8, 0x0, 0x1, 0x6, 0x0, 0x400000000000000, 0x0, 0x8, 0x8, 0x1, 0x7e3, 0x6, 0xd9, 0x2, 0x2, 0xfa6, 0x8, 0x3, 0xf6f7513, 0x200, 0x1, 0x0, 0x3f, 0x8, 0x1, 0xfffffffffffff2a3, 0x6, 0x0, 0xffffffffffffff26, 0x5, 0xfff, 0x9, 0x200, 0x7c5, 0x7, 0x80000000, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xffff}, 0x400, 0xf6, 0x4, 0x6, 0xfffffffffffffff8, 0xffff, 0x9}, r4, 0x7, r5, 0x2)
r6 = syz_open_dev$dmmidi(&(0x7f0000000480)='/dev/dmmidi#\x00', 0x4, 0x2a000)
ioctl$TIOCSBRK(r6, 0x5427)

16:09:50 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x700000000000000}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:50 executing program 4:
perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
shmctl$SHM_STAT(0x0, 0xd, &(0x7f0000000040)=""/3)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000280)={&(0x7f0000000000), 0xc, &(0x7f0000000240)={&(0x7f00000002c0)=@delsa={0x28, 0x11, 0x11, 0x0, 0x0, {@in6=@mcast1, 0x0, 0x0, 0x6c}}, 0x28}}, 0x0)

16:09:50 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="2c6c6f7765726469723d2e3a66696c65302c776f726b6469723d2ec8124b53822475a0668d6738af6668173e8f324cad67da920abacb6e08bdc56560f36f39c3a5c1433e903259b932bd02d4d277533b64eb5e072b29f721ef438b7db4d7efc2c1e1833ea8c6b4704fa25704544e2110cbf2fa286b4d40834fdcb7334cc2858bf234567ab9553d015d33402754885557f0ac778ccfeec082ff2ae63a30820711dc"])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
lsetxattr$security_smack_transmute(&(0x7f0000000040)='./file0\x00', &(0x7f0000000240)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000280)='TRUE', 0x4, 0x3)
mkdir(&(0x7f0000000300)='./file0\x00', 0x4)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)
mkdir(&(0x7f00000002c0)='./file0\x00', 0x8e)

[  909.102894] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  909.125525] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:50 executing program 4:
openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0)
r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000640)='/dev/vsock\x00', 0x802, 0x0)
getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000007c0)={0x0, @multicast1, @multicast2}, &(0x7f0000000800)=0xc)
openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@text16={0x10, &(0x7f0000000180)="2e65f32efe0a6766c7442400008000006766c7442402000000006766c744240600000000670f011c24b866000f00d066b88044a2b20f23c80f21f866350400d0000f23f80f0766b80500000066b9080000000f01c10f0766b8010000000f01c10f01dfb835008ee0", 0x68}], 0x1, 0x0, &(0x7f00000000c0), 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe4000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000240)="b8010000000f23c00f21f835000006000f23f8650f280736f3f00fb045fd640f01c80f23a4f5650f22c066baf80cb83ed53580ef66bafc0c66ed0f01cb670f225d"}], 0x0, 0x0, &(0x7f0000000180), 0x769)
write$binfmt_elf64(0xffffffffffffffff, &(0x7f00000006c0)=ANY=[], 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000680)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = socket$inet(0x2, 0x200000002, 0x88)
bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e21}, 0x10)
getpgrp(0x0)
getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000380)={{{@in, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0}}, {{@in=@multicast1}, 0x0, @in6=@ipv4}}, &(0x7f0000000480)=0xe8)
sendmsg$nl_generic(0xffffffffffffff9c, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000010}, 0xc, &(0x7f00000004c0)={&(0x7f0000000980)={0x3c, 0x17, 0x4, 0x70bd2b, 0x25dfdbfd, {0x1e}, [@generic, @typed={0x14, 0x13, @ipv6=@mcast2}, @typed={0x8, 0x7b, @uid}, @nested={0xc, 0x1a, [@typed={0x8, 0x0, @uid=r4}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x4000)
r5 = dup2(r3, r3)
sendto$inet(r3, &(0x7f0000000080), 0x0, 0x8000, &(0x7f00000000c0)={0x2, 0x4e21, @remote}, 0x10)
setsockopt$inet_IP_XFRM_POLICY(r5, 0x0, 0x11, &(0x7f0000000880)={{{@in6=@mcast1, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x4}}, {{@in=@dev, 0x0, 0xff}, 0x0, @in6=@dev}}, 0xe8)
sendto$inet(r3, &(0x7f0000000180), 0x0, 0x0, &(0x7f0000000280)={0x2, 0x0, @remote}, 0x10)

[  909.211588] netlink: 8 bytes leftover after parsing attributes in process `syz-executor0'.
16:09:50 executing program 4:
r0 = socket$netlink(0x10, 0x3, 0x0)
bind$netlink(r0, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x100040}, 0x3b)
preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x78}], 0x1, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000007c80)='net/netlink\x00')
preadv(r1, &(0x7f0000000480), 0x100000000000018e, 0x0)

[  909.263177] binder: 6035:6043 ioctl 2270 200001c0 returned -22
[  909.345137] overlayfs: option "workdir=.ÈKS‚$u f�g8¯fh>�2L­gÚ’
[  909.345137] ºËn½Åe`óo9Ã¥ÁC>�2Y¹2½ÔÒwS;dë^+)÷!ïC‹}´×ïÂÁáƒ>¨Æ´pO¢WTN!Ëòú(kM@ƒOÜ·3LÂ…‹ò4Vz¹U=
]3@'TˆUWð¬wŒÏîÀ‚ÿ*æ:0‚Ü" is useless in a non-upper mount, ignore
16:09:50 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x87010000}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  909.413399] overlayfs: option "workdir=.ÈKS‚$u f�g8¯fh>�2L­gÚ’
[  909.413399] ºËn½Åe`óo9Ã¥ÁC>�2Y¹2½ÔÒwS;dë^+)÷!ïC‹}´×ïÂÁáƒ>¨Æ´pO¢WTN!Ëòú(kM@ƒOÜ·3LÂ…‹ò4Vz¹U=
]3@'TˆUWð¬wŒÏîÀ‚ÿ*æ:0‚Ü" is useless in a non-upper mount, ignore
[  909.509323] binder: 6068:6071 ioctl 2270 200001c0 returned -22
16:09:50 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x700000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:50 executing program 4:
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
creat(&(0x7f0000000140)='./file0\x00', 0x0)
clone(0x1ff, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
mount(&(0x7f0000000000)=ANY=[@ANYBLOB], &(0x7f0000000100)='./file0\x00', &(0x7f00000000c0)='ecryptfs\x00', 0x0, &(0x7f0000000280)="3551cd5de31f9ecfe97350c599e969766e35515d9a6d393a5d245dcc170da11336651abe42e2c1ff04000000fbf90f866e8ff8b8cf186302aaee84a1e4de5b6eae81c14924900ab58f371729a8d2c293db06a5622da734604739bbd0e8d6c21fa545896c13c4bf4612f418071f9df9520923ddc978f37ba51477c09f69e58c7a87c3a85bb40d7b9ce604ffbe295102753c11ada3977a29bb4e857f714f47f61e60aa8c6bdb817b48624e7048573878be85ad89fe6db64dfeaf28da1cc1af33173531f856df49b0dd8dfb1f5d38770997a6a409eccc2e641896a3bf160053c0b232da82b2ba5dd251b95db2c6d8fa31bcfb19")
add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f0000000380)="38fe", 0x2, 0x0)
setsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000180)={0x0, 0x0, 0x6, 0x0, 0x6e}, 0xc)

16:09:50 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
sendto$unix(r0, &(0x7f0000000500)="a3fd359da8ae7cf65dbcbc1b185784a23c4bb18f0269c9d963f642141fd55a667e65db976b0c68638a4f0cea70eb6622844eea455aefd32736d01aaaa08981c55d22a4f07c42376497432049835122fb3c41775c737e3bb7372132692c5994143b65a208028a42ebe73f3417f3bcabd28f9ea025e2444cebcbbfdbf24e587c65b3ea0ef5ad6dd4e2087cb4487ca5255de906e3e69495f33d42d5677baa3a94656b4d4a0931d12bfe1a8df625d5fc8007f970263e40d309e2b1051227cef6c2b58660b663417759752db0543de6ccd6ff62c539782b715ba1f548c2fad0f77ba0c4ed151dc9ebd390fcf79b5c0e3772793cbe159c03de3f147a3f663455b1593426be50b80948bb79b6aaa0b09f6b3198760ad7c8a74f79ebff1a82217b0cc7be65e10cf5cd929b239295b444e9f126285f7a9e19fdbb3ae0b6c6b3f84877168f19a53d2dd1d8a4ab16f892fc2dde31477acd72474781968686a80f1243abbd6f3cbf915413a6cafe3cc21366bfa713e9523cc3d5492adecb413e30e08f7f8c9a93119ecb0c1d74cff2dc9baa33cb0030f6052f2d23d09499b5be824fba25e82953f55d4fab6cb722e0d3deb063482db4b174c345ad74da92a79b1f94c31022053bf25620416055bdb05e61528926d0f09a093e4e4c7ddfef63a4ad4fc745aa78065244755eebcea9c45cef17f974018721edf78aab7ca71e19c8f4669adb1178bbd32e82a40fa760d492e2374d2b682681e53c887b85ee43ac41d657b9d852dab5c09e44c285df6ff86cd3dee90bfb6164fe44d35e1d38aee35549ac6fa2a5278eb14ae9d95d649f1ac75351062a1cb06b3148f88112dfe8e3b0596efb79a8d444b06a1bf5c477f44342c3286ac84df9baee4f93bedd7f2df57fd7333c1a0d914f2ed32ee2b18d681a4d29a1ccf5a210e97d57f8badf44ab9f0d863b33b5905e539bf5ac6f5a342cddd50705a1dd21246acb51d0cee724ee43123c0b0af75c691a537cc5cff060c2d2dcb212516fe3b2a4dc1838648e4c207c8b50afab058b84dba8ffecbb2160e86c17ed2af4eca2937fea39d90a5228107f2bd79a518eda6dd56cf7285cd77bc1ab10edc9621be30be9e2126f55aef25966e7bab12e10e0ee8638487d00d5fa1cf4007fbc2390d7b59fef38c9b61e26d4b7ba66a3d565acc04e791c0ebe31ad34a67eb258e3e11ce1e5a44e4dc81872dfde81fba803605f436fbbea51413c8b95938360f8d92d121edf1c78126a6faf770ec5643f343286b3dbc7e31c26590011c3aac3c12462426c0cee47d0ea1c91432fcd467219e285bcb527ab29d05e8a5ba3320ab41a65fc0b2bc6e23d2d06e1bbd4ede84ab15e4c5ee4fc1f647698e661b15779fcb21de1aea5dd28c5efadbba10003bc4292dd0a76c342a72455d85d3ffd1735847bab36828a0ad623bc4fbb16a6ef66a850dc16f689dc3ae446c27409e35ddc3be27f438be198b1a49d3769225dcaa4b0da85201ffd400253cfaa6ba2b7c73a43d7fe007bf8c58695fbdfc55dc1a1504701cd09de08e46497b584c7eb31a7d26018d7edcead4504c78a6550c7fd9ae54c33f55ad8b51426f25d6f794672c1b949d46b86e028ac4466d72f8037d76adb1ad12c07c8df7d613b984adea8e3e2a34d4a3093ebb1209a423a5e08e4670c563364ca8ad01e56d8212e4ebbac0b821f4c9d3593f0eefe202d3baf476e0bfda0062ec23a41bc96e1d701a5fa24fd97155313ff57074c3390dd41f6c6dbe0898ab616c0af30dc790b0a777d16d5ef2aa4883734edf3f41b3b62049a84fd4c835269390b0a891e7fb6467ef17c98ecadf40785710181c1daad08cc6ab1b81c2069e7333fe85dde5e5e8095fdf93cff10dcf520bd38c5fb167866e11bcbe72d0877e5496383dc23f8b142b75cc83275aecc4434a46188c841bd6fe9de954617094123eef244c23aa56e619e0527fbd7ea644867170044bac8837ca14fc8df2d2c72e759b55a0d19712a443cd24c75385726feaba9e1a7b81847175abf1f9662498678b3f6f0e265cd2e5974e893ae6319653a1481ac70746ca4a03aa12e9a2d072b22acfc7803acd94f616ac745dbf16cf5793341e1195e34a94c46b01c09e961d7498699b233ce3050b63742088985a44baf18582cbc1f244af52709c145a2369dbd6bbdf0a21ba0440cc08ff6272f57386ccf3617355000bde44c5fac5086d4f8a666d1d0e57de13f23a1b2cc6310961c1b0514ee8d3b07244e2e509ffa3fbb526fd22a34fc07a33ace3f3f5ac8fe638cf29180e60de6fa1b6e9272726e21dc561c204a9aea65032604325ee879a4f44424a3317d255beb4a0b98082884c57b9b3ecd8836fe84bc1b53270cf180a668704ae65a3053d2a0062624022f0d17889e28ccb487e98b1daffd9c22aa503d34a99e50a0c49e276995b9bec4af91494866992f6f5961849b5f0110b3e7a05be650ff8e33dda1b0f13f2691eaff1c45cc87c7a63a09c096bf7041962558ffeb8daf21791a84645369738b1540266f96dcd7af79a3294b13f7457844e3b6ccc8c1823af3ffaedfa03bcd80bc08fd0124cf5d662f0978d3cc31d8be894784aae89b280ca5bed81c190dbf8119678daded9b4c33dbb545ca0746129ccb44268f24e4448aa3bf1d281742053e69c33ca74c51cdc6fe9b09048d9d4099600e0b5e1c16e4dc8d21cb5cc5120cf26ee31704990ddb77638b8f5c84b96cdf0991452794a271bbfc064d3114fd23fd6ef2f41f881d4db9ad6937544b83e2be82ec34a5bce3cdd3cc2d3d502a498c99dc3269c1597f5898919463ff4396cb34bee5c0877bad90ceb02fb3132908180051d89215cccecdaab4e940f712da357cf8dd6037746bcb327087e1c2d8ded7ca00b5bbbb48720662186afce93181c2e773a9ee8989fc16ec3025139eb8b7987f1a727de3d3f3e42f376b035ab8f09d374701e3ef6e1a4991a71022d608757d1f6fa5506e0cbfe5aea557f1a74d6ac4f6c322f11352384b658c087164ef513c39a58c8ac8c5c2a1af47946238c85c4fc6cd5feb6bff84be9cfc15d159054a818df90d5e913315bc4aad5e07493d0436ada43b46289bb629e18c5119ca63a8079a30a88b84e3e71143e6300255d54ecb623cc9baf2831510de3993771e4e67f17430f45b568113ffee1e6718a253504dbef8c4ac0db59da3fbc90fbabeeb8da1633de76a860317ec5e57e62d37d0455b3f0d4359397e3d18b305e43c129719005a7e28eb77c0139497e7f8706ddf88dc74edaa05f8f0f2115602dd092453c73a81ac223a38d1f095455b8a87983917b9a8330212d9ca24f27262140db34bf7172e22461e28bbf5e2efccb1d1b99579b71444c8a43cfbbbe15fc929bb4510c0f5da37e99288ef2ae7c408b554855c35ca801c5c58528a48fc94aff573037495dc0bcecb61103b5deaeda674e99d8bdd090ad47db7472d5c216108867a2156fd85501532e833c3e7ea0596d11c20107644d3df5638b0682771b50304591a98db8d35257871074451db0e79439804bb8e0151833c53786c65ef8d0feac3ddb56043bca20fc9461b91150787596c3e78586caaf4820fff2974d3e864a5184134f342ca310162e157cbf6c51d3d38889579d78347b2cea85a8ee661c524489bb76c21b8a6566c5f77498aa2ea65dc4cba1efcf9676da9b6e662bf45750f9eb1a051180a81c518dfa798cfa75ca20b208d8174100c827e929487275377ae73a9986d44b7c9ff83edae011df9c9c513edc6d3a8688325731b84061618ea1b540c3cf4b5e4f29a3f2c466f773300b2502cf311cd240cb2bacf2b84ee92fec94bf21308fc78b025ebc306120ac6b9f92ec88c1bf4487206463b6c0e4c760d08360c724db0ea5f6a1ffd720ad7b84a653c2276e7a15b9411e3708b02eed8244a9d9d4f3d1cfb5ee2cd868d28af9deb173301e2eb0de7f8e93864fc4572a159a023d0e780f39d538007f3e63ab7b91966faed9000567e93ecf4e6f767a93059945b87ef87ee0877a3084fbb597c04c9ddc79cec052b197c526421fd1b4454b2a524c8da5c8239e1d1f3accdd2c0162ba3476ef6fc91254ddafe961cbf4cd48c98b5a3398edcf239f8f93fa5281e0e4be71b523174e13162cff774e0bf5720d6d3e966b50154558bbe5e450c194c72a272b48d23f69de8e60573095038e2da480d659c230b40ef6a2bda75c40d74ba43cf83e16bca1c40405461e77fe771d4f0743e3f8981f52b32048f356554d3552c618d92413ccdcc46b8bdaa466f9e87aebe68b1b852f27026f5211ecd76ef944d0de8287a5848f0791629fae2af8ab82366398afe673c231ae01dfb4ce64a087276c134462c53d2f38b30701b57f0babd738092c81d367bf705f43837d3762374f1991615f0d97244cb1b75b5aae68cef8dbb7cfc2fc2cd2945987fb31222ccad1ee49c20470776bbf0d01c21a1ba24bb44e57b6239c6c327b0bc566113856911c5204a1d101124a507a053cd8b8ae3339383d3bf532c8787ce2e6fbd6a624286b31fa485b1fbbcc2357444a7cb5fc282402355df3c001eadfee51aa21fe03e7d542df31e971b4d71e8bd6ffdec60eb69b7781b4eaf81e63fc44210e89de13b990462051232ea7851a620133c7c6cbe70806eca87f620c06786e40319bda29f39feea5cc28576ff22e0c54ca3bc09ed5e98fffb3176d0f81565da2f0ded7643b2522ec5a5f2b0ae29601b890a995d5811a9823381f616b33d1289a37af20f3a20fa95f7796a78ca8cda757f3a25ab9a6d118fe85432eb38541251a99e6447d2a3228e9e680a17bab661aa95c425b37c6cd0eecb1c13e45af7c3e3b757d85bd48bb631757cb8b85aaf1b96b4bd0b44dffe6d4c0fd20b1889c7ad575bad499053c1fa3070d8ea6ca9daebf02b8a02bf15e7aa7bf90007eadc8db5e1421667e28b65c9af1a5171624ef9ac9402daeef46cd632f76781fa8a54456b2862981bfbabd3840aaa902fe1e4b6373922cf3fbdb80e836b170767877537afeb2c2d88ee0f30250e91c024de06c6da90353cfb98ebad9e9b0e670375e12afd56895917764cbce1796bc54eb7104d774c59177fc167b8f191b7479a1de3b2b99681dddeee89b99e3cc3704ec35d6bfabccf121979bdf988ab4d4a6cda9ec0aef942f62abaf8a7553a09409c22644f7d0d3459281d6b38ddad8d06a42d319ad45df67c0f2e26f22e0435f770e6d7e62733fe0e479318470c48fa93b234af5fa453cd87332eb8d097846200ac7d5d54e3230c0694d580e07d772da09bb896ee736ba33eadce6c33cb479c41087ea6cd5ed202e3d18c9ecf4b451254183489feb502f5165f570631f77d1478931f2f5ce6bff5ee22ff2e3f5758c9fdbdb768b2e5a6f78d3282436b2e28f0c803234aababf393f88d4a7150547aeecec0438c05acf532551c3a153fdb92b9a68250e7cae86c5376ba03df0435fdc71a4735f7d5908734f6f8bb5b6b1af6a4ea32136e8ad3ccd2fd4a9c5f092768c3ba900f2ae350fed68db5b9b3bce3e56ed3c16bfc7e85fa9dfeff181891a7516b80109538c929ac1a22cf6ccfbd67a35280b7535792b65d688fd9673fcf7462862b0e2323ea70cbaef11e82b413dd03c2640c7dc18ad5238ef332ce9cca5f7fd894ece4d16fa68cc1714e6679a36f1bdf38b8556ff8990830c9f1293b3d229763af2562756ab11529db3fa5175401c0c1cb0c73e4a59469c0015a3e56737e075020911ce6ddb3426c3e7f75c12970c731b36a669154a31130f94d476aeee72828f8b3dfb1008dee0afbdb18b03a006fcc", 0x1000, 0x20000000, 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)
stat(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, <r1=>0x0})
syz_mount_image$erofs(&(0x7f0000000040)='erofs\x00', &(0x7f0000000240)='./file0\x00', 0x1000, 0x1, &(0x7f0000000280)=[{&(0x7f0000000300)="a881929e9e3b268433f8e5f9032082b3cdac5b406258da2ee583dd97e93c6896ed77fcfa895edea107f07e3be6c05c4d2266a655ffa40a0c80280a758eb2bc4b89cbfccb3eccda064197706c070cc820bf18a3d119d6b6cc4cbe7e38c37ca688328b2bb60939e7", 0x67, 0x3f}], 0x402, &(0x7f0000000440)={[{@acl='acl'}, {@fault_injection={'fault_injection', 0x3d, 0x34}}, {@fault_injection={'fault_injection', 0x3d, 0x10000}}, {@noacl='noacl'}, {@user_xattr='user_xattr'}, {@user_xattr='user_xattr'}], [{@dont_hash='dont_hash'}, {@fowner_lt={'fowner<', r1}}]})

16:09:50 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x3f00000000000000}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  909.610057] ecryptfs_parse_options: eCryptfs: unrecognized option [5QÍ]ãžÏésPÅ™éivn5Q]šm9:]$]Ì
¡6e¾BâÁÿ]
[  909.629908] ecryptfs_parse_options: eCryptfs: unrecognized option [5QÍ]ãžÏésPÅ™éivn5Q]šm9:]$]Ì
¡6e¾BâÁÿ]
16:09:50 executing program 4:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00', 0x200002, 0x0)
r1 = openat$cgroup_int(r0, &(0x7f0000000000)='io.weight\x00', 0x2, 0x0)
write$cgroup_int(r1, &(0x7f0000000100)=0x50, 0x12)

[  909.648354] ecryptfs_parse_options: You must supply at least one valid auth tok signature as a mount parameter; see the eCryptfs README
[  909.662160] ecryptfs_parse_options: You must supply at least one valid auth tok signature as a mount parameter; see the eCryptfs README
[  909.681541] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  909.689402] Error parsing options; rc = [-22]
[  909.701975] Error parsing options; rc = [-22]
[  909.707272] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  910.000842] netlink: 8 bytes leftover after parsing attributes in process `syz-executor0'.
16:09:51 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
r1 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r2 = socket$nl_route(0x10, 0x3, 0x0)
socket$bt_rfcomm(0x1f, 0x3, 0x3)
pread64(r0, &(0x7f0000000200)=""/39, 0x1f, 0x0)
lsetxattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)=@known='trusted.overlay.upper\x00', &(0x7f0000000340)='/dev/net/tun\x00', 0xd, 0x1)
write$binfmt_elf32(r1, &(0x7f0000000580)={{0x7f, 0x45, 0x4c, 0x46, 0x7, 0x101, 0xf85, 0xe37f, 0x1f, 0x2, 0x3e, 0x8, 0x8e, 0x38, 0x334, 0xfffffffffffffffa, 0x200, 0x20, 0x2, 0x7, 0x3f, 0xff}, [{0x6474e551, 0x9, 0x8000, 0x7b7d, 0x8, 0x2, 0xe8, 0x80000000}, {0x60000005, 0x2, 0x9, 0x1, 0x5, 0x3e80, 0x8, 0x200}], "3be95eca60f3b58276d7d6f344383b2bf21161679e74472c", [[], [], [], [], []]}, 0x590)
r3 = syz_open_dev$usb(&(0x7f0000000240)='/dev/bus/usb/00#/00#\x00', 0x80, 0x20000)
bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000280)={&(0x7f0000000040)='./file0\x00', r3}, 0x10)
sendmsg$nl_route(r2, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f00000003c0)=ANY=[@ANYBLOB="2800000010005fba6f3e8eb41d06a02d9602e30000000000000000000000005ce29c09a4656698634eb253aa10d2aa4d7d06cb9e25a154efde5414018989db845feb4cdd1387d6df890243ff571bc80b6902255fed11e1c863480926f2259faf8733c78b5d886bbb9892cdd475dfefdaaec8780c574f635d9fc62aae6657d5e808c8bcad0144d3639aeff7d5adc2bf7bc45912647461ab6ec78598a8edc7d031fce122c4e0e3bb1fcd4efbd38bdb", @ANYRES32=0x0, @ANYBLOB="0300000000cdd90f697ffc6a5cf33f9004000000a800000008000b00000000040f600735afcf61a67d215f0e5764951790373a3384b2ae0250ca3c667b9deff4db3c491a9f378681ab0f7a2b743fd016"], 0x28}}, 0x0)
lstat(&(0x7f0000000380)='./file1\x00', &(0x7f0000000500))

16:09:51 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x200, 0x102)
getdents64(r0, &(0x7f0000000300)=""/214, 0xd6)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
unlinkat(r1, &(0x7f0000000040)='./file0\x00', 0x200)
getdents64(r1, &(0x7f0000000140)=""/65, 0x506)

16:09:51 executing program 4:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x700000000000000}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  910.097422] binder: 6068:6074 ioctl 2270 200001c0 returned -22
16:09:51 executing program 2:
mkdir(&(0x7f0000000040)='./file0/file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
syz_genetlink_get_family_id$fou(&(0x7f00000000c0)='fou\x00')
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  910.145578] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  910.158395] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:51 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x4000000000000000}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  910.247897] netlink: 8 bytes leftover after parsing attributes in process `syz-executor0'.
[  910.260399] binder: 6108:6112 ioctl 2270 200001c0 returned -22
16:09:51 executing program 2:
removexattr(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)=@known='trusted.overlay.opaque\x00')
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff})
sendmmsg(r0, &(0x7f0000001ac0)=[{{&(0x7f0000000300)=@llc={0x1a, 0x339, 0x0, 0x3, 0x2318, 0x0, @remote}, 0x80, &(0x7f00000007c0)=[{&(0x7f0000000380)="631e5b944c7be8023e8dd67c1066b5020ec260405eaef7415c308884fd17391b13ed26f9cb8bae385b777b75cdcc125bcea4023594ab091594148e45ae11a7f2a90ea58df78dc07919e96b3c9dcfd559a726db1c", 0x54}, {&(0x7f0000000400)="28964dd1eea64c6d79543aba6d7a18cd0ee512b45fc401e6915f6fcc0c21519d26a0919507b100eb94504e554842190312401f75ee1fc047e3d78f5fd8ca61e9d66b47bfc60479696cdb56773f348ed225124da5536fda2ef34202d2315458bfcd2ca8fb90f5809fd886bd749a8b9606e0789b6fc6873356bd81d80341fb7e15398e02cc6712469a5a0470d931fb86c695613e28d0c08422499b2bdd783967d15adb86afb57f014c45659554c6f5fcb9d4d199443f01d3175229080a6c6324f570d9c349ae1a4cb3c51bb5fe7d1726dfa142bfac1b5f7043b43cb0071ea62bb4e69212af0e48f39e79", 0xe9}, {&(0x7f0000000500)="e7e21459d63eba2c1b", 0x9}, {&(0x7f0000000540)="5cd07bb96833e09173d70195d5386bd3d3f4dae9537abeb2fc209e9141df9bc73fa9ecd08afd58f58d705c0f323f4e39763bfe423fc0745a1d95c2d0e9dc818cf7ae644c3e4c", 0x46}, {&(0x7f00000005c0)="ae75c0487674f9ef9b2a96eba270730513da80cef753c266c1527672ae4abf17657de9da937ea07c12f8b5690a2e20760e7fa630d1cb77b69eea18613d58b8b4415b3818ae1a1822562d3251a2019838e722f2ca7c16adf32b858a70ef5537ff89eea5c2496058fda62ac39e65ad085ae2fbf22668", 0x75}, {&(0x7f0000000640)="b134b7b865568991a6ae44da423004b8ef9c2cd7b5d9346ed0c4aa2c28cd514f35cd66e6a19cf188fa58e3638f19b014c3a15dcfb6659875c6e9064d346f8222ab306bdead8026ab5cc0a0aadced60a97a2b1006e31ce3d000ae7ea53ced6ee196551a470172000e2da8228e5918b7db2dd0e69b15ac915104ebd2dcff52a9081a3e34d7ebca89ef3223087efb8474350553f144cc0c37725f19b25e184ccda11677473e2e8c990952e4c8271b65cc16a17bc0f08b7c59a42a19ddaddb7a1000ecde05d6baa855c008", 0xc9}, {&(0x7f0000000740)="30bd60c804f4325b7a416bf9d4b64958d9f5feefb2b505fcb28cd70380a6e8f644e6828849a3c4befec27b4a4c2e41149d78549b00795b17f7257a3502de8ce7a60829ef8626ce424f6b36012d1575cb0d98ee8691f2de", 0x57}], 0x7, &(0x7f0000000840)=[{0xd0, 0x102, 0xdc, "0efe616c683153c62328a3e8b1634c40a119973787c073fc759e864e80b5e7b700f760db6654f845a1ffa17ef34089b28498742bd98cbd944a5d99f2f0b3899794d3326ee01342cedac382ff9ccdf38b35ef8cc6c9932363b4fa1ad09dcb85ba242517ec44a1c7a95f3f288a41e044b0bfbc25245e7f0f73f5efeac9eb1fc27cffcac1fde089b9a8e426a8c2e2a576037105be49810ac901394b1dfb15f14cff2e1ec64b14c5ea83d88d63d9bdb40e2c51327f18d4b6196f94ffc0ccd2e59a1a"}, {0xf0, 0x0, 0x100000001, "4a064d43dbbf157309bed9e0c83608d5933ef46694b5e26646179c89b4a90e5db31ebec7da9f870c9b081f785c662d24e625ba45b3c3438028ed02fae56367a8d320b652dc4a7eedb7a367bb416be6720340af0a7603407f443fe1a26eee9b07d7b749671c6eb95cb664f8faa7897b41d182ac2f26de5c4d4d5f475d813e778566443fe857fd7b75cf5f690e9ab13d529cb0b19095e905a5f25e3e590d6a012f8a53c077b62603d39712f0fd8849091c15eaeb5a70c1c59f41072e80bdf29a2cd837cdb6189747cb33fdefb661cb737fc07abed246e90c1b6adad30fb5d416"}, {0xe8, 0x11f, 0x2, "04f80e8b5788e74ef2b9621e95fe8b4f46163321f2170c9a74fb116187cf35062fe4cfa6289045171ceebf9bb0a1f0636304f9a5e3e350a33fe044998c9c0e9bd8a42c3b013f1a13e7c3bb0cfa024d0601f42ea5be0619e5156dfbb8c0f60dfff182a1ce5aab8e55a900f5a0097db033edb4e9838084ea58dcaf83d21b37a4bf75e480fbd6421000a7d08eebb108c8ed6525101c5589dac0083e220405b1175f22b8faadfbea488d9afff7555fe7dd00b32f31c3552503fffcf132ae803c2cb3d23bceacf050af403a7778ad86de3aec0b369f88"}, {0xd8, 0x113, 0x10000, "c2ca1a8b8d1c8bc1644bebc9b5ac4640bd90254d721b8e6e49073576d3e4fefe36c3b0eee7e83b2ad830b04bf24e329bad574eb4e2cac892a3781e43b95c0b5eba0b230cbc032c5df0fbdb2384b0bec0d8c8f54eeb73ea8d2060c559f923fa2d653d45c2dff941ef3e0f6360d7b1d4865b7db99edafccf221414ee8c13d6042071882d668bd9fe7f2fb69c612e1c9eeacf8417aea5b1dc9984c00b14123b8913b5eaf25913c2dfbe70656539614f4049298d8f588960cec8816f15f74c10e865c18b3d40"}, {0x40, 0x10c, 0x6, "9f1a59081b6156ce0bfee0774a7643178b45bcf59b18365966b30973f5722ec57c0e5541296ab3c708f9a756e531"}, {0x90, 0x1ff, 0x100000001, "3c56824fc02b4601419ff1d15c741962c66098151655db6fcd78e923cd1e03320cda693223580ba1c5df783aa8b3e1fe3484e3043f2f24f7616ac9ccb52302643ebe85c18b8b1caca650e4f4d0e3768742a75681a07522a33b750f6531bcd3096de0c4d4f609e23954903285164d7a72156df1abb5cd95e7d4428628"}, {0x30, 0x119, 0x8, "1a54927b4572264dfa90913d6b96354c82ba76aca7f3bcceca582070ad"}, {0x108, 0x11f, 0xffff, "0248fd27e475648ece739d4791848e6918455312dc93674a445a21c4020074c25b922d919dfbd6760de524b4ffd61853f3f34a79f9a5781b9c20b143628c4610aad285f1f2d63cffacc3c8afc93541963ad22aa858f7cf15a3a47d13faa89e81ee6ee1727826f3fc2ce87e6c5c6b6fc1ae3e99c945879ec4f37ce920be51b1b248061c045e26b791158fb8751f2b8e8512becf1075ceace1e97a204153030b992e3753854d563738336c70b6352e6151f8549dc25e0547f0ad909dd37bc4088040c5c3d22dcd93273c786eb0ee7e2abd07bc23476325e39bb60c4ebb9201a376634923c2d725779e38489e843ef56cb4c1"}, {0x18, 0x11f, 0x29c, "cb531ead"}], 0x5a0}, 0x8}, {{&(0x7f0000000e00)=@nl=@kern={0x10, 0x0, 0x0, 0x68000}, 0x80, &(0x7f0000001180)=[{&(0x7f0000000e80)="7def4a738365c1cdd51e59a0f4b89dd6f0773018612112841bbe", 0x1a}, {&(0x7f0000000ec0)="bfe12c662f7d5e2fe498d12e5f006fb3c7f27f72f912ce1a806594890d929030384b39e34aba8f6ae4351052523983cffc0e24af8d893b7b94", 0x39}, {&(0x7f0000000f00)="38e75ee3a6e1b2d83a8355bee09fd51d5a2ff293b3c4e078c515724588916b591e8860cc055d99c255f1b7c235e9769ef436a6dccf3f621b7ef87fcb4f98d72904c8e4cf97f5c2e90d6af29dcdd3bfdad15dbcd7aed0e2e972e81bdece9273a076202291edb2afa00cfb526c5a864e6583c271bef64061fb25d5aede84cbc8832c1981fac538130a43bcca17c78625d5fd4d9a1df898fe3e3ec608863d20e35133e6381fb3e6d35b7569ea196a37728892b9cb458e505f32e00c65c716e00640fc6c533185f5086d25c3b3", 0xcb}, {&(0x7f0000001000)="ba78d78c8c15592f8f30dcce0b6c8ab26e7be461c072beb9f4c77020f7447f0e340727552414bea2647f365d9723d22f7a6a73163b8344bf69b6dd1f2737510a952fefece635fbfad5a622b37cfb36fc3cf5ce9d917fd9c46eb2fdb6084881873e2f22cd52960e9c976bedfe4aaf914b8d1b1b08314e7b512dd1fdf071a5bf4cc5bfa87125503e58a30083d6b0793b92c73bc4f11c0e896119e906764742965fa80259ec404d1f72c56d701c7021183c70c885c51674c9906e994eaa230515bdff34f3e34eb05b163068a8051ad0", 0xce}, {&(0x7f0000001100)="b572d1c85e2679d8c30110f3d619655c5bbfe3d4b74a70ee8f7fbccd0ffd05ed7fd74d4ccde804b4a955a2e48b3fb4184ede80aa", 0x34}, {&(0x7f0000001140)="b724c21be8fe839c66d555227bb733d39a5f3080d2d7bfa9603d668aa291d92982a8e5f4a35a738178ff4ae7b1ca87d92053c9aae1fce59f05", 0x39}], 0x6, &(0x7f0000001200)=[{0x60, 0x117, 0x9, "d62654f0ad26a5162861052481e26193082a9cf63e515971593667c5cbd188ae16114cc1b2fe8be2487fe2267d692fe5a19ddf549ed72d5c9f00ba5a396c052e0917fda60754cb32f1"}, {0xf0, 0x11d, 0x8fb, "ff78bccfd301b9c68bb9b845aab8351b5f28dfa60b8fda64ff2ba1e6b32cacec91ce76729dece703fdd8b2e5a51e003ed39ba2e8a41e9305132fa8772f09624bac1defc1688d05d37ce174c269f911fa8bd12827964b6b7141480b430d4a00d97e0481695607374567607a7081b144fae18d32af85a8716423f03f744f3212d826390610f7a2fa93239eaa5577ac85f712cf0e0d91e60a0ab9152c3f1ae60b00602f72f7dcebdf0105174590e92988d5a59bc95817034efde17cc27fd5a6583ed330ed6d1402840ffdb7b00f126621a787bd0f5097e31e38a1e5c7bd2d46"}, {0x20, 0x1, 0x4, "11f690221cedc655deda8170"}], 0x170, 0x15}, 0xffffffffffff7fff}, {{&(0x7f0000001380)=@sco={0x1f, {0x1, 0x800, 0x1, 0x5, 0x2, 0x7fffffff}}, 0x80, &(0x7f0000001900)=[{&(0x7f0000001400)="f66d307a1c37e1fdaadd027335be62ac90742229f13e491e83158315de7a6b5a57f6303d31d849f368c1f35f8521118f5ebfbc2f93352f678217fcf341630614f03658bdd5d37be34f83a1099727563c2b28b611d686b219ec00fb5d9167b95de435ec4e66ed28f514e91a0f207554feb976f856f5c5653c04b4dfdf0c137f65e15805e21544ce8f60a345bab2acf53abe81af61e3c9a04e4bf18d994cf47dd9a41f5c34f6536f0589be", 0xaa}, {&(0x7f00000014c0)="16743fea9a9f488939940f069b2b1783d20fe3682052b04e964d9a916121b985da63f9d025018443379da83dd45acbb994361729b410325378270dbdd5746168d4b8f2fdbd1056a8b7cba7e1a267907054685ef28e9368320f61244a9f83dabd128f78fe95455ed6bb389c57e34908a23fd6605298c9ee5ce37027a25caa142fef2a8dc50d7b000f9bb128f2e17ec23286dbd71b187801da4c6a4ac7aaf6a2ffd03e6b141cd83e71027f6874", 0xac}, {&(0x7f0000001580)="a7840e593903db9cb7f487f0ed88a3e402b0fa", 0x13}, {&(0x7f00000015c0)="de637e705073a131d8dc77ad7b277a9beabbc0ee", 0x14}, {&(0x7f0000001600)="d6dd0776587ef0a72a6348ef5f45a80d6424af11bae43ba21ffc20e2940d9b30d8233d1ff466e2fd945fd1832866472cc2c5b6ff4e1008638945f4c036be8c22d6aa38a869dd1a9c7d4d92ca35a24efac0d3189671ba65fee86b926d6dc0734dd89eb2e2bde234f8a6779007f9d165e0edc2e1756a58c8f0b46e20680ed8722f9eb1b8285372a0ffd756509678d718640840be381d1ea06f8fb7614b9c111676d95307196678dd4adfd419b4647cc4b9a23176a285f6a94cc243d99550b688bdfaa2bc1944b7b66c", 0xc8}, {&(0x7f0000001700)="e31c718d6471826794977b34d84596f47552ff2945779130d20a309ece5c2dcdda01130a05719d815e6d0b51b5a152103cc763b93495905efe893ddae736ca7e", 0x40}, {&(0x7f0000001740)="5978c4ca1e6a7d6c6f27ffe8391c6b42942bae6ebbd667f60f645830d2a695aefa9b2b36b5a4d8524b18e9e3c6beab1e7a3146d1e52c544dca7f5cdf3aba2573c34002b6b64c27cebf72a26062d799c403f1407b86c5", 0x56}, {&(0x7f00000017c0)="e7ae494e5c0ebc0b64db72eaa76097875455da6ee377ff5a2387f56ff8eaaa426390fdf859fd1edf0e5ab5358a3836dac05288a4e7e413687985c2c6999c16efc67113fb99e9444eebd0a50d9b4f7ea1915a112892db71399a2d049a4a5b77f4675c19eb9161f7972a258b121081a3a944ff619a4f4540bc", 0x78}, {&(0x7f0000001840)="3f7a241079c91ea36db0aeee570d8f7f336fa86a8336984a89b04a29b567b086cc7189fbd15f30a261abedef569ab357c3e4d96059f26038a4cb5b3a1e046e67c9efa9e8808cff3d5a3b9cd4", 0x4c}, {&(0x7f00000018c0)="c2153fe4c1301340f4e7c72e859b823e0f38669e97c45ff64d61360e1ec0ab09234993a77bc7", 0x26}], 0xa, &(0x7f00000019c0)=[{0xe0, 0x115, 0x80000001, "1875ead6eb50c11c41d16816ef8c40a9c84e98e3ce2ce36aaaece3881891df0e42941bb4265d9749be2c1ce83ef4be09f30ecba885bd2e188941b5b9935d9e6852d3580de553d98a330d294d9e5838530215d7320380695a5c9226898387cb7e84774709ea1922634152265c0f7904a32367a8d57c81fa69d42736dcddb3668222a2819a50f813265da5c46ea6845c99c57f09817fef0ac1c4653161969999e785b4620bb2ffed2c0fe2579926285167334793a20a37b26275ad513c6f71089c8fcc525ba01bc13de89f90"}], 0xe0, 0x20000004}, 0x1}], 0x3, 0x80)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqu%ue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r1, &(0x7f0000000140)=""/65, 0x506)

16:09:51 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x5802000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:51 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x8000000}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  910.542532] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:51 executing program 4:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

16:09:51 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
execveat(r0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000400)=[&(0x7f0000000240)='vboxnet1(bdev-;security.\x00', &(0x7f0000000280)='overlay\x00', &(0x7f0000000300)='overlay\x00', &(0x7f0000000340)='%@ppp0}:systemselinuxselinuxppp1cpuset\x00', &(0x7f0000000380)='mqueue\x00', &(0x7f00000003c0)='overlay\x00'], &(0x7f0000000480)=[&(0x7f0000000440)='%\x00'], 0x1400)
ioctl$PIO_FONTX(r0, 0x4b6c, &(0x7f00000004c0)="ab73d79342207a07d69c2ed725f56b58953091dcc7fb2883db81b84d4ff36133d235402724be74802ea128a4d03dae6f519c5584235b1cc37dd3e193eac6900cbf444ca1c7205f44e53247f4d0faa94dc95e90fa4dba36f424c3ae132e9aba0ed3ad5566cf32dd")
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  910.683064] binder: 6108:6112 ioctl 2270 200001c0 returned -22
16:09:51 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x6400000000000000}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  910.729359] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  910.758670] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:51 executing program 4:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

[  910.869514] binder: 6136:6138 ioctl 2270 200001c0 returned -22
[  910.952299] netlink: 8 bytes leftover after parsing attributes in process `syz-executor0'.
[  910.964949] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:52 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x10000, 0x100)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

16:09:52 executing program 2:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000040)='./file0\x00', &(0x7f0000000200)='devpts\x00', 0x1008, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

16:09:52 executing program 4:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000140)=""/65, 0x506)

16:09:52 executing program 2:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc501}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  911.096044] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:52 executing program 4:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)

[  911.150992] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  911.185335] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:09:52 executing program 4:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)

[  911.310578] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  911.312456] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:09:52 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x14000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:52 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x64000000}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  911.529786] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:52 executing program 4:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)

[  911.615337] binder: 6136:6140 ioctl 2270 200001c0 returned -22
16:09:52 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x3f000000}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:52 executing program 4:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)

[  911.823332] binder: 6176:6180 ioctl 2270 200001c0 returned -22
16:09:53 executing program 2:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:53 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
r1 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r2 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r1, &(0x7f00000001c0)=""/39, 0x2d4, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)
openat$urandom(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x111080, 0x0)

16:09:53 executing program 4:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='mqueue\x00', 0x0, 0x0)
mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)

16:09:53 executing program 4:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)

[  912.217982] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  912.365380] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:09:53 executing program 4:
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)

16:09:53 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x3f00}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:53 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x7000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:53 executing program 4:
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)

[  912.572209] binder: 6176:6181 ioctl 2270 200001c0 returned -22
16:09:53 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x4000}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:53 executing program 4:
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)

16:09:53 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/tcp6\x00')
ioctl$TCSETAW(r1, 0x5407, &(0x7f0000000140)={0xfffffffffffffffd, 0x1, 0xc145, 0x8, 0x6, 0x0, 0x37000, 0x9, 0x5, 0x11b})
r2 = socket$inet6(0xa, 0x1, 0x8010000000000084)
ioctl$sock_inet_SIOCGIFDSTADDR(r2, 0x8917, &(0x7f0000000000)={'bpq0\x00', {0x2, 0x0, @multicast2}})
bind$inet6(r2, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
listen(r2, 0x4)
r3 = socket$inet6_sctp(0xa, 0x1, 0x84)
r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0)
socket$inet6(0xa, 0x0, 0x0)
mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, r4, 0x0)
write$tun(r4, &(0x7f0000000040)=ANY=[@ANYBLOB="a86db4276c7501ab5fbcff"], 0x1)
r5 = perf_event_open(&(0x7f0000000180)={0x6, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mlockall(0x3)
close(r5)
setsockopt$inet_sctp_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f00000003c0)=0x6, 0x4)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000340)=0xffffffffffffffce)
r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
sendto$inet6(r3, &(0x7f0000e33fe0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$netlink_NETLINK_CAP_ACK(r1, 0x10e, 0xa, &(0x7f00000000c0)=0x5, 0x4)
write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0x0)
setsockopt$bt_BT_SNDMTU(r6, 0x112, 0xc, &(0x7f0000000380)=0x6, 0x2)
openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/thread-self/attr/current\x00', 0x2, 0x0)
r7 = accept4(r2, 0x0, &(0x7f0000000040), 0x0)
inotify_add_watch(r0, &(0x7f0000000080)='./file0\x00', 0x10000000)
syz_open_dev$mouse(&(0x7f0000000200)='/dev/input/mouse#\x00', 0x8, 0x200000)
ioctl$TIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000240))
dup3(r0, r7, 0x80000)
ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000280)={'team0\x00', @dev={[], 0x19}})

[  912.851709] binder: 6219:6225 ioctl 2270 200001c0 returned -22
16:09:53 executing program 4:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)

[  913.006759] overlayfs: missing 'lowerdir'
16:09:54 executing program 4:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)

[  913.379037] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  913.648928] binder: 6219:6234 ioctl 2270 200001c0 returned -22
[  915.743774] overlayfs: missing 'lowerdir'
16:09:56 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="2800000010005fba000000000000000000000000", @ANYRES32=0x0, @ANYBLOB="030000000000000008001b0000000000c3eda422aac826208192629237805f6604d52f77ce0aacbdf472cbc848961d201237b60c753c8377828b0ae037505f5a7117d8c69c07db6bf7f846341d592bc0a357432718f4cdba331b70371629d08959a39150bd3093dc54d3d162d5a76f8a45bf9c2aa1c5a2cfecacfca5535c8bdb78f10ccef3ae772675c32e41f2cca75880375a8558cef73a9c2e1b8e04bee5d6b77e23d9a2464127ec41b84d76df1310bf9c9a1892f5854ad5062780e27750d9684fe790bfc0f2761ccbbae6000000000000000000"], 0x28}}, 0x0)

16:09:56 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x1400}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:56 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x64}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:56 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x10})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:56 executing program 4:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)

[  915.938892] overlayfs: missing 'lowerdir'
16:09:57 executing program 4:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)

[  916.011045] binder: 6246:6256 ioctl 2270 200001c0 returned -22
[  916.080546] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  916.118286] overlayfs: missing 'lowerdir'
16:09:57 executing program 4:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)

[  916.319720] overlayfs: missing 'lowerdir'
16:09:57 executing program 4:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)

[  916.426247] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:09:57 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x6400000000000000}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  916.519528] overlayfs: missing 'lowerdir'
16:09:57 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f0000000000)='uid_map\x00')
write$UHID_INPUT(r0, &(0x7f0000000200)={0x8, "c1170385b9d1c114eb6196baa1db71afb3c6aecbe706dd4289833dbd64d037c8024c34c493f06d7c60dade709fcd65d77ca5ebbb83e4d2fabe286dc8d1b089aeea863916b59bd11bbf379ceb4dc5b4cc3fcba2e6adc7d9b57d5316086cc95c20766bf697d763e54cb244f9df78419f82e1173f34de48f32dce0f2ac80d8fa27ace403af7bb33c9088aa9de1293f770a44d633c903585ce9659568578992216d684fc1227e5e998140ee0f6662d9041fa9003e7466ea931f4deb1a25e50f8bcd0c7564e6689384bbf934783ca0132f0e8fd4d29e56f15d06614b5fac9043d341b36ebb3f638a0cf455408b972c2106fc55843fde7faa840ac8d953dd8a7c2ed6a23ffe15ff8f1459f28baa922828369c063c4782abdb743123d38abd37a9908b128c388a84554b103a81476d1c0fbf5e1f1015cdc2a1696db26a833b816b4946a44db5a8e5232950e39c007275741bfa4b63334e24a9fa36551f14ce8a750d30a1f8c2f424b181d49c21ba027566fbfb5dbab9e6c81acb2c05cdd26f7c6604b45999aa03b0d028211a7d02aff3c21d86dae709b33aa1d53588ad7ad77b61ac806d3ec7a81c465f484c43ec93c40dcd6bd1f271add4ee0ec5d4e9bb82f192dd1ec371d314f0a3160b728b7f6c21557890ef108c72ea0d272c70604c0e65440ec120786ccd719956aebc72230bf2eaf2e136b4e24e298831fa44102e61b076505700f2f5eba67e8bbb7d1aab56d439effd56d9fbcd5b9174feaaae6f54243af585c5abca689e4543848857be297bd70879303db7454ed618a848ed59ed1a4d56cb8d8f4c2d0695e1f15ec226530b0d53c2e33a214b443ab27c887400523b4a34a80bcb9b9edb40cb38fc7e7aceec318ff87d0cd571748285aa6cdffd804f88d37c2020f6f315cef28139a3a4ec6c42c37c8eb84552420dffc413a1598fbb0c6d0c3f4e78651ce7c38139027c2fa3d6be707d176d227489d1b72d7db4636069cfd4c2816bff140332d9fa1487b3170b8afb30377521097fd5f2ec652800351b7d1574f2c00836169dafc70e51653ddc5e43a754416015ce82bc4424d9bc9e14585b20f7e7509cb31972e84386913ab485f9674f676cc6498dc9a6974080665ff6ec72cbc05450e04d7e2322db0f674339755a983a1159fb5bb4dfe7f44e6d4f18cbd7eb6d2acf4bda6df8d474760e1139ac4fbd6dbbd79a90badab2afa0cf29d40602d15010ca5894a4f82306387a61d63ad4434e476a4f71ef0c773ba2787ccc9284a59759d6bfa2c03bb43d09900ed6f28c35eec9a48f2ca4fbccef3647a59967ca44512a856b5ee3601413cf03c6f6b86f728cad0f072e28a04dc0f6a4a1075069301b91d4066e7dd8d77039ca5c652d8f7c682419df3f4897dc83f4192bcfe484da4b35f131a0f07fff052bd252a257fc8ea5faaa0b5c265d31d5ccd6ea5cbb826efc6db67516cf0020c89dba6b802a5da295cc3e9b88fe6ca3d6882407c3597b4a64580fec44f04515f371e5def0e60cff3eaa51880cbdde7f213053760469fdb755abaab0aa1826f2e3f73960205f80ba2986a2f1461e7e273634fc6e784a9f45a9042a53461dd5761973eabf272adffeaeabb23f574f5357772a637fe7abd6aeabdc9cadd40a36caa0a78970f5fcc04bead63fef67fbad85914746e6ca6471c862f55f96708b67121fea43ab787ca1eb8fa56547d7e75760664f09386f02740b0167fdca402a972b0cad3824a9746d3eb1802469b0db4dd667cfb29dc8854e867f8df30c6078ec4cb8e046eca85eacca3c8d33f0f5b491c98eb0284f5ee19674e3b2e27d9c8528d9618993855ad9c2ef9170e7983c343cb48429077a3042bbc991a9df71658302e456fd93bf02f390e06b7dc7e5ef31657d26389d52f475d8dd0764c0ff27c3cc3fe46f0ca1c9bbbe4f277b7a2d7cee3d00af820b81cb5147680ac649cc743e61f4b870e98257df8a06a27f4db82cfca526067fd3e1aba9f69052ff8c0fbd7a722e66ee6dace5323410b005d7e852a3f23b090de6a23ccde83d66aa221a4d50d011fbaf6880931a21df843a8ff0414b3e06c2ef1417a17b5df20c5a0e09fcd01a5da8e0a0ef734355b2426bb77fb95ca1d2dd752a04c73e29f498884fc729ec8f7ad007de999054cb3d40140d1fb15c35db830095d0446292fdf4b1f892d465c8a58882872ef7ce541311f2ba10963cd2e9d0063aaad5b419ee7165775606151bbcfe4e856c97cfcf23fdab891eba0d5f96d87019539397dddc265caf68d65f306a98f88b3faaf0f47ed7b1701d258505920cbb59695d4c2abaacddf080fc7d0ef59e69fd8bbc18f3ed344951d2bad0d2487cdc88bcdbc319ee5eb25b92a872029897fc5ec4c7b899354ab48798bd9bf9935eba647206e2f999cc6ab671f089a6e622327e16f1cd7811c419ab7838cb780646f80dd0cb325fcae3be9dd60e26c1478aad9e4b427179fcadce895559402791880c50988b49e2019edf198b89e017427a56f61ff1977a14dad877a7c2c76220c226fe98fe022d2e22afaa7d9b187e45b5c6ac0e5ce65e12a359f9d08a2bd63ef491cae6216bc9657b0fbcfa3b2d67df97083ae42f42f2cb6ea5df383143eb738ca0ec4df1e6464ea1e0b7e987a64a18872f5cb1a230620a695a4da51d6818bf2ac137da114165d831ba2f0ca24e5e672b9040a433203bbc2b94762cc52931832ea5d42dde67e2959713bac755bdc53936008b9bb06cb3856c26983ad40def38c1254f433a9085a0aa0ba3bf5c89cbde025b5c2e3dc5222115369823503d8a56783dc43968392582d80dd61fa6aac03087307a55b04539024a3166bac2a34cd7c76e8f49e53911ccfc39ce46dfcb6e8e7ff5a945cacf6aa20766c76c3f7c1b105060f932dde9c4e0bf0cf2c50892e96dc02aa791b32fe1b168b29ffbc8d92f4124d9ee5d89bae86a6ca163e6a094897f1fa5813e29871e0bd1227f7646dd003554b10d021249479b43be6cf914b0becb8b5b4a8ca2bd138652aef06945bd71cd191d0fa114353e56bc51fd220ae61da141a1e03f98755477cafbcab54975282e7d564b26685d0ebd21a2ea7c41d0d62fd1a4127bedad8bd041102274c4a554adb95f642f238e48d9d20b9f7e9a047888314c64fa442f1f5d521a28d934521bc8995bc4b97a587fcf0f05c784a05f3328b065c970525c2669dc39e080f088e33d0d1fed5628da3397b495c41f3cd54bd4c4163356f28e7e6c8173c28bd2c96ebd38d467b028c459370ccde8b7f5d6624d52ce77eaf055fb98fa6a752b8080a93065cdfb72c412fad56ff698ae128a10b9eec31530df03a78628f606bd26c826017b703e0c881b88bceaeabdf9565e1f7a8c5ad10ea98c5e2273bb563fb086d170e279f4489edfeb46360d2c9b81c4033793c52b5c977257e1b0b622774dd11502330c98119b61eadf7787f5f5e2a154cf36b83a6a695b187d52f0db1bb02d5462d0cdf2046233ec2db0f909aa1b0ebddbcd1601066f8588b2342fb0bcd6a2c393497926863baa0751177116db1792c94768da0007d9b614ab5375328cbdd1e251ce8493a7d834e1bd7d96f1364eb5b2294d98ab9dc2dc5f9fce5cd0a82d2c1e0cfa03697df7782f187835231f059ea771189502a5755ae56e7da4f148f5702cda7b16f7d02425e8d396c07a2bc640b13060d023bbb80d153506c6a16b515f51e8187e0cfa79f0d0a3bfe73cd6788556a5f724c608dbe2bd9023a256fd75717e6feb858dbef86e6d1d2f66706ec2a9e4919b9a0ba76870814408d608e564b10528017212a5077fdcc493149cc31bd75034b7b44ac198b96dbc01f6fe4cd2e2d6b97033ca4cb3a0f65c2bcff9ffdc7ef8dfbe2b4aa4c185ba4edcb1624f679cdbd6f8ccb7254baddc45042141cba2f444054539a8cefb9011d24cd22660504fb1469da3f06854e873465e4de1746d9401c405d1008145640532dd900bb5eb93537b78a1c7cf2c0bb621ab5dcb7aac95a44f595f0dadad16c57122910e6771216740ccdd4e8cfdf529e4743529919828a8ed4044874a3c5a8fb50d87517aa4b98dce404e364c85fba4d9dadae5ee409d3425fe5bd50f78e85d522782730fafe7429f7a6ed4fecd2519ca5e0c6a4cd3d7bec13e63708e14f4076787a49200ef6bda5a6f970cdfba5355e14aa1741b7f856af3fb26a2e1a8bf05f5ca99d1c39b31d8cbb4e5c0c2dd21665896cfe0549ae26d6304514263d911c36a1781ffba76bdefdb59a263d974acdbe04bf95cf4136ad47f9c14294e97938f9d0b36a89facb8068711dd4b3420d67f996a42d80901a50ee80ed81e59c36d65c6373969a1a1b1f6e28207e562b52191c63bd74a26c4997f108189b83754a4cdea515c1aa21d7038fdb88fe54947a467dce2497c15fa4a68c01adcd5283312a08d69a6c1d7738a8a7761d3ec6f8f2e07fd4c0ebd902066d2cb66fbebf928d59b6326ab73030a5e9a3e2967c9cc7797f0c5874aa178ae57585b248d045a59a293977f4f455fcd00b239d8263394a3fdc7ae3801c06841a09c3b2a8342c4dcdf886cb7ec0cc57ad16d836208111ce28962c5ed07705a58e1d7dff08aee9cb59ab189faedbd55d6195248e892003ad2463ef2d097f0b2546b5f8b755559dc59f5f0d4b654eec1a51892d5f1bec920ce646812a19809c466fcfcbe3b5c9ee3ed9e927180688faafbd86e8f2bc924d20ac9c99196312936109a91a50ddcaca6f87f706e779e26a1b3a07067ed38aef3d530f9c21b9317bda651858e27614ed0d96986b4bf18a9cc55bb8106741b352a10a658fecb5b1b2f6b754e8058726521d38450e59d57c4a93383d24b7d2ecb0804df0736c0f2162f98aeadf39d371566d34d19236685b212aa05982528730a024f739707cc98e0ed7875edf27e6f707fef33b2d525897c7511cf6eec8950dfd8c081a963379dda5d62aef76bdf37079a053fdb8a48500720319b71523ed589bbc1df650f96553a813d94da80bc5910152ed9adb6977298e02e3eb5bf228235043fafe73b863a606e47000c8e0ca4a071efd46a22bc736ba4f63fc8b1a40c2f7c0553e7293170bd1a9d594b62d07e2cfde3de33d12385ebafe3f075eb4771a62153c45fcc67c4823a0c98201c8c0687469764cdf508c432b475acd8975b72957fb74902e0f79721bb6164a38fde92750897767c902824fcbce15257d0983de51a53654a8cbcd77e9932b2a453d525661fbcc2c95892dba433afd19c567372705d1b4b2a0b7cd2abac6d02d5b2f20dab3d14eff100ae9e705477f2ed5fd65adeff9df730fee3e3299cdbf49ad5d86559f8ae5be4d00eba90d4ac0ced20d3a9038f31f5f552c4e9c8b57789e6a5df432fd35e5566d45edba4f781ffceb2b6effdb402f677d5b867daea80ca69e042754711d3c80caf27830feb4fb4937e962dc182fb429a472a2cddb486de1fb94c92a8d516c6ddd216fed69333ffa22404e0b90f3412c104691448401b438beb40914e002754a9161156962752af6e11cb453755bb0f877f9d128899b1626b13f3fa56831e59ca835977421d93dfe3df5903648fc2511812c1516b0d47730765bd44e4dd89c3d3c22ae3893239b32a819c74293b40a694e4fbba895a95255fc3c7c25359c6920fe914169ef157ee1949de2737bbe37deebc5bc9cdebd9c68335c23b8ca283fedcce56a88c6d10be4017f4937d5ed7a592a5c224ea397359f07a57e90fe6cc5b296be8770c62cb1faf1f18e9457f46f56d237d4fc92d6d7fe24d22376fece7c5db9d6f24dcfcb9ffa6f341124e07938d2", 0x1000}, 0x1006)
ioctl$TUNSETVNETBE(r0, 0x400454de, &(0x7f0000000040))
openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x200000, 0x0)

16:09:57 executing program 4:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:fi'])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)

16:09:57 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x7}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  916.809541] binder: 6246:6284 ioctl 2270 200001c0 returned -22
[  916.858392] overlayfs: failed to resolve 'fi': -2
16:09:58 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x2b0, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="2800000010005fba000000000000000000000000", @ANYRES32=0x0, @ANYBLOB="03000000000000000800338fe25f48a6236044a79bb10a791b0000000000"], 0x28}}, 0x0)

16:09:58 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x200000c8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:58 executing program 4:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:fi'])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)

16:09:58 executing program 2:
mkdir(&(0x7f0000000040)='./control\x00', 0x0)
chmod(&(0x7f00000000c0)='./control\x00', 0x54)
r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vsock\x00', 0x8000, 0x0)
ioctl$sock_SIOCGSKNS(r0, 0x894c, &(0x7f0000000100)=0x1f)
capset(&(0x7f0000000580), &(0x7f00000005c0))
open(&(0x7f0000000200)='./control\x00', 0x8000, 0x100)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000600)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
dup2(r1, r1)
r2 = syz_open_dev$sndpcmp(&(0x7f0000000140)='/dev/snd/pcmC#D#p\x00', 0x45, 0x10402)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0xfeb)
setxattr$system_posix_acl(&(0x7f0000000180)='./control\x00', &(0x7f00000001c0)='system.posix_acl_default\x00', &(0x7f0000000300)=ANY=[@ANYBLOB="02000000010000000000000004001e00010000001000000000000000000024c2a85e00004a79bc553fa23fb7f3091d000c24d9ddfa3486e2dd6d4846cff363e41a4fe01c7dcd92811e985f222dfe0e9a3c29c369211619d0c6bd1d4371ead00af01b5dfb96fdb5565d7806f9a27cd9d7bd7ba6a1be1f5fa636e78fccc8849cf7b9e6ba684ca141f3236bca275f5f60f2c045a8ac875624c2ccde6f6dcf75f4e06f5d1756c23197678da3c55a80d52021dbf9ee0df110400704f79ecd99328f93ebc55e25fb6b11819fcde9bc41ded058785ea15bfd911f6dcec3380e166b4cc3b93de7be7e26b99c2ec916"], 0x1, 0x0)
open(&(0x7f0000000000)='./control\x00', 0xc40beb2474dfd22a, 0xf6ffffff)

16:09:58 executing program 4:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:fi'])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)

[  917.351388] overlayfs: failed to resolve 'fi': -2
[  917.363581] Unknown ioctl 35148
[  917.383484] Unknown ioctl 35148
16:09:58 executing program 2:
socketpair$unix(0x1, 0x400000001, 0x0, &(0x7f0000000200)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0)
getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffff9c, 0x84, 0xd, &(0x7f0000000040)=@assoc_id=<r2=>0x0, &(0x7f0000000080)=0x4)
getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r1, 0x84, 0x73, &(0x7f00000000c0)={r2, 0x3, 0x30, 0x100, 0x7}, &(0x7f0000000180)=0x18)
r3 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl$sock_SIOCETHTOOL(r3, 0x89f0, &(0x7f0000000140)={"62726964676530000000008000", &(0x7f0000000100)=@ethtool_cmd={0xa, 0x0, 0xf00}})

[  917.405816] binder: 6295:6305 ioctl 2270 200001c0 returned -22
[  917.434166] overlayfs: failed to resolve 'fi': -2
16:09:58 executing program 2:
r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vga_arbiter\x00', 0x40, 0x0)
mkdirat(r0, &(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="000000000000000000001d6f602af5748e9e0b3030c9c0c63f045038bee4d92c452c4514bedaf13cacbf5106e4f3c17c053b0a111e4f7e93310758226e3af65b6dc88b0e496ddb696fc36ae411b5dd8b2b0057044df1c0337dbbba191612083b34833da7077f3bb9f36d6ab45dbaf74906457ac831e3c8474c961c878b6136098ef08e70b7f88c4d895217bf54aff97204599bc6f5f93f7599244a613f9f9727dbd59447029204981bbc7736c8cf788e68ab320b6619b526891826406cb72e3718403ca4d160fb7e8cd2618b8a57e2b2973b1a6942ad5b2f12295500e83e62771daf9c2659cd8ee2b5b0b79a5eb81a51e960d87b5a7d86218fbad5ba2e", @ANYRESDEC=0x0, @ANYBLOB="2c66564ff333e870ef506e9f47b03136fe00"])
r2 = add_key$keyring(&(0x7f0000000180)='keyring\x00', &(0x7f0000000200)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb)
keyctl$invalidate(0x15, r2)
read$FUSE(r1, &(0x7f0000002000), 0x1000)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f00000008c0), 0xffffffffffffffff)
lstat(&(0x7f0000000600)='./file0\x00', &(0x7f0000000680))
read$FUSE(r1, &(0x7f0000001000), 0x1000)
write$FUSE_INTERRUPT(r1, &(0x7f0000000240)={0x10, 0x0, 0x2}, 0x10)
getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000040)={<r3=>0x0}, &(0x7f0000000080)=0x8)
setsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f00000000c0)=@assoc_value={r3, 0x10000}, 0x8)

16:09:58 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x10000000}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:58 executing program 4:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,wor'])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)

16:09:58 executing program 4:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,wor'])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)

16:09:58 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x34000}, 0xc, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="20e0ffff8a5895da000400000000"], 0x20}}, 0x0)
r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00')
sendmsg$IPVS_CMD_DEL_DEST(r0, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x90, r1, 0x10, 0x70bd29, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_SERVICE={0x34, 0x1, [@IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x6a}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wlc\x00'}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x7}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x430d}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x101}, @IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x10000}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x9}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e22}]}]}, 0x90}, 0x1, 0x0, 0x0, 0x20044000}, 0x4010)
fcntl$setlease(r0, 0x400, 0x1)
r2 = syz_open_dev$adsp(&(0x7f0000000300)='/dev/adsp#\x00', 0x3ff, 0x100)
syz_mount_image$bfs(&(0x7f0000000480)='bfs\x00', &(0x7f00000004c0)='./file0\x00', 0x7, 0x2, &(0x7f0000000680)=[{&(0x7f0000000500)="ab32fa5ff7b732e9ee85561f0e7ab0337228ab028a1949e5c9f4ec4a72d5c796d5a26a9c92a97522a1cce50f20b95a88fdc3b3be1cd33b36ab2a14c5b7362427ff8169dc5134f28aa32cf7b8dcebb454a3ae9561df6fdd269cfe8beeec5dd8c0918ec47b99c1e95dda134a630cdc16aba0e2faec81efaf73be66499843e8e0df1a8fd761e3efb2d06a3f409d215bfa9476c9850ff8b5eb1ea8f1a7072f5ab3520aad5a21254f45fb664270e5149c38d89c960eabf728f26d3a104c5fc5b580627071c8abfff9b6e4afaef335dc227c59514d", 0xd2, 0x7a}, {&(0x7f0000000600)="23e282bdb2cd68866b522e29ce434d4c89531fd8b179f2e32c0ab1b5baf98be6b99accbe0da6b0a010d8741f0ac0767c5bb78704186a9de2aaeb58b70623d94f9b91b61882071e0705733ea65bd2f27e7b55664e60e1", 0x56, 0x9}], 0x1, 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r2, 0x402c5342, &(0x7f0000000340)={0x6, 0x0, 0x5, {0x0, 0x989680}, 0xffffffff, 0x1})
ioctl$IOC_PR_REGISTER(r0, 0x401870c8, &(0x7f00000002c0)={0x8, 0x40, 0x1})
lsetxattr$security_smack_entry(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='security.SMACK64IPOUT\x00', &(0x7f0000000440)='\x00', 0x1, 0x2)

[  917.577597] overlayfs: unrecognized mount option "wor" or missing value
[  917.673323] overlayfs: unrecognized mount option "wor" or missing value
16:09:58 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x258}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  918.168571] binder: 6295:6341 ioctl 2270 200001c0 returned -22
16:09:59 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="2800000010005fba000000000000000000000000", @ANYRES32=0x0, @ANYBLOB="030000000000000008001b0000000000"], 0x28}}, 0x0)

16:09:59 executing program 4:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,wor'])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)

16:09:59 executing program 2:
r0 = syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0x1f, 0x103480)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000000c0)={r0, &(0x7f00000001c0)="790c758d945f962d1b06e06c05bc01f8bd4ab3dcf7d3d840e88007e441c809cd6c32df71a50d63e2aeb576842d9f48573f6cb81416adcf82b51772686de10f017ed46c5791e7c722ff4834e2cd3376669c06098c8fd29500f4bcdf43919399c2786c7dd95d2b741e9965161cdb8405bdd44e5f17ddcee594c047cf97e4b3a4caa9cd6f425b9643cb6c85fde8", &(0x7f0000000280)=""/75}, 0x18)
perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000100)={0x12, 0x4, 0x4, 0xfff, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa]}, 0x2c)
r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x80000001, 0x400001)
ioctl$RNDZAPENTCNT(r1, 0x5204, &(0x7f0000000040)=0x7fff)

16:09:59 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x20000108})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:59 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x3f000000}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:59 executing program 4:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdi'])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)

[  918.370835] overlayfs: unrecognized mount option "wor" or missing value
[  918.432666] binder: 6347:6358 ioctl 2270 200001c0 returned -22
[  918.440848] overlayfs: unrecognized mount option "workdi" or missing value
[  918.451049] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:09:59 executing program 4:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdi'])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)

16:09:59 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x2, 0x10, 0xffffffffffffffff, 0x0)
waitid(0x0, 0x0, &(0x7f0000003ff8), 0xa0000004, 0x0)
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000040)=@md5={0x1, "9ceb0763fb4803a916204f286d5dfebf"}, 0x11, 0x1)
getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffff9c, 0x84, 0xd, &(0x7f00000000c0)=@assoc_id=<r1=>0x0, &(0x7f0000000140)=0x4)
setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000180)={r1, @in={{0x2, 0x4e23, @remote}}, 0x485f, 0x2}, 0x88)
getpgid(0x0)
ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0)
r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x60801, 0x0)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'syz_tun\x00', <r3=>0x0})
bind$packet(r2, &(0x7f0000000480)={0x11, 0x1, r3, 0x1, 0x100000000, 0x6, @local}, 0x14)
io_setup(0x100000001, &(0x7f0000000300)=<r4=>0x0)
io_cancel(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x7, 0x5, 0xffffffffffffffff, &(0x7f0000000340), 0x0, 0x1}, &(0x7f0000000440))
ftruncate(0xffffffffffffffff, 0x0)

[  918.606822] overlayfs: unrecognized mount option "workdi" or missing value
[  918.629600] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:09:59 executing program 4:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdi'])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)

16:09:59 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x800000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:09:59 executing program 2:
r0 = socket$inet6(0xa, 0x1, 0x8010000000000084)
bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
listen(r0, 0x6)
accept4(r0, &(0x7f0000000340)=@alg, &(0x7f0000000040)=0x80, 0x0)
r1 = socket$inet6_sctp(0xa, 0x1, 0x84)
fsetxattr$trusted_overlay_upper(r1, &(0x7f0000000000)='trusted.overlay.upper\x00', &(0x7f00000003c0)={0x0, 0xfb, 0x1015, 0x1, 0x2, "ec38d91ba2b1e615bd7480d803f75542", "b4f96ee5f50086491d94c549bcf9438e2553aaca9ed3452cca91d5a73b94fe4fd95cc547f55a658ab1830332cac20e8138e3568c9ac0ffdfeee96baa626d61d7ac9214fbd3da5f9ac8786dd4f4f92e911b023b8376acc504a91269e77c3fb6e69714924af614afbe69a71bf82c527664adf0566b01978a13c192c5f7f500e94cac0171c32130702c3fc711c4ab2557e5044ef3c7f95c761b2b3cc05c4ea407e3548d046f3f9e219b6d0f57e777b64bd10190e75faa080f4773f323912ed10210418c05d650705d858b549ee9a108b9605cb4ded728e2ee634a271020edb5abcf11ad1bfe3989606f377ba1c8358331feac4e7fc6ffcee32a97516e93e351d61c407996c4c0c6e39d21d9cb180d6287c30414076a987a95632e7a19c0a203e6b9d5a36aa39bfd2ac07b79cf58cddcc73517cea754d36f66da1746e29960e5c8eeed3d9f5784570ab3bce6bd44eb4aed68bbee5b1ec93f0c3f0b6e86d1b6a2afa41549a183dbb5197e18bfbf386a3157294e04f6a24c74e91b15fa8fe31a2c9aab477b23cdd19d9e949f51655bf7e9bdc9903e950b869a9dee059cf286e3448a6d02dfd3f985ceaad533080ba5f10fecd67b3941a839e86b91dec9a59bb2e43c49ba3180328af91421abf9775bd07b844d9e55004211a18da83efdb2b8e676b020f584cbe42a618b6d71d90e2fbc7edb10043d9e6d9682d79715a50074e7fdd30c2a126da11cad74173f82cf9f841b1e431856538ac68eca3423a0def1278366859bb96399be6a0ea4f24649c766fed6ed7901ea7489b6ce570262feaf468f10a4e30365bec8700a2baa2dd804e24c1ea20a90ee866c42cc8b8bc0de13860884a26229d4501f4f882ad4d1b842caf930d5f8c013405721e2e30fee67fbcd68803085144cecfcb2ff9b9f192d5aa529add28e9d08bd8dd17d8d7d0bfcc7c858c06a5ca53a69e5e63566667371e68011d5a66f3d6349a64ad254e89cf087e5a7f584eb0d8338bde8a6d439f9c1d2ed2949ea39119d81ca150cd6b470f06d5bb9c7304f1019217381cecc7050c25ddd3d5cb46ee94cc540a07db6a931355dd3c3622f9e08acdd0bb81e45a76c8c782b32ced59c117118a92bf5e70a6314fd70862c60d01d2ca4fb24145588c28a7ffae0e4c23a79908b7cacce58cc0266367d11cde79a940024fde92606d3a42a3333788dbcf362c9658cab9aa17d18c0bc56b9695e1ba054ae4d50dfed6557d8ec750ecb89b669936ccbb4b3b6a4ee915a46b0b306786364af3d82e15e5dde4734d8949e98ff2c68205c628c17e181b28d406e179a102ef48c14978439733b4fe712b6c17c58b7c303a8f22540d4ed44278930b6ebef11c13effbfc9eb14a7d55ab93dd04389e1b0d0aca704bccfc9dcdcfe87d490665cde6e1e69a9ac2719cce7571983586fe51b9fbc1070d46962d6a5a268ab5f9342e2d193eb76b0bfb4d7266cc09add68e0b1e5c6764afc0e4d073f5c687b89071c44fc11be4da0e182bfe478f5d4cab5d0603d4688cc53523b7a70f6aa01d947065dbaec071a3f31da3122b55822d224390197a6d5813bacd31811300784b8cf6003e61201c3da244cb844d775fc81b46f2b1a3d1784028e4349ff70db936742190352d7da59a5fdeeb6f7581c9e2c0863d7ed650bdae3c05c8e8ec4e839819b64eb3090668e3744b98695da5e10222bfeb461cee1220ff9524ed6f0965823a52d08e253311cf9128c2f0e21ba05afac03511860e1a3d8d97ba2a2c3396d5557d5cdad82ab42a3d5fc238206ac5a622d6e196c409cf626b724e195401883dffda94e0086f176d748da4956b6780e1b9df78b881c653f5e4cb03cbdcd614485ebec186fce6d4b84f5d020f468a553b49ba49e0f111e940211d1ef1a9d402624dacff2d3bf14553ca3159958ae535f70c393cb9e5b69bec371673705e61787c0dbd0170d50c41a29a8394b4444ffdc20ca4179ad1207e9cd3d384a28cb04d5cd9fe113263e526c0dc418c343e0549ecee0d3a47ffea53225a864253309260339c10887d5d78b12ad87ea90c10652a52ce365c978db2a080c500476dd4e43bc2bc37fac02b1aece8767d13ec3e4bc200e8c399ad49607e8c1e7a3e775bfd5c07e1211b28f9a413f01b720af7a3761d26c82c0f62a100fc22325888a63f01d466a9021fb2e04c4d56962070bf34b0194dc96c0adf7f3ab324bc48c02d2866c64fe2d5e368b48e5505306210bf5fa9ea5ce669bbdc516d2291a4dd2ad1f7c3d36ba117a13bd78bacabc1bddb947342098950af66faee42fe8be9f7aba3bc05ab3f3b2a5655f89d1197e78498da3c680f4f0a18cb6de839ac02976af78a8adc089e33d0e3d8a6b5fa8ca50fc1cc21da0ce8b9dff1f5aaf0ba5bf483f89b9eee12ee6d43e8e918618e564ffda87da8b2bf82773c29f2eaa59c6be81a0fcc1c88a0b748de74bdc799f042c5808494d524bc4719bee9aea1935b05dcbb0d1ae9f782363288f8b71aef0ace5af9d9b40915e01c8e1eafe179b7525ff5d45ae746370e36ed16df086909e4607ddab1d64c1014071694582ca0f26d4cebbb0ddfc8aa32439099fa301280fa544d8f39b248d8c1b11017f77966cebbe2acea9c4ce2f68f4fda334483f715876ff177054b3cbd79f63292be653596ee182e0fd72f95fb700953f58f7f5a05b063099e8d070b4cf7550ea3e2e81c5c830662eb4065b050a05dfddb9fb844bcf1eb6fa97a4e14e00752488db1e4ea90061b99c4017ba0243c5a95a90d2de6e044849d4e297380d4d51f17aa0dce9fa44dc56cb37e06ef213ecd3f88acfeff2c5826ef7cce540c0a5abd5b606955de4626d4264a231155128186353af15d93c864375758ef4b1033d460436cd0e8a16e015554ad4d1a4669598c3d169bfd6a3ad22adeaed07b4c7089dc7d39be6ccb199aa970b53896ca77e2d03f116473478deae3ba0fa74c2b8abb2b172a3733a0810d08de8c0695bf94d0a2e22b30e12d8acec754a7e24fc3001d577bd995e584f347c9c88a1d345d1114230852459ea172ed8438aebf1befbf3949656ed4feaa1d2a6cabd9cbb57dd18cda3af20c97667161c368839a901f9abd86c7b9a7e115775e96b89a7b6211e84ba869e9b98970973bc7d9756874bdb9bd9cf9fca3fb60e57c3e7c38e1e5792c0400397dfff65bb14c3549f58dba6eee7048d5fae69538ab3eff91e6f7592004a88e8e4f39101bd8c2dbd3e81654fb620b3b6637209c4e4e2468cb5ff48e29331241b42c45f95a2fc45142fd2af5cd05ebd0b8570976a306a6ba34ee6aed03fd27d2aae1e775f6bb5c5039f55a1dcb76cf0c8f18c00616a293b7aec71a8133adb0edb41fe15212ab5f6802b8400fbb9fb16ec1821cba987fdac4abbf9f3876c136fa6e5ae20eff7953b5948a50695461183ab7608ee6911ebfc94f368e77c61202d9d35faee78f946177fbe59c048e4f929ce2226b635622540ebdf4c07d969eea87ca0c3d9ef6ace7501dcde5b81f8bde8e3b185eef105eaf69c7b0a50e603db30182896bfdf1214885dcf94ffd22608102a41c561c52eeb7af108a6b3e0b1f4c7e1465b33b423a86ae991c350c393756f11c402423a011e46cafd563b67937bc90e47365178c82c2b1a6e4c37552fe4239ebb1fae59da7f52104c0f40a270bc31b69655608a30b3d9637033266f75eaa73430447b5cc2d8f72aa6d06bf304cfd0437706653de8ad9fb108e022ab5181df44a850882c023f0a4154fc29669052bee756d7f76e56aaab9637c3aeba900ada4342cb7bd188a22c47add111ae14731575c1be3c6748c0279c8e682aa02714d19f41a934f789cad4003f27b4ba95ee274c8230398fe14f9b8b6a034838da3e656616ff1c2824e66afda3b0232d933aee6d080b700620de2d80886cc84bd997728705778160b2b8df46f98aecddebf4acc04b0a3cc8db4b22022ab2a7ad8b8a60427bc56d8b290d14f39147e46e484efc0dac5c994cadbd9cdd2084a116036c4a69d886ed5fcf8b13efa98ca4ca166fe8ba7ebb85696e9dd3f26927b62e89754a9165ffa9ea3d1fadf7d2e5c627b9fed38b28c14538e8ef9636ab0b1f2113b88633b580cb491f2e3954b050c2b5dd759c220907e52b2847543a130459f9c44e5d4457ed4227d9c24df97ce693ed8c0e348961b92ae6864ea5cc9c4eadc91a043b0701c220a690843a130e377b647c36ef139d56ca5eac804aff8440236eb5acdb3f6d4ed9c18c8d9a57845d8bb54b4ae54b1436ee14be5f40b2a2a9466a3f17e66575f77581f21c7221e970e82a6c0735a781f4f07aa7ca389e9fbad2d0d715c2cee702409fee1c36024f328b109c3406010655b5d7599e0ef1d1edc8dc2c3032ad939b4e9f36a45917e8706ba5f2338572009766ff7458e8e383a95fcbd3279a2a80df81b455e88edc981d076723505690ec98b3cc93a8083eba23a9599c290f978e6bfb46572fba948ce673b29cddc6cd6906f893764b49a7a0e7a6f19a00145842b761bfaa7a57a04953a6cab6f604f49ab87772dbb225bd2da35608d8344264cddd16edbf7e784b9c0741b299eb47b20e66ff0853303543f430e2cde65b7a98632683cd9eb7c19ffbaea6b4c07493311764bd306b3824d21a32181cbf268d27168f0777b6eba6ed83b4575add548ca723b25ebd4219b901891310103f3ea67750b5eb79457bcb78c6537468bffe6145fe209122ef89a7a006986b664f029a1d00237ed9bec39cb1a1f51a5b171b9d3ab903a16e7e6425e283b1bc453d64bb8bea81f819b8549ee26e6f874abf7fe7e535bda75cff78ebb98e40ca93f18393d1565a23ddd9a89b9a859e92f1a89836bbf428b7a904f40dda182efd761fe7479f545765c81e8a3af23445b2bd6183bb9214c721cf5d7e6dc1c8ff822f3f008769f343a2b59188a9f8a3f3ca1006acc06b261315ffdd56b52357bc29556a1f1efd33d9b01f368d84e593b6e6c043827e84a04851ab14f2f1d4a355a86b021eb8eb1f598c96f2b932a0b8ad20a42af4b0efe141768ec55bb7433c317e725e195b8d694459ef417c2dc73805788c462e5144cd1b1498f98f7a50b8e9c22a159a3ece93d8e21eb089e12cfe924eb6b0344dae53ef373c38ff753e5be75f5972fd8013312e85948bf0860e526cdb284c720b3c7fdafc9fe4f0f23d9d413f5e60824dcee8755d9678367b3bec1a5167c7f88599270b327c7ce8996d874d7bbf21da46ca5743c8ee4d5e0bf54a84d3efaaa45a4737ba56da20076dbe9c931085e4fbad3c71957b77b8eb5a06ded067a58095917402a710355d9ac6641c4c4d673916444ed622596d2e97ea410aca6fc53331ec88032b6c266a803525cd3aa881c157dbc03c0208fb266c933b28491f5e61061252a496cb684818765f440eb6f9d96d597eccf72e360d3da7544b7ee3175da5cc69f4694cad1f76bf22f81bd25ee8c1c7b46a51e8b24fba2e76fe5f9d829ea9cc553350084e56d45bfb5e16ae0edd3e5b633e5b66ed28dfedf8f3b2423daeffa5a4c690ecc7ad45f11022637c1a66f3e95cf26b53411baf68b89112aaff5dc1c74cef79984c1f1fd781d45780a069611585bca5e5f03f189a3b63a1a993dabf1400cef8b2465273408fa706c91053653045c92fd40e2ebeeadb2e24ded005cce1e2f919f17befa4a5e946a96358291367e8ce2685eadef9344b03ae3df5ff70d139778dcb5e613c71037008408ead7ad140df69f38bb0a573696a80f70a047de9ef875dd26579932d5b3bab795e5fe8700696464c5cf0f2111a530e1ebca599d87f"}, 0x1015, 0x1)
shutdown(r0, 0x0)
ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000000c0)=<r2=>0x0)
sched_getaffinity(r2, 0x8, &(0x7f0000000100))
sendto$inet6(r1, &(0x7f0000000080)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)

[  918.792370] overlayfs: unrecognized mount option "workdi" or missing value
16:09:59 executing program 4:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir='])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)

[  918.924411] overlayfs: unrecognized mount option "workdir=" or missing value
[  919.220818] binder: 6347:6390 ioctl 2270 200001c0 returned -22
16:10:00 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)
r2 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1, 0x80)
ioctl$PPPIOCGCHAN(r2, 0x80047437, &(0x7f0000000200))

16:10:00 executing program 4:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir='])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)

16:10:00 executing program 2:
r0 = syz_open_dev$mouse(&(0x7f00000000c0)='/dev/input/mouse#\x00', 0x4, 0x109900)
write$UHID_SET_REPORT_REPLY(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e00000003000000ffffd00096ff21a1533cbf999c905a04009849d6014bd513220e31d4b7106975f3e11ef0b557f523c2fb1c905bd2462e538c3e36d98192fc822f15835fa2af1fc5cfb8fe20fc871d6e823e52539bc95856af6ab16adf920398102b50aeac8ef300a201d37767bb997f6e5fd0463a287c3f7b19bc6d32bc8743f7eb3307c208fb364314931e630ffd7b06dc06b2b95b8403d48a51d49a0b2ca250f9f4f15d72aea77caaf7b6562d66a17558d2e9e8aea1eb4f25a277046cc9803a077f2305a62aafcbf2036fc92a8e81619c6dbc27816a05b7236a"], 0xdc)
r1 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x1, 0x0)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, 0xffffffffffffffff, &(0x7f0000000200)=0x78a55b61603836dc)
pread64(r1, &(0x7f0000000080)=""/4, 0x3, 0x0)

16:10:00 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0xc5010000}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:10:00 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x20000148})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:10:00 executing program 2:
socket$inet6(0xa, 0x1, 0x0)
r0 = socket$inet6(0xa, 0x3, 0x31)
r1 = syz_open_dev$usbmon(&(0x7f00000001c0)='/dev/usbmon#\x00', 0x0, 0x48001)
ioctl$FIONREAD(r1, 0x541b, &(0x7f0000000200))
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
r3 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r3, 0x8912, &(0x7f0000000080)="025cc83d6d345f8f762070")
setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, &(0x7f0000000140)={'filter\x00', 0x3, [{}, {}, {}]}, 0x58)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r4, &(0x7f00000000c0)={&(0x7f0000000080)={0x10, 0xf50c}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x20, 0x27, 0x1, 0x0, 0x0, {0xc}, [@typed={0xc, 0x5, @u64}]}, 0x20}}, 0x0)
bind$netlink(r2, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc)
setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000002c0)={{{@in=@remote, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast1, 0xfffffffffffffffd, 0x33}, 0x0, @in6=@loopback, 0x0, 0x0, 0x0, 0x90}}, 0xe8)
connect$inet6(r0, &(0x7f00000000c0)={0xa, 0xfffffffffffffffe}, 0xffffffffffffffc9)
write$binfmt_misc(r0, &(0x7f0000000a80)={'syz1', "a88dca03e0df93730006de73f42b0e74d443bdc28645bf2fda74ed24e6e8c68e8db8a84e46c37f178cb27c9565c3a83c69b78119d9b2702314ac3909fe9231cb8adb75f50bae8905453e6e9f063581bca5fa2a4b260cd869bb4e76bffaf1b8d086df0d73741e0eb1593694d4c4c15b8ab5bebc9be916c232b3e943939491539a1472563b37ff20a7fda49531554872c9ff70e67a0420e7884795e8c99aa42a6f0b84bb92a92644963c0f4d1d1977cb3e0e190a2e53aba41631d5acecde7efdc7c0df3b3b76bcb1140b3dd5e99a15b999ce6cfb774a54ca01270810d90c6ae0d70e63486f389e68e4ce99c217bcaaf7449f52599029b3512e420a7d029642f2f86b69bd75315f71081ed1f29b9544dbf84bf3ae9e0248563a89cd7f6da74d7be34e6823118dc8fc4da7c48a1f319a3e4d1e588da603282a19f8d4d0ac67ea6e386db7c75a7021043baa416b38c44bca1158a68f44e75e466c88237adb81adf42d0440a3ccdff0bf6ce64416ee4781dbbdc8f8fdcc87250b791646673618b2f2a9afe74141ab1f5215b2885241b5dc6ed4d897dbd36e2009df097d9ee332184bc71e986b59eda38f0ac207b73ced382743189e29a6c13953382221efdcfe3e5c052d2ba3c7212d9de396c7580b48e8df689818beecdd1ee9acb0664f35a38d848f6caa8148a0fc34e39122a814c167e2f6ff17c6f7f56f5a40616244163c37afa3af6c05230766654e7ce37cfea899826f8d023b27e642d158102d60db112abecce457b8f8bb6835d8a7fa5fa1f8f94f5457fa648273ccd60bb7e2b4ed319e4d528c8de12428da3be485c0679d0d72f2311e992008b65f2a158fb89e6e9812c0729f22a970247bd2467366976e069021c871c20229129f1f99e0d369fcd70d10687671464490063c982c93dcccf9c1ef5c6131001af41c4366c2ec9150d4e6a8f8b04d8de782f7264f1e781da519b4d5f1c148e49166c60d4a5839c7b12da608ad2326129dc4d0ebad6fb7f6b49d59c912c4e9c68ddee45f50cdd95aec9c9b83f3dbef53f5ecfdc5e7504697a47e165683ff5225856888857b787aec43b8ecd7ee7bbaa9701e3a05974faf805e8e0775bebdb99b58cfab7d972429cf5b7da560424fc93db1e49856dd96e617faf0cbc48c39e0cf034d85695ce0b8d46b0cd8d15db8a06a9c21dbb1a4a579f9719728e3eca4e51d0ad77a097def02c2fee0006a5d9bdc0f5167286849e6825334b3730b0c664dc1acb87ab65b14f2d43fbb81746f3094d490f20fecc75e6af39b97155b2ec00317496dba1f356dfd3f44b668f95c14288c703bf957eda82d24569c9ef7009f3f927545c864ae7298539f520de1da316515c3812532f38f6f280e330863d1a520f299c3d04a01f3d6ed0e668f0379f9052b72ad30fa12d91f1b0fc90b705b8ab7c3c116f6dccf64ee29cabdc9de741b6aab1229f792478330b7d97bdf30f08da4606baa717328b83e8b7e9deb0da3e96080bc856d8e135e7c3417435c0ef95b0db61acfcd450744e51cbb88745a3036bb286fff8268fb7f89cc96d2efced0747f985f0b7b1c1207e99036a947cc9259a90824713dc885606c006a976270f860d603f69439817976475d655f7140f0631f467c14ed535e557394cc380ad6cc6a9516485dc81aa4a91357243ae568e7bba2284024a89fa4f5d59b4db6a89918f6343042d0660ee6a5469cbc695c11972349afb6f0170fd7140906592f74d6529d348f2862a1bf12c7f96cff1c4371da42ec6483a0ff687694d0a2e7cf55ec64aafa201f8ef096bcfe6b6ff0f6710420a9189e46b93c45fb478293437e92baa0bd00fc12d93642eb804be1e480838d53169f42253c951fe2dfaef229d866fed18db0ed5ea0e5bd5cedb969d1b3c64fe9e9ae03a31895b5954ddb899ad1def85a835c4191f884fee1756bcc8483a9dd498b1eefb69911136bc287481f3e1e05894bf402d8cfefd5edaf30c77d10f7a5bfc29d88e78eea17175f8e424e3024fd79d0322294017e4933162adea1a50a688e6cd43137240e6dbf1ea385ef4c1dd10dccd8ad00ba2d258fa7b8d37b4d210635f40586986b38aff568f97a4f30756978e5e4f56831a77324cae848c2dba4e407e771c481384f681d7dba940314777132dd5935d23ec035d674d3145850c9b2008d366b5c18e5de3fe922c20b8fee71a3603b8de40f1deab8939b21e650606cec05d2c37e370b2ad15aa85914ede4543374093905f5869613b8cdbd59b9dcdff8d7b8229b8e9af7977b09c932dc2322daa1ac701a99f5641a8477a54664b05314c52f6f6a898bcc81112c454764b3996aeeec8a99280c39cbaa4d06e60a4bc1efe9ccb187455e033469e3480bd91ef000cc79b857b5d3f25bfc7b49cac38a553435f9a222166a7ac9bce3c0b19073dbdd0d05343cb3402174a9afda2e3618af2bb7d5fd1e3d83b286fba7236adebd19660bf8fb1bd2ecb1263cc65ed9c07065cc972b600a558405c9975fb581cdb2704e9cfdb9214a52f31231d5dfcee87d5f2dd4069a597add652bab0f20ca01eae2a835be793bc227cc848585df2b68a08595ec10f27efb1ff5ffc19af4515a26b30a2194fb261ff61ef2cac7a776575fbe961fd98cd9055dfd2ae35bb58dafa5418af2f7d8b18b2557f603ebfabfa3e044cbf33ff32a56def0ab9c18ba24d91f501014c14148a1cb764cccf211c6caf106b0"}, 0x784)
ioctl$SG_SET_FORCE_PACK_ID(r3, 0x227b, &(0x7f0000000000)=0x1)

16:10:00 executing program 4:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir='])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)

[  919.510918] overlayfs: unrecognized mount option "workdir=" or missing value
[  919.569819] binder: 6391:6403 ioctl 2270 200001c0 returned -22
[  919.587959] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  919.617960] overlayfs: unrecognized mount option "workdir=" or missing value
16:10:00 executing program 4:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd'}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)

16:10:00 executing program 2:
syz_open_dev$usbmon(&(0x7f0000000380)='/dev/usbmon#\x00', 0x0, 0x0)
r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000600), 0xffffffffffffffff)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0xe, 0x24, &(0x7f0000001000)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d03010000000000950000000000000071260000000000006706000002000000bf25000000000000620500000e0000007365000000000000bf540000000000000704000004faff003d4301000000000095000000000000005d54090000000000bf250000000000000f65000000000000070500000e000000bf5400000000000007040000040000003d4301000000000095000000000000006154000000000000bf00000000000000070500000e0000001f6500000000000007050000040000000f65000000000000bf5400000000000007040000040000003d3201000000000095000000000000004d54000000000000b7000000000000009500000000000000"], &(0x7f0000000100)='GPL\x00'}, 0x48)
nanosleep(&(0x7f0000000080)={0x77359400}, &(0x7f00000000c0))
perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x3)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0)
acct(&(0x7f00000002c0)="2e2f66692e65318c00")
syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400100401000200027000f8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[])
ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r0, 0x4008240b, &(0x7f00000003c0)={0x7, 0x70, 0x20000000000000, 0xffffffff, 0x4, 0x1, 0x0, 0xce39, 0x100, 0xa, 0x100000000, 0x3f, 0x9, 0x40, 0x1, 0x1, 0xaf, 0xffff, 0x7f, 0x0, 0xb, 0x70, 0x6, 0x85, 0x5, 0xfff, 0x3, 0x200000000, 0x100000001, 0x1, 0x8d73, 0xffff, 0x1f, 0x3, 0x6, 0x0, 0x283, 0x6, 0x0, 0x3, 0x0, @perf_config_ext={0x21f, 0x6}, 0x10aa0, 0x3, 0x200, 0x0, 0xd43, 0x9})
openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0)
mknodat(0xffffffffffffffff, &(0x7f0000000180)="2e2f66692e65318c", 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000240)="2e2f66692e65318c00", &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000340)={'trans=fd,', {'rfdno'}, 0x2c, {'wfdno'}})
ioctl$PERF_EVENT_IOC_ID(0xffffffffffffffff, 0x80082407, &(0x7f0000000200))
readahead(r0, 0x6, 0x2)

16:10:00 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x1400000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  919.756516] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  919.790659] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:10:00 executing program 4:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd'}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x0, 0x0)

[  920.000964] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
16:10:01 executing program 4:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd'}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x0, 0x0)

[  920.288690] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  920.379127] binder: 6391:6438 ioctl 2270 200001c0 returned -22
16:10:01 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x10}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:10:01 executing program 4:
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd'}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x0, 0x0)

16:10:01 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x200002c8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:10:01 executing program 2:
syz_open_dev$usbmon(&(0x7f0000000380)='/dev/usbmon#\x00', 0x0, 0x0)
r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000600), 0xffffffffffffffff)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0xe, 0x24, &(0x7f0000001000)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d03010000000000950000000000000071260000000000006706000002000000bf25000000000000620500000e0000007365000000000000bf540000000000000704000004faff003d4301000000000095000000000000005d54090000000000bf250000000000000f65000000000000070500000e000000bf5400000000000007040000040000003d4301000000000095000000000000006154000000000000bf00000000000000070500000e0000001f6500000000000007050000040000000f65000000000000bf5400000000000007040000040000003d3201000000000095000000000000004d54000000000000b7000000000000009500000000000000"], &(0x7f0000000100)='GPL\x00'}, 0x48)
nanosleep(&(0x7f0000000080)={0x77359400}, &(0x7f00000000c0))
perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x3)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0)
acct(&(0x7f00000002c0)="2e2f66692e65318c00")
syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400100401000200027000f8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[])
ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r0, 0x4008240b, &(0x7f00000003c0)={0x7, 0x70, 0x20000000000000, 0xffffffff, 0x4, 0x1, 0x0, 0xce39, 0x100, 0xa, 0x100000000, 0x3f, 0x9, 0x40, 0x1, 0x1, 0xaf, 0xffff, 0x7f, 0x0, 0xb, 0x70, 0x6, 0x85, 0x5, 0xfff, 0x3, 0x200000000, 0x100000001, 0x1, 0x8d73, 0xffff, 0x1f, 0x3, 0x6, 0x0, 0x283, 0x6, 0x0, 0x3, 0x0, @perf_config_ext={0x21f, 0x6}, 0x10aa0, 0x3, 0x200, 0x0, 0xd43, 0x9})
openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0)
mknodat(0xffffffffffffffff, &(0x7f0000000180)="2e2f66692e65318c", 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000240)="2e2f66692e65318c00", &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000340)={'trans=fd,', {'rfdno'}, 0x2c, {'wfdno'}})
ioctl$PERF_EVENT_IOC_ID(0xffffffffffffffff, 0x80082407, &(0x7f0000000200))
readahead(r0, 0x6, 0x2)

16:10:01 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)
r2 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x1, 0x0)
getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000200)={0x3, [0x0, <r3=>0x0, 0x0]}, &(0x7f0000000240)=0x10)
getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000000280)={r3, 0x1}, &(0x7f00000002c0)=0x8)

16:10:01 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x58020000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  920.901511] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  920.939708] binder: 6447:6461 ioctl 2270 200001c0 returned -22
16:10:02 executing program 4 (fault-call:2 fault-nth:0):
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd'}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)

16:10:02 executing program 2:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='setgroups\x00')
setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000e80)=0x9, 0x4)
mkdir(&(0x7f0000000000)='./file0\x00', 0x40)
rt_sigaction(0x18, &(0x7f00000002c0)={&(0x7f00000001c0)="660f3a60530700460fa22e660fd01c768f296001786a66660f3805170f1827366566420f3829f48f897812c7410f802cf30000c4c24191844bf1000000", {0x5}, 0x40000000, &(0x7f0000000280)="670f6f700fc4c2d59004c8c462f922ef2e2626f2abc4a27918aef56800002664420f2e1e6626662e66420f71d40bc401925d7d3cc4a155d5e4460fda02"}, 0x0, 0x8, &(0x7f0000000440))
r1 = inotify_init()
r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vga_arbiter\x00', 0x101000, 0x0)
ioctl$sock_bt_hidp_HIDPGETCONNLIST(r2, 0x800448d2, &(0x7f0000000400)={0x1, &(0x7f0000000340)=[{}]})
inotify_add_watch(r1, &(0x7f0000001740)='./file0\x00', 0x80)
write$binfmt_aout(r1, &(0x7f0000000480)={{0x1cf, 0x1, 0x6, 0x57, 0x11c, 0x4, 0xcc, 0x400}, "0e8b9de51db6a2f4c5e1623d9b16", [[], [], [], [], []]}, 0x52e)
r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100)='/dev/snapshot\x00', 0x8200, 0x0)
ioctl$sock_bt_hidp_HIDPGETCONNLIST(r2, 0x800448d2, &(0x7f0000000080)={0x8, &(0x7f00000009c0)=[{}, {}, {}, {}, {}, {}, {}, {}]})
getsockopt$inet6_tcp_int(r3, 0x6, 0x15, &(0x7f0000000140), &(0x7f0000000180)=0x4)
bind$llc(r2, &(0x7f0000000040)={0x1a, 0x7, 0x6, 0x3, 0x3f, 0x4, @broadcast}, 0x10)

[  921.009859] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  921.100117] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  921.157599] FAULT_INJECTION: forcing a failure.
[  921.157599] name failslab, interval 1, probability 0, space 0, times 0
[  921.229632] CPU: 1 PID: 6471 Comm: syz-executor4 Not tainted 4.19.0-rc7-next-20181015+ #94
[  921.238102] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  921.247468] Call Trace:
[  921.250081]  dump_stack+0x244/0x39d
[  921.253748]  ? dump_stack_print_info.cold.1+0x20/0x20
[  921.258972]  should_fail.cold.4+0xa/0x17
[  921.263151]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  921.268285]  ? __f_unlock_pos+0x19/0x20
[  921.272279]  ? lock_downgrade+0x900/0x900
[  921.276446]  ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20
[  921.282000]  ? proc_fail_nth_write+0x9e/0x210
[  921.286521]  ? find_held_lock+0x36/0x1c0
[  921.290610]  ? virtio_gpu_gem_object_close+0x598/0x5f0
[  921.295931]  ? perf_trace_sched_process_exec+0x860/0x860
[  921.301391]  ? __lock_is_held+0xb5/0x140
[  921.305478]  __should_failslab+0x124/0x180
[  921.309733]  should_failslab+0x9/0x14
[  921.313553]  __kmalloc_track_caller+0x2d1/0x760
[  921.318253]  ? strncpy_from_user+0x5a0/0x5a0
[  921.322680]  ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20
[  921.328225]  ? strndup_user+0x77/0xd0
[  921.332047]  memdup_user+0x2c/0xa0
[  921.335617]  strndup_user+0x77/0xd0
[  921.339269]  ksys_mount+0x3c/0x140
[  921.342827]  __x64_sys_mount+0xbe/0x150
[  921.346824]  do_syscall_64+0x1b9/0x820
[  921.350731]  ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
[  921.356119]  ? syscall_return_slowpath+0x5e0/0x5e0
[  921.361068]  ? trace_hardirqs_on_caller+0x310/0x310
[  921.366119]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[  921.371159]  ? post_copy_siginfo_from_user.isra.25.part.26+0x250/0x250
[  921.377840]  ? __switch_to_asm+0x40/0x70
[  921.381915]  ? __switch_to_asm+0x34/0x70
[  921.385999]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  921.390866]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  921.396067] RIP: 0033:0x457569
[  921.399293] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  921.418207] RSP: 002b:00007feb5b4acc78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[  921.425933] RAX: ffffffffffffffda RBX: 00007feb5b4acc90 RCX: 0000000000457569
[  921.433221] RDX: 0000000020000280 RSI: 0000000020000240 RDI: 0000000020000040
[  921.440502] RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000
[  921.447785] R10: 0000000000000020 R11: 0000000000000246 R12: 00007feb5b4ad6d4
[  921.455068] R13: 00000000004c289b R14: 00000000004d3c78 R15: 0000000000000003
16:10:02 executing program 2:
r0 = syz_open_dev$adsp(&(0x7f0000000080)='/dev/adsp#\x00', 0x0, 0x2)
ioctl$KVM_S390_UCAS_MAP(r0, 0x4018ae50, &(0x7f00000000c0)={0xffffffff, 0x0, 0x2})
r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0)
ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000000040)={&(0x7f0000ffd000/0x2000)=nil, 0x2000})

[  921.619425] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:10:02 executing program 2:
pipe(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cuse\x00', 0x2, 0x0)
splice(r1, 0x0, r0, 0x0, 0x8fd, 0x0)

[  921.726276] binder: 6447:6483 ioctl 2270 200001c0 returned -22
16:10:02 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x10000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:10:02 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x7}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:10:02 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x2a})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:10:02 executing program 4 (fault-call:2 fault-nth:1):
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd'}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)

[  921.958697] binder: 6494:6500 ioctl 2270 200001c0 returned -22
16:10:03 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x700}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  922.292868] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  922.311203] FAULT_INJECTION: forcing a failure.
[  922.311203] name failslab, interval 1, probability 0, space 0, times 0
[  922.340913] CPU: 0 PID: 6502 Comm: syz-executor4 Not tainted 4.19.0-rc7-next-20181015+ #94
[  922.349352] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  922.358717] Call Trace:
[  922.361331]  dump_stack+0x244/0x39d
[  922.365433]  ? dump_stack_print_info.cold.1+0x20/0x20
[  922.370657]  should_fail.cold.4+0xa/0x17
[  922.374741]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  922.379957]  ? save_stack+0x43/0xd0
[  922.383593]  ? kasan_kmalloc+0xc7/0xe0
[  922.387495]  ? __kmalloc_track_caller+0x157/0x760
[  922.392352]  ? memdup_user+0x2c/0xa0
[  922.396095]  ? do_syscall_64+0x1b9/0x820
[  922.400186]  ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  922.405571]  ? proc_fail_nth_write+0x9e/0x210
[  922.410106]  ? find_held_lock+0x36/0x1c0
[  922.414215]  ? perf_trace_sched_process_exec+0x860/0x860
[  922.419685]  ? lock_release+0xa10/0xa10
[  922.423677]  ? perf_trace_sched_process_exec+0x860/0x860
[  922.429165]  __should_failslab+0x124/0x180
[  922.433418]  should_failslab+0x9/0x14
[  922.437237]  __kmalloc_track_caller+0x2d1/0x760
[  922.441927]  ? strncpy_from_user+0x5a0/0x5a0
[  922.446353]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  922.451910]  ? strndup_user+0x77/0xd0
[  922.455724]  memdup_user+0x2c/0xa0
[  922.459281]  strndup_user+0x77/0xd0
[  922.462931]  ksys_mount+0x73/0x140
[  922.466493]  __x64_sys_mount+0xbe/0x150
[  922.470487]  do_syscall_64+0x1b9/0x820
[  922.474398]  ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
[  922.479783]  ? syscall_return_slowpath+0x5e0/0x5e0
[  922.484726]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  922.489588]  ? trace_hardirqs_on_caller+0x310/0x310
[  922.494619]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[  922.499852]  ? prepare_exit_to_usermode+0x291/0x3b0
[  922.504893]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  922.509764]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  922.514970] RIP: 0033:0x457569
[  922.518180] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  922.537961] RSP: 002b:00007feb5b4cdc78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[  922.545683] RAX: ffffffffffffffda RBX: 00007feb5b4cdc90 RCX: 0000000000457569
[  922.552963] RDX: 0000000020000280 RSI: 0000000020000240 RDI: 0000000020000040
[  922.560240] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000
[  922.567523] R10: 0000000000000020 R11: 0000000000000246 R12: 00007feb5b4ce6d4
[  922.574804] R13: 00000000004c289b R14: 00000000004d3c78 R15: 0000000000000003
16:10:03 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200)='/dev/net/tun\x00', 0x8000, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  922.734488] binder: 6494:6513 ioctl 2270 200001c0 returned -22
16:10:03 executing program 4 (fault-call:2 fault-nth:2):
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd'}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)

16:10:03 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x800000000000000}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:10:03 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000001500)={r1, r1, 0x5, 0x40, &(0x7f0000000500)="8480fd4a47d990087d9835675b0639cc7b5e82f450e3126838fd3cc3e43a7247ad497cdb8aabe1fb687dee33fdb271f841e9dc0f9ca6c7132d1efd9cb1b057fa6a539bb7498b74479cb0d2053c37558c066a3890b5e46bdf89f86bdfe3b817e7b91ac82fe405c9149fd2db029fd1dcc5f35b645bb917393b5736f34b07be437d429a3dd58dd9f093bdc8c5204aa1efacfc3071482641b2d7af42a251ec82648750225a286ebe901f0506c84af1d9336ef59ba33accf6f65f64475e8c4cc157fb4d6c894617095e4a9956607e7dfdb72516d60eb45fce19fa2bf6f49ed8afd808ec33c44dfb8fcbea78430ab82fbe39f8072f3717b0afd052bc19780d97848301ef7feac80ae79520dc948aabb521792d622ab8a6f5377053781460aeac2aef3445d6f4e45785b61ce114a298656ef1418dc584abbcf54eeddb79a6f87d9ef4b2f4223afa7ed171a7caffd2d0694de3ccccb132686544b76a04f6c56fde86e8ec8e86523e28e42f60d2a9da26c92102ddf1f229f198052ca335fa1b07a51c9a13a2457bd7b362b73ad9c40da6cb6df79a0e246529f8d7602c2f3f9efdcff65b4fafff03d310ea468f14aee5b987b305e9161cacf7ebb1632519ca3a508a79f16d41ed246d2953c6f298d64af9ebc31a7066daaae5c27d254ae3f19133d9bc8b2fad760d715051fcd05c1415963a7a88cf8b7674567f11d28ae9f20c6cd4d69f754e999071d8d5b27366767f0fbb119fd6843dd4eaca321ac6462a69c5fd47fb48d2b8d3ddd232566015291aa99baad42d474075b0f0161de0df2ac09358e9ac9ab7f32e84c81f578bd985517689c69dc75edfd623aca2d5c7427f56f6f926dc684cc9fb7a41f64c3502395e20761852634b107aa3213a4d675d0f6cbe613c68af266eceb49c79019420232e19ba1714dcfc7f55187e7b76e459d661bf57236761edaadbaeb46d1ffddd0244da35248362bae890b9b77ccacf88808dc8719e9bbe03de4b90fcb5c502f8f5cdda22673ee4c8a649de84638e1e288c2151b72f405c0ba3af37bfb310e213a812dbd4c969885f1ebe34b20328ac13fe6601199f01d8f2e69fe3150f31d890b13dfe4508459511f1d45d67cf3517bac503cbd0120ced430d83ebf3287db31da7a9e6c3b56d111ee06c33aceb2d815609c7f35873b3c1610b8d713fbb009523e9e2ef5292e1b4caef0bde33987114a55293e9fa0dc88c4649a7e10a42c3b25ccd2a0b1772533f920470f0b1b149c54963e80b4b664c973940f5d128d7572e7c00a8d12d527ef674ab1a8aa9ea67dc0ec71babb8aec908ff3779d3eaf02240e42ca7cb0c3af03312201240f36cd723f4a27123601e1111e90c26b99de7dd9d7862a656ea747b8db12dcfe3962858fafd14fc73f6bd7ae12a447efc413b9e68e23633edbeaec94f8170cda70f20df4021b1a6e1d13018188863f1cf1ff9933d5af8b7edb51e8817f49edd8a9579354aa3cb02c77737768682365efeb02ec1cded04beee8eea8272c8edf34669187360a5aeda82a34fe51a872c52bd84a9bc89966ca0026de1433e37d5620c821246ea883056b7c5f207304e5b60e3b3e50cd88a25614efa9ae44cc91b33721424080addc592285313ba26f766e2432308125eee640c83b61f9493d7aff0e5e745b836583c9301badaed35e9a32fe2a9017641625f3da571557528e8d65a2576c0b765bf3b23a0f1e9a23cfd0e9a54373fa1da5d53c3e83bb3815d2264af48f4ea4f3aace52107925223a2fb7fe16c5d97bd791e2b2db78a0a9977607f5cfc78b720f83e43f58a112610b6fa5c1e82142e1dbc42668bdc065592d200181ca94ce9c81bbee7c1298b50dd8cf6402fda405a7b2d3f71a6242fb61b3e2dcc15e3613f4ce95a0f56761dcf478d167724b2f979fb8709b789ae4b0cd74538466104c0ad55d088fc6eb9a16fba3525d6b9781cb4ebd69bc52e9bc00a87192122b9c7b3e9fdc69e8df031600688275a4d06279b91d825b186ac56dec025d90663998e2e508a6968b55865f669e0f59f652030a1e8dbdc203b2ce6939c8eb825f481627b1b151c93f54838b33ae2bc7190b8656839721332ea473b13452834416dfe4c068004eb3e455f0e4f874abb9d1736d7204b18cb3b55b64e5a1048984d16098b57c574cb4039d6e665531399afda5347ec9af70424e60e02c4015a23d60c9d11eeec52125fb489ecfa17667cdf27d1ba902986417e643eab9e07dd8eb9c524c603985579413ce49ce1a9974682abc9561e00a82f208dfd1425e71fc8fde31f34d2d9ba1d38b0995ade64255fa92a1680fd54ebb0c840ea23d82a86aed402614ef151fe8ea29e8ca6d336910a4f802069f674b6eacb5c7c7f1ce37950144d936f400ff27ed38b094fa5c3daad0659201e37ebda20d609b8c6463aa818cb0272a342e7d3630d76f2f2d89bccdd1385d8354887f4a041f44443d29786abd8a502cc8a71434fd9c5139a4ece6b209a23b1225419dff34f4ac8162ee31b226a8dfd1e1dd8827108cf5671294746323b7df8b38dcd07d62b7ddf483bdb7bfc700a00c907a3ffb7404786ffeb663e57317161d4518fc6af66229cc59f7c7488e08e6fc5a5e06433269f6cd1fdc1aad90e9b32815dc01273a46ff36ea77b21f8c6dfa7410e3ef8e67215170e3b359d19251c653462f096fc84c48c9faf71372577c6d46269c670a99889697574b6b67cef03dda1a96d7e3eff48c2bc5cef74bfd6646382a9425e11fa21d39a4f64708fc839008ce93c96fc365d3a555c7c0913f3675de1cc8dbb621d44c25935006fceee847a8e572dbe6f283b12b2fc5fb4eeffcc4d8b1e464e922e3226a5495bbee1f8decd9e5e6297f4d5861bf25b73a7728334b2df72de8348a8a8b0bf800fd8ba888bbd9e07f8b5a2ac34b5ea0eb8006b27bde074cea3ea9acc74b692821d98ed8c286f68037ab731a287829945149b80c52fbd6855567a04f5c631ec4dea3712a017668f11bdab9f89ddeec6e2465af8f017268947d28c53ad7b5559c2ba14d0d21a2694db06431ccc8117dc1095587426c32e5420b503f5b00eb186b716ee174c4980658cf007ee0dd734087d5245704213c9e03afee6bf7ae4e5a366f335f76b9fbb818251717e9ef736f8816e2d6e73e76dd265a359cfaccfb719ba81dcb23d0ae75a35b73e84a207679b84bcaf44d14fd36ce056bc600db5e1e5e88e69046e1f364300d5311aefaab24288c3acd22e8c4e0dad51e16b80ded6c1b53520adcba452eacb4cfe5951606ef7f92927a4bcfa2e0085da5cc2199e268d86db9513f100f329fcc3432c8f10b7882909c970938ff5f9d946c991f6b621d067b03436a3765111813549ca4fbedc60cf680da29f9d358368932fb46ee04f170e29799575e8cab4574ea8b7d18dc490353eb785dad2e32e37dabd8364538103434eed89e5889880e4e76569184dd350022c9ecfa5bc0e2545f0242e8d7aa832ca272c530b749427a04c728b2f6e538c1f87ecfcd613e0c9c07a38e494b606722d1f88528bd81cd0c3fca0de93386f678bf1a65378126d5121a660d60d0c7ddb513a399e47aef07cd95f95bca9cf713ed55d4e4069d2a1e0865ee62b3cc24501a7f853740b2f193849434d17c8ba33323ebf49141428861e7787ae1c9d14baa3f869f716283789862e434984fd2c5123ed3aca95e03f8b116f4a56725eb6b501e4e7eac24f602d535c713b9f1712a87c440f22b86a5656c4ef047ef272007d5c70a823952e5d3b3d7c1d35dbe924ca5ed00e95a153555d995741e9742c871f47aecd2c43ad4a3be7a8ef0c600be6edc617decfb3b9a2f0eed75eec5b304a39203b3a3e3fe60b4c1fe3f190ad0c7b418b79241f1c6a32fedcf92d9f1f0784c715473458be16fda7bccf04960565ab9216078694af16ba2d3c85c6f150ec45bf267e7908f39cf877f94228946ead4214fb2e96aa7cb1118f2a7ac01f0fa08e73d7320a54b9df24542432f8dd852372bac670d467c65c78027fdca312fae780d3eeb31a71871ffc83bcd6b50b502305af3e60a7adc865fba369dceba4563adf123ab2573f38b516838ce7a065451c11f93ec490ba194e9e6edaa53ddcbc7eedd35eb265bded5dbd402211ee5ecf53e1f77785974ce08f5d5ec017d8df4f7a0fb1503a662286a1467f595d9b6d7985e4104950783ebfd3a244152e728103162db755764c14722a0bb4722321293b190caa088948dddedc1c8fb4b212a5fe8d5c934fb4f2ba950435e6552aa2e470adcb14fc54feb93391fa2cdf978d88fa59e6aed565f5107937af3a1123eb300a9dc095c2531c48aeb0ab1ebcea665721e95675de235ae9b6f046392f77ed4c4e7ef31b925f1e062bccc0ee149e6add713c2ae4e8e6f927f39e7848c57b7c82a63356e85edf5a6ee9998c4ea462378c185ca1e101799946f57656777dc872a74d26ab1ee7970097a80b57f709ebcecca1076112a0361705c54867d7b81ef355a476b21f111dfc7ad116e3dbb7a9bf0afbe40e84f0e07cad741719e38d04615ddd7bcc339f8b04fb02c62d58eea4b30dcc2f3be5f4313b3a8d1f00f6a18669119815beaafc6599047ec981d0a376a1149c3c96691ab0acdd0b3c17590bd1e8ee8e2258bb635e4a930deb62ce3e96141611f7cc12c3ca8042667dcde1d4cfa3ed93e146adc6b434a8ca1c279d126f0f466054d6e0d1fc915c2fbafccb01ad7a14649d2ae1ee02427654e8ee23325d170d53d2460962c6b7dc1d29747dbd193470421dcf41ec6e7aa83dadccb5ce8c6ccd6eebf27d66d7e84d0be2108690cdf6a5395b719c0f972415f8060581f23ee78248dc998350f2ecba77cd5f7b2902c854ef14c22883749ede613e4be6b35b31ed3c2449a0d32b8e8399ce9a9fb26db4102e01934de5978d451370bb82c078a8b797bd8e06e6f6cb3db01949b93f8e09f82ade2879aa84eb54892c8edb9bde62268f86e91c5d612287613b09a3e191d471677d340deeb2fd8c6d689ad871e4b038699ed4a8f5ca80d135546abb2bd9048d9cf50816633b083f1509c1e20f4750a703c0999c2412c8a7d3d6d09ac133994b5f6dffdf6919da6f384b49b07d145279a1c0307a96e1bdd87b89cf444ed44187ba1fe7435d617fea6e175553144ba12fc929cba5a6e17ff4dfece8ddd8babd776a2e81b4d0832097feb600cc70f725188f90d14fbf6981da063f3f35f9df8a35003bf82be26ef8178738bb731994df3a9019f8ab0e7c9b917dda87106230ddd721930ca8802d99771d261c3e02e9f9cd6dcfe294c77ede83bc6ae8394b3220f6dd42db759de68d7448071052a40e5aaa008bf0c8b0c28ab09df10346f98f34079c41a6fa3a59dcf49d4517c14da19cd055760224ee6b6071a4864c28ddd2418eb435d17334f9c5839762ac585fdee7d1bdd7dbfc479e76965f160062697958e8bdc26b9501bd16477154a6741063473687f6d61a9016f7e6ab50a555816602e19bf97c94d8e175cac3dd580dda62eb537f8632aa0ddda4e6683bf82a22b838351110d79259db8a4911078afa4de8001ecb410f52b161df4f51fa81027aeb0b89b5b972bf5202dfd5c3f562729210edde0846445af29a4a1541fbb5798c4e042257605ae51a8824d83e498f569dcffd4cc313107380687ba45a2dacad0cf98f3329de6bf22ceb93d789c2ecdb7733b468d377c62b6789a10441a7823a556d624abec3b4743c4ea0ecefe8d8b7a12b7c702ce6e17926c8dd75c237e5c92f01b1cad2e9c3e7bc7cb174e25f090da18589d84b423bb769ff36769c", 0x80000000, 0xbd, 0xf8e1, 0x7fff, 0x0, 0xffffffff, 0x6, "654f46291639329e6b7f70a2715e59b2aa1e2d9884e7dff08748879d95e6161cbaf0291e0771725f3cf6aaadfba422835e1fe1a14b2de634608bcb20796c8cd1179b9babff16cc64ad4ae63308a10fda5a5e9239b046d498a7fdef89a2bc7184b92d974fc9c42e7ece4b230501c7997c04c5272668105a46687b45c8e1f6a000795b5afa1da431111ec3fa2e2b5badc59a16c9f7e5bb0169b5a4cba3a89960a1283d"})
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  922.845286] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  922.920097] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  922.935258] FAULT_INJECTION: forcing a failure.
[  922.935258] name failslab, interval 1, probability 0, space 0, times 0
[  922.947406] CPU: 1 PID: 6525 Comm: syz-executor4 Not tainted 4.19.0-rc7-next-20181015+ #94
[  922.955831] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  922.965196] Call Trace:
[  922.967791]  dump_stack+0x244/0x39d
[  922.971460]  ? dump_stack_print_info.cold.1+0x20/0x20
[  922.976671]  should_fail.cold.4+0xa/0x17
[  922.980725]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  922.985829]  ? rcu_read_unlock_special+0x1c0/0x1c0
[  922.990757]  ? kasan_check_read+0x11/0x20
[  922.994920]  ? mark_held_locks+0x130/0x130
[  922.999167]  ? find_held_lock+0x36/0x1c0
[  923.003268]  ? perf_trace_sched_process_exec+0x860/0x860
[  923.008735]  ? save_stack+0x43/0xd0
[  923.012374]  ? kasan_kmalloc+0xc7/0xe0
[  923.016269]  __should_failslab+0x124/0x180
[  923.020495]  should_failslab+0x9/0x14
[  923.024297]  kmem_cache_alloc+0x2be/0x730
[  923.028455]  getname_flags+0xd0/0x590
[  923.032248]  user_path_at_empty+0x2d/0x50
[  923.036428]  do_mount+0x180/0x1d90
[  923.039960]  ? lock_release+0xa10/0xa10
[  923.043923]  ? perf_trace_sched_process_exec+0x860/0x860
[  923.049377]  ? copy_mount_string+0x40/0x40
[  923.053647]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  923.059192]  ? _copy_from_user+0xdf/0x150
[  923.063354]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  923.068896]  ? copy_mount_options+0x315/0x430
[  923.073383]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  923.078909]  ksys_mount+0x12d/0x140
[  923.082541]  __x64_sys_mount+0xbe/0x150
[  923.086530]  do_syscall_64+0x1b9/0x820
[  923.090421]  ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
[  923.095788]  ? syscall_return_slowpath+0x5e0/0x5e0
[  923.100707]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  923.105548]  ? trace_hardirqs_on_caller+0x310/0x310
[  923.110555]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[  923.115565]  ? prepare_exit_to_usermode+0x291/0x3b0
[  923.120588]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  923.125460]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  923.130667] RIP: 0033:0x457569
[  923.133881] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  923.152788] RSP: 002b:00007feb5b4cdc78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[  923.160500] RAX: ffffffffffffffda RBX: 00007feb5b4cdc90 RCX: 0000000000457569
[  923.167756] RDX: 0000000020000280 RSI: 0000000020000240 RDI: 0000000020000040
[  923.175012] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000
[  923.182278] R10: 0000000000000020 R11: 0000000000000246 R12: 00007feb5b4ce6d4
[  923.189548] R13: 00000000004c289b R14: 00000000004d3c78 R15: 0000000000000003
[  923.205701] binder: 6523:6528 ioctl 2270 200001c0 returned -22
16:10:04 executing program 4 (fault-call:2 fault-nth:3):
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd'}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)

[  923.257997] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
16:10:04 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x1000000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  923.364182] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  923.421640] FAULT_INJECTION: forcing a failure.
[  923.421640] name fail_page_alloc, interval 1, probability 0, space 0, times 0
[  923.433514] CPU: 0 PID: 6535 Comm: syz-executor4 Not tainted 4.19.0-rc7-next-20181015+ #94
[  923.441934] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  923.451304] Call Trace:
[  923.453924]  dump_stack+0x244/0x39d
[  923.457586]  ? dump_stack_print_info.cold.1+0x20/0x20
[  923.462801]  ? mark_held_locks+0x130/0x130
[  923.467070]  should_fail.cold.4+0xa/0x17
[  923.471171]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  923.476314]  ? mark_held_locks+0x130/0x130
[  923.480572]  ? print_usage_bug+0xc0/0xc0
[  923.484657]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  923.490220]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  923.495776]  ? check_preemption_disabled+0x48/0x280
[  923.500803]  ? find_held_lock+0x36/0x1c0
[  923.504886]  ? debug_smp_processor_id+0x1c/0x20
[  923.509575]  ? perf_trace_lock_acquire+0x15b/0x800
[  923.514527]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  923.520082]  ? should_fail+0x22d/0xd01
[  923.524000]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  923.529133]  ? rcu_read_unlock_special+0x1c0/0x1c0
[  923.534102]  __alloc_pages_nodemask+0x34b/0xdd0
[  923.538800]  ? __alloc_pages_slowpath+0x2dd0/0x2dd0
[  923.543847]  ? find_held_lock+0x36/0x1c0
[  923.547939]  ? des3_ede_decrypt+0x588/0x1820
[  923.552385]  ? trace_hardirqs_off+0xb8/0x310
[  923.556813]  cache_grow_begin+0xa5/0x8c0
[  923.560892]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  923.566444]  ? check_preemption_disabled+0x48/0x280
[  923.571482]  kmem_cache_alloc+0x66b/0x730
[  923.575659]  getname_flags+0xd0/0x590
[  923.579481]  user_path_at_empty+0x2d/0x50
[  923.583653]  do_mount+0x180/0x1d90
[  923.587211]  ? lock_release+0xa10/0xa10
[  923.591202]  ? perf_trace_sched_process_exec+0x860/0x860
[  923.596675]  ? copy_mount_string+0x40/0x40
[  923.600942]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  923.606514]  ? _copy_from_user+0xdf/0x150
[  923.610699]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  923.616253]  ? copy_mount_options+0x315/0x430
[  923.620769]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  923.626326]  ksys_mount+0x12d/0x140
[  923.629970]  __x64_sys_mount+0xbe/0x150
[  923.633967]  do_syscall_64+0x1b9/0x820
[  923.637876]  ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
[  923.643259]  ? syscall_return_slowpath+0x5e0/0x5e0
[  923.648207]  ? trace_hardirqs_on_caller+0x310/0x310
[  923.653239]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[  923.658270]  ? post_copy_siginfo_from_user.isra.25.part.26+0x250/0x250
[  923.664951]  ? __switch_to_asm+0x40/0x70
[  923.669026]  ? __switch_to_asm+0x34/0x70
[  923.673116]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  923.677996]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  923.683210] RIP: 0033:0x457569
[  923.686422] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  923.705337] RSP: 002b:00007feb5b4acc78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[  923.713055] RAX: ffffffffffffffda RBX: 00007feb5b4acc90 RCX: 0000000000457569
[  923.720347] RDX: 0000000020000280 RSI: 0000000020000240 RDI: 0000000020000040
[  923.727632] RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000
[  923.734914] R10: 0000000000000020 R11: 0000000000000246 R12: 00007feb5b4ad6d4
[  923.742193] R13: 00000000004c289b R14: 00000000004d3c78 R15: 0000000000000003
[  923.785898] binder: 6523:6543 ioctl 2270 200001c0 returned -22
16:10:05 executing program 1:
openat$userio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/userio\x00', 0x0, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$binder(&(0x7f00000004c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r3=>0x0})
ioctl$KVM_TPR_ACCESS_REPORTING(r0, 0xc028ae92, &(0x7f0000000180)={0xfffffffffffffff6, 0x42})
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0))
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x10}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:10:05 executing program 3:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0)={0x7000000}, 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

16:10:05 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000240)={0x0, 0x8000})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={<r3=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x4001fd)
ioctl$KVM_NMI(r2, 0xae9a)
ioctl$KVM_GET_DIRTY_LOG(0xffffffffffffffff, 0x4010ae42, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000ffc000/0x2000)=nil})
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000300)=[@text16={0x10, &(0x7f0000000340)="643e67660f3a61ca9bbaf80c66b8bc5d158866efbafc0c66ed66b9800000c00f326635001000000f30f40f38c94bf80f380b5775260f01ca0f21360f180ad810", 0x40}], 0x2d3, 0xfffffffffffffffc, &(0x7f0000000280), 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

16:10:05 executing program 4 (fault-call:2 fault-nth:4):
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.'])
mount(&(0x7f0000000040)=@nbd={'/dev/nbd'}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='ocfs2\x00', 0x20, 0x0)

16:10:05 executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'lo\x00', 0x800})
r1 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r0, &(0x7f00000001c0)=""/39, 0x27, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="2800000010005fba000000000000000000000000", @ANYRES32=0x0, @ANYBLOB="0300000000000000faff1b00aa4d7163cc81c04e648a4962f9209700000000"], 0x28}}, 0x0)

16:10:05 executing program 5:
fanotify_init(0x2, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
timerfd_create(0x0, 0x0)
write(r1, &(0x7f0000000340), 0x10000014c)
signalfd4(0xffffffffffffffff, &(0x7f0000000340), 0xfffffffffffffccc, 0x0)
clock_gettime(0x0, &(0x7f0000000400))
clock_gettime(0x0, &(0x7f0000000440))
clock_gettime(0x0, &(0x7f0000000480))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0)={0x64, 0x0, 0x0, 0xc5010000}, &(0x7f0000000100), &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x1400000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8})
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

[  924.810250] netlink: 8 bytes leftover after parsing attributes in process `syz-executor0'.
[  924.819689] overlayfs: option "workdir=." is useless in a non-upper mount, ignore
[  924.829687] FAULT_INJECTION: forcing a failure.
[  924.829687] name failslab, interval 1, probability 0, space 0, times 0
[  924.841411] CPU: 1 PID: 6552 Comm: syz-executor4 Not tainted 4.19.0-rc7-next-20181015+ #94
[  924.849834] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  924.849842] Call Trace:
[  924.849871]  dump_stack+0x244/0x39d
[  924.849900]  ? dump_stack_print_info.cold.1+0x20/0x20
[  924.870658]  should_fail.cold.4+0xa/0x17
[  924.874746]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  924.879873]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  924.885434]  ? check_preemption_disabled+0x48/0x280
[  924.890471]  ? rcu_lockdep_current_cpu_online+0x1a4/0x210
[  924.896023]  ? find_held_lock+0x36/0x1c0
[  924.900108]  ? rtl92ce_update_hal_rate_tbl+0x758/0x14a0
[  924.905496]  ? perf_trace_sched_process_exec+0x860/0x860
[  924.910958]  ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20
[  924.916508]  __should_failslab+0x124/0x180
[  924.920753]  should_failslab+0x9/0x14
[  924.924562]  kmem_cache_alloc_trace+0x2d7/0x750
[  924.929248]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  924.934795]  vfs_new_fs_context+0x5e/0x77c
[  924.939034]  ? ns_capable_common+0x13f/0x170
[  924.943464]  do_mount+0xb70/0x1d90
[  924.947015]  ? lock_release+0xa10/0xa10
[  924.951000]  ? copy_mount_string+0x40/0x40
[  924.955262]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  924.960805]  ? _copy_from_user+0xdf/0x150
[  924.964965]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  924.970506]  ? copy_mount_options+0x315/0x430
[  924.975008]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  924.980551]  ksys_mount+0x12d/0x140
[  924.984187]  __x64_sys_mount+0xbe/0x150
[  924.988173]  do_syscall_64+0x1b9/0x820
[  924.992068]  ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
[  924.997450]  ? syscall_return_slowpath+0x5e0/0x5e0
[  925.002385]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  925.007240]  ? trace_hardirqs_on_caller+0x310/0x310
[  925.012260]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[  925.017305]  ? prepare_exit_to_usermode+0x291/0x3b0
[  925.022337]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  925.027201]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  925.032393] RIP: 0033:0x457569
[  925.035595] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  925.054498] RSP: 002b:00007feb5b4cdc78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[  925.062211] RAX: ffffffffffffffda RBX: 00007feb5b4cdc90 RCX: 0000000000457569
[  925.069482] RDX: 0000000020000280 RSI: 0000000020000240 RDI: 0000000020000040
[  925.076756] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000
[  925.084027] R10: 0000000000000020 R11: 0000000000000246 R12: 00007feb5b4ce6d4
[  925.091299] R13: 00000000004c289b R14: 00000000004d3c78 R15: 0000000000000003
[  925.100822] netlink: 8 bytes leftover after parsing attributes in process `syz-executor0'.
[  925.112352] BUG: unable to handle kernel paging request at fffffffffffffff4
[  925.119462] PGD 926d067 P4D 926d067 PUD 926f067 PMD 0 
[  925.124760] Oops: 0000 [#1] PREEMPT SMP KASAN
[  925.129266] CPU: 1 PID: 6552 Comm: syz-executor4 Not tainted 4.19.0-rc7-next-20181015+ #94
[  925.137673] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  925.147047] RIP: 0010:do_mount+0xb98/0x1d90
[  925.151389] Code: 06 00 48 89 c2 48 89 c3 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 8a 11 00 00 48 b8 00 00 00 00 00 fc ff df <4c> 8b 33 49 8d 7e 18 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 5e 11
[  925.170299] RSP: 0018:ffff8801c3667c28 EFLAGS: 00010246
[  925.175675] RAX: dffffc0000000000 RBX: fffffffffffffff4 RCX: ffffc90009eda000
[  925.182958] RDX: 1ffffffffffffffe RSI: ffffffff81e073ec RDI: 0000000000000282
[  925.190233] RBP: ffff8801c3667db0 R08: ffff880184e3a4c0 R09: ffffed003b5e5b4f
[  925.197511] R10: ffffed003b5e5b4f R11: ffff8801daf2da7b R12: ffff880185f1b830
[  925.204784] R13: ffff88017ea4cd40 R14: ffff88017ea4cd40 R15: 0000000000000000
[  925.212079] FS:  00007feb5b4ce700(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000
[  925.220318] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  925.226211] CR2: fffffffffffffff4 CR3: 00000001c4a64000 CR4: 00000000001426e0
[  925.233486] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  925.240759] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  925.248027] Call Trace:
[  925.250630]  ? lock_release+0xa10/0xa10
[  925.254627]  ? copy_mount_string+0x40/0x40
[  925.258889]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  925.264466]  ? _copy_from_user+0xdf/0x150
[  925.268632]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  925.274189]  ? copy_mount_options+0x315/0x430
[  925.278694]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  925.284241]  ksys_mount+0x12d/0x140
[  925.287878]  __x64_sys_mount+0xbe/0x150
[  925.291875]  do_syscall_64+0x1b9/0x820
[  925.295778]  ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
[  925.301151]  ? syscall_return_slowpath+0x5e0/0x5e0
[  925.306101]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  925.310964]  ? trace_hardirqs_on_caller+0x310/0x310
[  925.315994]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[  925.321022]  ? prepare_exit_to_usermode+0x291/0x3b0
[  925.326051]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  925.330923]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  925.336127] RIP: 0033:0x457569
[  925.339332] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  925.358241] RSP: 002b:00007feb5b4cdc78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[  925.365957] RAX: ffffffffffffffda RBX: 00007feb5b4cdc90 RCX: 0000000000457569
[  925.373228] RDX: 0000000020000280 RSI: 0000000020000240 RDI: 0000000020000040
[  925.380502] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000
[  925.387770] R10: 0000000000000020 R11: 0000000000000246 R12: 00007feb5b4ce6d4
[  925.395035] R13: 00000000004c289b R14: 00000000004d3c78 R15: 0000000000000003
[  925.402306] Modules linked in:
[  925.405498] CR2: fffffffffffffff4
[  925.408950] ---[ end trace c406b1e932365e35 ]---
[  925.413712] RIP: 0010:do_mount+0xb98/0x1d90
[  925.418038] Code: 06 00 48 89 c2 48 89 c3 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 8a 11 00 00 48 b8 00 00 00 00 00 fc ff df <4c> 8b 33 49 8d 7e 18 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 5e 11
[  925.436940] RSP: 0018:ffff8801c3667c28 EFLAGS: 00010246
[  925.442300] RAX: dffffc0000000000 RBX: fffffffffffffff4 RCX: ffffc90009eda000
[  925.449586] RDX: 1ffffffffffffffe RSI: ffffffff81e073ec RDI: 0000000000000282
[  925.456857] RBP: ffff8801c3667db0 R08: ffff880184e3a4c0 R09: ffffed003b5e5b4f
[  925.464122] R10: ffffed003b5e5b4f R11: ffff8801daf2da7b R12: ffff880185f1b830
[  925.471387] R13: ffff88017ea4cd40 R14: ffff88017ea4cd40 R15: 0000000000000000
[  925.478659] FS:  00007feb5b4ce700(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000
[  925.486884] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  925.492765] CR2: fffffffffffffff4 CR3: 00000001c4a64000 CR4: 00000000001426e0
[  925.500524] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  925.507789] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  925.515055] Kernel panic - not syncing: Fatal exception
[  925.521399] Kernel Offset: disabled
[  925.525023] Rebooting in 86400 seconds..