)=""/219, 0xdb}], 0x1}, 0x0) r3 = dup(r2) r4 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r4, 0x0, 0xccf3, 0x0, 0x0, 0x800e0050e) shutdown(r3, 0x0) readv(r1, &(0x7f0000002900)=[{&(0x7f0000000300)=""/153, 0x99}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5) shutdown(r4, 0x0) shutdown(r1, 0x0) 19:08:36 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r0, &(0x7f0000001680)=[{&(0x7f0000000100)=""/129, 0x81}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0x73a0b1b, 0x0, 0x0, 0x800e00549) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0xbf9d, 0x0, 0x0, 0x800e0053e) shutdown(r0, 0x0) recvmsg(r1, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)=[{&(0x7f0000001600)=""/218, 0xda}, {0x0}], 0x2}, 0x2) shutdown(r2, 0x0) shutdown(r1, 0x0) 19:08:36 executing program 0: r0 = dup(0xffffffffffffff9c) fsync(r0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) shmget(0x3, 0x2000, 0x0, &(0x7f0000ffd000/0x2000)=nil) recvfrom$inet(r1, 0x0, 0x66, 0x0, 0x0, 0x800e00667) shutdown(r1, 0x0) shmget(0x1, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) 19:08:36 executing program 3: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) poll(&(0x7f0000000100)=[{r0}, {r0}], 0x2, 0x4e) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0x1aa6, 0x0, 0x0, 0x800e00506) ppoll(0x0, 0x0, &(0x7f0000000040)={0x8}, 0x0, 0x0) shutdown(r1, 0x0) 19:08:36 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r0, &(0x7f00000005c0)=[{&(0x7f0000000080)=""/140, 0x8c}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x6) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0xccf3, 0x0, 0x0, 0x800e0053d) shutdown(r0, 0x0) poll(0x0, 0x0, 0x4e) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0xff98, 0x0, 0x0, 0x800e00549) r3 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r3, &(0x7f0000000240)=[{&(0x7f0000000580)=""/194, 0xc2}, {0x0}, {0x0}], 0x3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r4, 0x0, 0xbf9d, 0x0, 0x0, 0x800e0053e) shutdown(r3, 0x0) r5 = socket$inet6_sctp(0x1c, 0x5, 0x84) readv(r5, &(0x7f0000000ac0)=[{&(0x7f00000004c0)=""/147, 0x93}], 0x1) shutdown(r4, 0x0) shutdown(r1, 0x0) 19:08:36 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000180)=""/62, 0x3e}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5}, 0x0) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x2769, 0x0, 0x0, 0x800e0087a) shutdown(r1, 0x0) r3 = dup(r2) recvmsg(r3, &(0x7f0000001600)={0x0, 0x0, &(0x7f0000001680)=[{&(0x7f0000000240)=""/146, 0x92}, {0x0}, {0x0}], 0x3}, 0x0) shutdown(r2, 0x0) 19:08:36 executing program 0: r0 = open$dir(&(0x7f0000000540)='./file0\x00', 0x40000400000002c2, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f00000006c0), 0x100000}], 0x3, 0x0) 19:08:37 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r0, &(0x7f0000000240)=[{&(0x7f0000000580)=""/194, 0xc2}, {0x0}, {0x0}], 0x3) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0xbf9d, 0x0, 0x0, 0x800e005bd) shutdown(r0, 0x0) shutdown(r1, 0x0) 19:08:37 executing program 4: r0 = socket$inet_sctp(0x2, 0x5, 0x84) poll(&(0x7f0000000000)=[{}, {}, {}, {r0}, {}], 0x5, 0x4e) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0xfd1d, 0x0, 0x0, 0x800e00515) recvmsg(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000080)=""/195, 0xc3}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x6}, 0x0) r2 = dup2(r1, r1) shutdown(r2, 0x0) 19:08:37 executing program 0: r0 = open$dir(&(0x7f0000000540)='./file0\x00', 0x40000400000002c2, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f00000006c0), 0x100000}], 0x3, 0x0) 19:08:37 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) recvmsg(r1, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000080)=""/157, 0x9d}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0xd}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x4e5cc83, 0x0, 0x0, 0x800e00549) shutdown(r0, 0x0) accept4$inet6(r1, 0x0, 0x0, 0x0) recvfrom$inet(r2, 0x0, 0x3c7, 0x0, 0x0, 0x800e00545) shutdown(r2, 0x0) 19:08:37 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r0, &(0x7f0000000100)=""/164, 0xa4, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0xcf1c, 0x0, 0x0, 0x800e0053d) shutdown(r1, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x5}, &(0x7f0000000240), 0x8) shutdown(r2, 0x0) 19:08:37 executing program 0: poll(&(0x7f0000000040), 0x200000000000007a, 0x4e) r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r0, 0x0, 0xfffffd23, 0x0, 0x0, 0x800e00a3f) ppoll(&(0x7f0000000000)=[{r0, 0x80}], 0x1, &(0x7f0000000040)={0x1}, &(0x7f0000000080), 0x8) shutdown(r0, 0x0) 19:08:37 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r0, &(0x7f0000002600)=[{&(0x7f0000000000)=""/137, 0x89}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0xff59, 0x0, 0x0, 0x800e00518) shutdown(r1, 0x0) setsockopt$sock_timeval(r2, 0xffff, 0x1006, &(0x7f00000000c0)={0x1000}, 0x10) accept$unix(r1, 0x0, 0x0) recvfrom$inet(r2, 0x0, 0xff06, 0x0, 0x0, 0x800e0051e) shutdown(r2, 0x0) 19:08:37 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000280)=""/60, 0x3c}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5}, 0x0) r3 = socket$inet6_udp(0x1c, 0x2, 0x0) recvfrom$inet(r2, 0x0, 0xfd1d, 0x0, 0x0, 0x800e00505) shutdown(r1, 0x0) recvmsg(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)=[{0x0}, {0x0}, {0x0}], 0x3}, 0x0) recvfrom$inet(r2, 0x0, 0x1789836bed901fc7, 0x2, 0x0, 0x800e0050e) shutdown(r2, 0x0) 19:08:37 executing program 3: r0 = socket$inet6_udplite(0x1c, 0x2, 0x88) poll(&(0x7f0000000040)=[{}, {}, {r0}], 0x3, 0x4e) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0xcf1c, 0x0, 0x0, 0x800e00551) recvmsg(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000180)=""/112, 0x70}], 0x1}, 0x0) shutdown(r1, 0x0) 19:08:37 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r0, &(0x7f0000000380)=[{&(0x7f0000000140)=""/62, 0x3e}], 0x1) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0xccf3, 0x0, 0x0, 0x800e0053d) shutdown(r1, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = socket$inet_udplite(0x2, 0x2, 0x88) read(r3, 0x0, 0x0) recvfrom$inet(r4, 0x0, 0xccf3, 0x0, 0x0, 0x800e00545) shutdown(r2, 0x0) shutdown(r4, 0x0) 19:08:37 executing program 4: poll(&(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x7, 0x8000000000049) r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r0, 0x0, 0xfd1d, 0x0, 0x0, 0x800e00516) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) accept$inet(r0, 0x0, 0x0) recvfrom$inet(r2, 0x0, 0xfffffe98, 0x0, 0x0, 0x800e00511) shutdown(r1, 0x0) 19:08:37 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000080)=""/192, 0xc0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9}, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0xf299, 0x0, 0x0, 0x800e00526) shutdown(r0, 0x0) recvfrom$inet(r1, &(0x7f0000000000)=""/41, 0x29, 0x42, 0x0, 0x0) shutdown(r1, 0x0) 19:08:38 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r0, &(0x7f00000000c0)=[{&(0x7f0000000000)=""/82, 0x52}], 0x1) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x651b259e6d327d, 0x0, 0x0, 0x800e00865) shutdown(r1, 0x0) recvmsg(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)=""/142, 0x8e}], 0x1}, 0x0) shutdown(r2, 0x0) 19:08:38 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r0, &(0x7f0000000540)=[{&(0x7f00000000c0)=""/195, 0xc3}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x6) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0xfff7, 0x0, 0x0, 0x800e00507) shutdown(r0, 0x0) r2 = dup(r1) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r3, &(0x7f0000000bc0)=[{&(0x7f0000000580)=""/113, 0x71}], 0x1) recvfrom$inet(r4, 0x0, 0x245, 0x0, 0x0, 0x800e00512) shutdown(r3, 0x0) r5 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r5, &(0x7f0000000600)=[{&(0x7f00000000c0)=""/51, 0x33}, {0x0}], 0x2) shutdown(r4, 0x0) shutdown(r2, 0x0) 19:08:38 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000005c0)=""/107, 0x6b}], 0x1}, 0x0) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x1008d, 0x2, 0x0, 0x800e00527) shutdown(r1, 0x0) setsockopt$inet_mreq(r2, 0x0, 0xc, &(0x7f0000000080)={@local={0xac, 0x14, 0x0}, @local={0xac, 0x14, 0x0}}, 0x8) recvfrom$inet(r2, 0x0, 0xfffffdc4, 0x2, 0x0, 0x800e0051e) shutdown(r2, 0x0) 19:08:38 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r0, &(0x7f0000002500)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000011c0)=""/4096, 0x1000}, {0x0}, {0x0}, {0x0}], 0x4, 0x0, 0x12d}, 0x0) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x893f, 0x0, 0x0, 0x800e00519) shutdown(r1, 0x0) setsockopt$sock_timeval(r2, 0xffff, 0x1006, &(0x7f0000000040)={0x42f}, 0x10) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xd, 0x0, 0x0) recvfrom$inet(r2, 0x0, 0x10201, 0x0, 0x0, 0x800e0051d) shutdown(r2, 0x0) 19:08:38 executing program 5: poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x7, 0x4e) r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r0, 0x0, 0xccf3, 0x0, 0x0, 0x800e0051e) r1 = socket$unix(0x1, 0x5, 0x0) poll(0x0, 0x0, 0x4c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0xfb, 0x0, 0x0, 0x800e00a86) poll(&(0x7f0000000180)=[{r1, 0x10c}], 0x1, 0x0) ppoll(&(0x7f0000000080)=[{r2}], 0x1, 0x0, 0x0, 0x0) shutdown(r0, 0x0) 19:08:38 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$sock_timeval(r0, 0xffff, 0x1006, &(0x7f0000000000)={0xffffffff}, 0x10) setsockopt$inet_msfilter(r0, 0x0, 0x4a, 0x0, 0x0) recvfrom$inet(r0, 0x0, 0xfd31c70e, 0x2, 0x0, 0x800e0059e) shutdown(r0, 0x0) 19:08:38 executing program 1: r0 = socket$inet6_sctp(0x1c, 0x5, 0x84) poll(&(0x7f0000000800)=[{r0}, {}], 0x2000000000000009, 0x46) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0x858a, 0x0, 0x0, 0x800e0050f) recvfrom$inet(r1, &(0x7f0000000000)=""/82, 0x52, 0x2, 0x0, 0x0) shutdown(r1, 0x0) 19:08:38 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r0, &(0x7f00000000c0)=""/82, 0x52, 0x0, 0x0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0x26ba, 0x0, 0x0, 0x800e00517) shutdown(r0, 0x0) setsockopt$sock_timeval(0xffffffffffffffff, 0xffff, 0x0, 0x0, 0x0) recvfrom$inet(r1, 0x0, 0x100000279, 0x0, 0x0, 0x800e00521) shutdown(r1, 0x0) 19:08:38 executing program 2: poll(&(0x7f0000000280)=[{}, {}, {}], 0x3, 0x46) r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r0, 0x0, 0xffaa, 0x0, 0x0, 0x800e00509) r1 = socket$inet_udplite(0x2, 0x2, 0x88) dup2(r0, r1) setsockopt$inet_group_source_req(r0, 0x0, 0x52, &(0x7f0000000000)={0x0, {{0x10, 0x2}}, {{0x10, 0x2}}}, 0x118) recvfrom$inet(r1, 0x0, 0x38, 0x4a, 0x0, 0x800e0050e) shutdown(r1, 0x0) 19:08:38 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) poll(&(0x7f0000000000)=[{r0}, {r0}], 0x2, 0x4e) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0x10101, 0x0, 0x0, 0x800e00821) setsockopt$sock_timeval(r1, 0xffff, 0x1006, &(0x7f0000000040)={0x7fff}, 0x10) recvmsg(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f00000000c0)=""/198, 0xc6}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5}, 0x2) shutdown(r1, 0x0) 19:08:38 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f00000008c0)=""/102, 0x66}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x6}, 0x0) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0xfd1d, 0x0, 0x0, 0x800e00515) shutdown(r1, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r3, &(0x7f0000000800)=[{&(0x7f0000000280)=""/9, 0x9}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x7) recvfrom$inet(r4, 0x0, 0x245, 0x0, 0x0, 0x800e00512) shutdown(r3, 0x0) r5 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r5, &(0x7f0000000680)=[{&(0x7f0000000100)=""/214, 0xd6}], 0x1) shutdown(r4, 0x0) shutdown(r2, 0x0) shutdown(r5, 0x0) 19:08:38 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000040)=""/183, 0xb7}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x6}, 0x40002) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0xbf7f9254, 0x0, 0x0, 0x800e00549) shutdown(r1, 0x0) r3 = dup(r2) recvfrom$inet6(r1, 0x0, 0x0, 0x82, 0x0, 0x0) recvfrom$inet(r3, 0x0, 0xe5, 0x2, 0x0, 0x800e00545) shutdown(r3, 0x0) 19:08:38 executing program 2: r0 = socket$inet6_tcp(0x1c, 0x1, 0x0) poll(&(0x7f0000000100)=[{}, {}, {}, {r0}], 0x4, 0x8000000000049) listen(r0, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0x8164, 0x0, 0x0, 0x800e00547) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, &(0x7f0000000080), 0x8) shutdown(r1, 0x0) 19:08:39 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$inet6_sctp(0x1c, 0x1, 0x84) bind(r1, &(0x7f0000000080)=@in6={0x1c, 0xffffffffffffffff}, 0x1c) recvfrom$inet(r0, 0x0, 0xa7573e4c, 0x40002, 0x0, 0x800e00670) shutdown(r0, 0x0) 19:08:39 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) poll(&(0x7f0000000040), 0x2000000000000014, 0x4e) r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r0, 0x0, 0xfffffd0c, 0x0, 0x0, 0x800e0046e) recvmsg(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)=""/48, 0x30}, {0x0}, {0x0}, {0x0}], 0x4}, 0x40002) shutdown(r0, 0x0) 19:08:39 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r0, &(0x7f0000000000)=""/127, 0x7f, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0xfd1d, 0x0, 0x0, 0x800e00515) shutdown(r1, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r3, &(0x7f0000000380)=[{&(0x7f0000000240)=""/142, 0x8e}], 0x1) shutdown(r2, 0x0) 19:08:39 executing program 5: r0 = socket$inet6_tcp(0x1c, 0x1, 0x0) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$sock_timeval(r2, 0xffff, 0x1006, &(0x7f0000000080)={0x0, 0x10001}, 0x10) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r1, 0x84, 0x1f, 0x0, 0x0) recvfrom$inet(r2, 0x0, 0x1329, 0x0, 0x0, 0x800e00511) shutdown(r2, 0x0) 19:08:39 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(0xffffffffffffffff, 0x84, 0x18, 0x0, 0x0) recvfrom$inet(r0, 0x0, 0xdea0, 0x0, 0x0, 0x800e006c1) shutdown(r0, 0x0) 19:08:39 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000180)=""/155, 0x9b}, {0x0}], 0x2}, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0x1ea3, 0x0, 0x0, 0x800e00517) shutdown(r0, 0x0) getsockopt$sock_timeval(r1, 0xffff, 0x1006, 0x0, &(0x7f0000000040)) recvfrom$inet(r1, 0x0, 0xfffffdc4, 0x0, 0x0, 0x800e00521) shutdown(r1, 0x0) 19:08:39 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)=""/98, 0x62}], 0x100000000000005a}, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0x73a0b1b, 0x0, 0x0, 0x800e00549) shutdown(r0, 0x0) r2 = dup(r1) r3 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r3, &(0x7f0000000b40)=[{&(0x7f00000004c0)=""/135, 0x87}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x8) r4 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r4, 0x0, 0x8164, 0x0, 0x0, 0x800e00547) shutdown(r3, 0x0) r5 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001780)=[{&(0x7f00000001c0)=""/231, 0xe7}, {0x0}, {0x0}], 0x3}, 0x0) r6 = dup(r5) r7 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r7, 0x0, 0xd051, 0x0, 0x0, 0x800e0053d) shutdown(r6, 0x0) r8 = socket$inet6_sctp(0x1c, 0x5, 0x84) readv(r8, &(0x7f00000006c0)=[{&(0x7f0000000040)=""/106, 0x6a}, {0x0}, {0x0}, {0x0}], 0x4) shutdown(r7, 0x0) shutdown(r4, 0x0) shutdown(r2, 0x0) 19:08:39 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000080)=""/126, 0x7e}, {0x0}, {0x0}], 0x3}, 0x2) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0x893f, 0x0, 0x0, 0x800e00519) shutdown(r0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r2, &(0x7f0000001680)=[{&(0x7f0000000000)=""/87, 0x57}], 0x1) r3 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r3, 0x0, 0xfffffecb, 0x0, 0x0, 0x800e00515) shutdown(r2, 0x0) r4 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000100)=""/189, 0xbd}, {0x0}, {0x0}, {0x0}], 0x4}, 0x0) shutdown(r3, 0x0) shutdown(r1, 0x0) 19:08:39 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) readv(r1, &(0x7f0000002700)=[{&(0x7f0000000140)=""/59, 0x3b}, {0x0}], 0x2) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x73a0b1b, 0x0, 0x0, 0x800e00549) shutdown(r1, 0x0) r3 = dup(r2) r4 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000100)=""/158, 0x9e}, {0x0}, {0x0}], 0x3}, 0x0) r5 = dup(r4) r6 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r6, 0x0, 0xccf3, 0x0, 0x0, 0x800e0053d) shutdown(r5, 0x0) poll(&(0x7f0000000000)=[{}], 0x1, 0x7f) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) shutdown(r6, 0x0) shutdown(r3, 0x0) 19:08:39 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000200)=""/233, 0xe9}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5}, 0x2) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0x6497443f6facb3a, 0x0, 0x0, 0x800e00516) shutdown(r0, 0x0) r2 = dup(r1) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x10, 0xffffffffffffffff, 0x7fffffffc) recvfrom$inet(r1, 0x0, 0x55864b6356183c8, 0x2, 0x0, 0x800e0050e) shutdown(r2, 0x0) 19:08:39 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r0, &(0x7f0000000400)=[{&(0x7f0000000000)=""/40, 0x28}, {0x0}, {0x0}], 0x3) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0xccf3, 0x0, 0x0, 0x800e0053d) shutdown(r1, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000005c0)=""/224, 0xe0}], 0x10000000000001cf}, 0x0) r4 = dup(r3) r5 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r5, 0x0, 0x73a0b1b, 0x0, 0x0, 0x800e00549) shutdown(r4, 0x0) poll(0x0, 0x0, 0x8000000000047) r6 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r6, 0x0, 0xfd1d, 0x0, 0x0, 0x800e00507) r7 = dup(r6) poll(&(0x7f00000000c0)=[{r7}, {}, {}], 0x3, 0x1ff) shutdown(r5, 0x0) shutdown(r2, 0x0) 19:08:39 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ppoll(&(0x7f0000000040)=[{r0, 0x1}], 0x1, &(0x7f0000000100)={0x9}, &(0x7f0000000140), 0x8) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x7813, 0x0, 0x0, 0x800e00515) shutdown(r1, 0x0) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x11, 0x0, 0x0) recvfrom$inet(r2, 0x0, 0xcebf, 0x6, 0x0, 0x800e00519) shutdown(r2, 0x0) 19:08:40 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r0, &(0x7f0000000800)=[{&(0x7f0000000140)=""/208, 0xd0}, {0x0}, {0x0}, {0x0}], 0x4) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x1788142, 0x6, 0x0, 0x800e00549) shutdown(r1, 0x0) r3 = dup(r2) getrusage(0xffffffffffffffff, &(0x7f0000000000)) recvfrom$inet(r3, 0x0, 0xe5, 0x2, 0x0, 0x800e00551) shutdown(r2, 0x0) 19:08:40 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000040)=""/17, 0x11}, {0x0}, {0x0}, {0x0}], 0x4}, 0x0) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x245, 0x0, 0x0, 0x800e00512) shutdown(r1, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) recvfrom$inet(r2, 0x0, 0x1789836bed901fc7, 0x0, 0x0, 0x800e0050e) shutdown(r2, 0x0) 19:08:40 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r0, &(0x7f0000000080)=[{&(0x7f0000000240)=""/8, 0x8}], 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0xfff7, 0x0, 0x0, 0x800e00507) shutdown(r0, 0x0) r2 = dup(r1) shutdown(r1, 0x1) recvfrom$inet(r1, 0x0, 0xcffa, 0x2, 0x0, 0x800e00585) shutdown(r2, 0x0) 19:08:40 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) poll(&(0x7f0000000040), 0x2000000000000014, 0x4e) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0x10101, 0x0, 0x0, 0x800e00810) ppoll(&(0x7f0000000040)=[{r0, 0x40}, {r0}], 0x2, &(0x7f0000000080)={0x7}, &(0x7f0000000100), 0x8) shutdown(r1, 0x0) 19:08:40 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000080)=""/39, 0x27}, {0x0}, {0x0}, {0x0}], 0x4}, 0x2) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0xccf3, 0x0, 0x0, 0x800e00551) shutdown(r1, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/139, 0x8b}], 0x1}, 0x0) r4 = dup(r3) r5 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r5, 0x0, 0x73a0b1b, 0x0, 0x0, 0x800e00549) shutdown(r4, 0x0) ppoll(0x0, 0x0, 0x0, &(0x7f00000001c0), 0x8) shutdown(r5, 0x0) shutdown(r2, 0x0) 19:08:40 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000180)=""/227, 0xe3}, {0x0}, {0x0}], 0x3}, 0x2) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0xea1ca13a, 0x0, 0x0, 0x800e00516) shutdown(r1, 0x0) shutdown(0xffffffffffffffff, 0x0) mprotect(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x5) r3 = socket$inet6_sctp(0x1c, 0x10000000005, 0x84) recvmsg(r3, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000002d80)=[{0x0}], 0x1}, 0x0) shutdown(r2, 0x0) 19:08:40 executing program 2: 19:08:40 executing program 5: 19:08:40 executing program 1: 19:08:40 executing program 2: 19:08:41 executing program 0: 19:08:41 executing program 1: 19:08:41 executing program 4: 19:08:41 executing program 2: 19:08:41 executing program 5: 19:08:41 executing program 1: 19:08:41 executing program 3: 19:08:41 executing program 4: 19:08:41 executing program 2: 19:08:41 executing program 5: 19:08:41 executing program 1: 19:08:41 executing program 0: 19:08:41 executing program 5: 19:08:41 executing program 1: 19:08:41 executing program 2: 19:08:41 executing program 4: 19:08:41 executing program 0: 19:08:41 executing program 3: 19:08:41 executing program 1: 19:08:41 executing program 4: 19:08:42 executing program 2: 19:08:42 executing program 5: 19:08:42 executing program 0: 19:08:42 executing program 3: 19:08:42 executing program 1: 19:08:42 executing program 4: 19:08:42 executing program 5: 19:08:42 executing program 2: 19:08:42 executing program 0: 19:08:42 executing program 4: 19:08:42 executing program 3: 19:08:42 executing program 1: 19:08:42 executing program 5: 19:08:42 executing program 2: 19:08:42 executing program 0: 19:08:42 executing program 3: 19:08:42 executing program 4: 19:08:42 executing program 1: 19:08:43 executing program 5: 19:08:43 executing program 0: 19:08:43 executing program 2: 19:08:43 executing program 3: 19:08:43 executing program 1: 19:08:43 executing program 0: 19:08:43 executing program 5: 19:08:43 executing program 3: 19:08:43 executing program 4: 19:08:43 executing program 1: 19:08:43 executing program 0: 19:08:43 executing program 2: 19:08:43 executing program 4: 19:08:43 executing program 3: 19:08:43 executing program 1: 19:08:43 executing program 5: 19:08:43 executing program 0: 19:08:44 executing program 4: 19:08:44 executing program 2: 19:08:44 executing program 3: 19:08:44 executing program 0: 19:08:44 executing program 1: 19:08:44 executing program 4: 19:08:44 executing program 3: 19:08:44 executing program 5: 19:08:44 executing program 1: 19:08:44 executing program 2: 19:08:44 executing program 0: 19:08:44 executing program 4: 19:08:44 executing program 3: 19:08:44 executing program 5: 19:08:44 executing program 1: 19:08:44 executing program 2: 19:08:44 executing program 0: 19:08:45 executing program 4: 19:08:45 executing program 5: 19:08:45 executing program 3: 19:08:45 executing program 2: 19:08:45 executing program 1: 19:08:45 executing program 4: 19:08:45 executing program 3: 19:08:45 executing program 0: 19:08:45 executing program 5: 19:08:45 executing program 1: 19:08:45 executing program 2: 19:08:45 executing program 4: 19:08:45 executing program 3: 19:08:45 executing program 0: 19:08:45 executing program 1: 19:08:45 executing program 5: 19:08:45 executing program 2: 19:08:46 executing program 0: 19:08:46 executing program 3: 19:08:46 executing program 4: 19:08:46 executing program 1: 19:08:46 executing program 5: 19:08:46 executing program 2: 19:08:46 executing program 3: 19:08:46 executing program 4: 19:08:46 executing program 0: 19:08:46 executing program 1: 19:08:46 executing program 2: 19:08:46 executing program 5: 19:08:46 executing program 4: 19:08:46 executing program 3: 19:08:46 executing program 1: 19:08:46 executing program 0: poll(0x0, 0x0, 0x800000000004a) r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r0, 0x0, 0xffffffa9, 0x0, 0x0, 0x800e00516) r1 = socket$inet_udplite(0x2, 0x2, 0x88) dup2(r0, r1) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000001a00)=""/4096, 0x1000}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5}, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r3, 0x0, 0xccf3, 0x0, 0x0, 0x800e00545) shutdown(r2, 0x0) nanosleep(&(0x7f0000000180)={0x1f}, &(0x7f00000001c0)) shutdown(r3, 0x0) 19:08:46 executing program 2: 19:08:47 executing program 5: 19:08:47 executing program 3: 19:08:47 executing program 1: 19:08:47 executing program 4: 19:08:47 executing program 5: 19:08:47 executing program 2: 19:08:47 executing program 1: 19:08:47 executing program 3: 19:08:47 executing program 4: 19:08:47 executing program 2: 19:08:48 executing program 0: 19:08:48 executing program 5: 19:08:48 executing program 4: 19:08:48 executing program 3: 19:08:48 executing program 1: 19:08:48 executing program 2: 19:08:48 executing program 5: 19:08:48 executing program 2: 19:08:48 executing program 4: 19:08:48 executing program 3: 19:08:48 executing program 1: 19:08:48 executing program 0: 19:08:48 executing program 1: 19:08:48 executing program 2: 19:08:48 executing program 5: 19:08:48 executing program 3: 19:08:48 executing program 0: 19:08:48 executing program 4: 19:08:48 executing program 5: 19:08:48 executing program 4: 19:08:48 executing program 2: 19:08:48 executing program 1: 19:08:48 executing program 0: 19:08:48 executing program 3: 19:08:49 executing program 4: 19:08:49 executing program 2: 19:08:49 executing program 5: 19:08:49 executing program 1: 19:08:49 executing program 0: 19:08:49 executing program 3: 19:08:49 executing program 1: 19:08:49 executing program 2: 19:08:49 executing program 5: 19:08:49 executing program 4: 19:08:49 executing program 0: 19:08:49 executing program 3: 19:08:49 executing program 5: 19:08:49 executing program 3: 19:08:49 executing program 1: 19:08:49 executing program 2: 19:08:49 executing program 4: 19:08:50 executing program 0: 19:08:50 executing program 5: 19:08:50 executing program 3: 19:08:50 executing program 2: 19:08:50 executing program 1: 19:08:50 executing program 4: 19:08:50 executing program 0: 19:08:50 executing program 3: 19:08:50 executing program 5: 19:08:50 executing program 4: 19:08:50 executing program 2: 19:08:50 executing program 0: 19:08:50 executing program 5: 19:08:50 executing program 1: 19:08:50 executing program 4: 19:08:50 executing program 3: 19:08:50 executing program 2: 19:08:51 executing program 0: 19:08:51 executing program 5: 19:08:51 executing program 1: 19:08:51 executing program 4: 19:08:51 executing program 3: 19:08:51 executing program 0: 19:08:51 executing program 5: 19:08:51 executing program 2: 19:08:51 executing program 1: 19:08:51 executing program 4: 19:08:51 executing program 0: 19:08:51 executing program 3: 19:08:51 executing program 5: 19:08:51 executing program 4: 19:08:51 executing program 2: 19:08:51 executing program 1: 19:08:51 executing program 0: 19:08:52 executing program 5: 19:08:52 executing program 3: 19:08:52 executing program 2: 19:08:52 executing program 4: 19:08:52 executing program 0: 19:08:52 executing program 1: 19:08:52 executing program 5: 19:08:52 executing program 2: 19:08:52 executing program 3: 19:08:52 executing program 4: 19:08:52 executing program 0: 19:08:52 executing program 1: 19:08:52 executing program 5: 19:08:52 executing program 3: 19:08:52 executing program 2: 19:08:52 executing program 4: 19:08:52 executing program 0: 19:08:52 executing program 1: 19:08:52 executing program 3: 19:08:52 executing program 5: 19:08:53 executing program 2: 19:08:53 executing program 4: 19:08:53 executing program 0: 19:08:53 executing program 1: 19:08:53 executing program 3: 19:08:53 executing program 2: 19:08:53 executing program 5: 19:08:53 executing program 4: 19:08:53 executing program 0: 19:08:53 executing program 3: 19:08:53 executing program 1: 19:08:53 executing program 2: 19:08:53 executing program 5: 19:08:53 executing program 3: 19:08:53 executing program 4: 19:08:53 executing program 0: 19:08:53 executing program 1: 19:08:53 executing program 2: 19:08:53 executing program 5: 19:08:54 executing program 3: 19:08:54 executing program 2: 19:08:54 executing program 5: 19:08:54 executing program 4: 19:08:54 executing program 0: 19:08:54 executing program 1: 19:08:54 executing program 3: 19:08:54 executing program 5: 19:08:54 executing program 2: 19:08:54 executing program 4: 19:08:54 executing program 0: 19:08:54 executing program 3: 19:08:54 executing program 1: 19:08:54 executing program 4: 19:08:54 executing program 5: 19:08:54 executing program 2: 19:08:54 executing program 3: 19:08:54 executing program 0: 19:08:54 executing program 1: 19:08:55 executing program 2: 19:08:55 executing program 4: 19:08:55 executing program 5: 19:08:55 executing program 3: 19:08:55 executing program 1: 19:08:55 executing program 0: 19:08:55 executing program 2: 19:08:55 executing program 4: 19:08:55 executing program 5: 19:08:55 executing program 1: 19:08:55 executing program 3: 19:08:55 executing program 2: 19:08:55 executing program 0: 19:08:55 executing program 4: 19:08:55 executing program 1: 19:08:55 executing program 5: 19:08:56 executing program 0: 19:08:56 executing program 4: 19:08:56 executing program 2: 19:08:56 executing program 3: 19:08:56 executing program 1: 19:08:56 executing program 5: 19:08:56 executing program 0: 19:08:56 executing program 2: 19:08:56 executing program 4: 19:08:56 executing program 3: 19:08:56 executing program 1: 19:08:56 executing program 5: 19:08:56 executing program 0: 19:08:56 executing program 4: 19:08:56 executing program 1: 19:08:56 executing program 2: 19:08:56 executing program 3: 19:08:56 executing program 5: 19:08:56 executing program 0: 19:08:57 executing program 4: 19:08:57 executing program 3: 19:08:57 executing program 2: 19:08:57 executing program 1: 19:08:57 executing program 5: 19:08:57 executing program 3: 19:08:57 executing program 2: 19:08:57 executing program 4: 19:08:57 executing program 0: 19:08:57 executing program 1: 19:08:57 executing program 5: 19:08:57 executing program 3: 19:08:57 executing program 2: 19:08:57 executing program 4: 19:08:57 executing program 0: 19:08:57 executing program 5: 19:08:57 executing program 3: 19:08:57 executing program 1: 19:08:58 executing program 4: 19:08:58 executing program 0: 19:08:58 executing program 5: 19:08:58 executing program 2: 19:08:58 executing program 3: 19:08:58 executing program 4: 19:08:58 executing program 1: 19:08:58 executing program 0: 19:08:58 executing program 3: 19:08:58 executing program 2: 19:08:58 executing program 5: 19:08:58 executing program 0: 19:08:58 executing program 4: 19:08:58 executing program 3: 19:08:58 executing program 1: 19:08:58 executing program 5: 19:08:58 executing program 2: 19:08:58 executing program 3: 19:08:59 executing program 4: 19:08:59 executing program 1: 19:08:59 executing program 0: 19:08:59 executing program 5: 19:08:59 executing program 2: 19:08:59 executing program 3: 19:08:59 executing program 4: 19:08:59 executing program 0: 19:08:59 executing program 1: 19:08:59 executing program 5: 19:08:59 executing program 3: 19:08:59 executing program 4: 19:08:59 executing program 2: 19:08:59 executing program 0: 19:08:59 executing program 1: 19:08:59 executing program 3: 19:08:59 executing program 5: 19:08:59 executing program 4: 19:09:00 executing program 1: 19:09:00 executing program 0: 19:09:00 executing program 2: 19:09:00 executing program 5: 19:09:00 executing program 3: 19:09:00 executing program 1: 19:09:00 executing program 4: 19:09:00 executing program 2: 19:09:00 executing program 5: 19:09:00 executing program 0: 19:09:00 executing program 4: 19:09:00 executing program 3: 19:09:00 executing program 1: 19:09:00 executing program 2: 19:09:00 executing program 5: 19:09:00 executing program 0: 19:09:00 executing program 4: 19:09:00 executing program 3: 19:09:00 executing program 1: 19:09:01 executing program 2: 19:09:01 executing program 5: 19:09:01 executing program 0: 19:09:01 executing program 3: 19:09:01 executing program 1: 19:09:01 executing program 4: 19:09:01 executing program 2: 19:09:01 executing program 0: 19:09:01 executing program 5: 19:09:01 executing program 1: 19:09:01 executing program 3: 19:09:01 executing program 2: 19:09:01 executing program 4: 19:09:01 executing program 5: 19:09:01 executing program 0: 19:09:01 executing program 1: 19:09:01 executing program 3: 19:09:02 executing program 2: 19:09:02 executing program 4: 19:09:02 executing program 0: 19:09:02 executing program 1: 19:09:02 executing program 5: 19:09:02 executing program 3: 19:09:02 executing program 4: 19:09:02 executing program 2: 19:09:02 executing program 1: 19:09:02 executing program 5: 19:09:02 executing program 0: 19:09:02 executing program 3: 19:09:02 executing program 4: 19:09:02 executing program 2: 19:09:02 executing program 1: 19:09:02 executing program 3: 19:09:02 executing program 0: 19:09:03 executing program 5: 19:09:03 executing program 2: 19:09:03 executing program 4: 19:09:03 executing program 1: 19:09:03 executing program 0: 19:09:03 executing program 3: 19:09:03 executing program 4: 19:09:03 executing program 5: 19:09:03 executing program 2: 19:09:03 executing program 0: 19:09:03 executing program 4: 19:09:03 executing program 1: 19:09:03 executing program 3: 19:09:03 executing program 2: 19:09:03 executing program 5: 19:09:03 executing program 0: 19:09:03 executing program 4: 19:09:04 executing program 3: 19:09:04 executing program 2: 19:09:04 executing program 5: 19:09:04 executing program 1: 19:09:04 executing program 0: 19:09:04 executing program 4: 19:09:04 executing program 5: 19:09:04 executing program 2: 19:09:04 executing program 3: 19:09:04 executing program 1: 19:09:04 executing program 0: 19:09:04 executing program 4: 19:09:04 executing program 5: 19:09:04 executing program 0: 19:09:04 executing program 2: 19:09:04 executing program 1: 19:09:04 executing program 3: 19:09:04 executing program 4: 19:09:05 executing program 0: 19:09:05 executing program 2: 19:09:05 executing program 5: 19:09:05 executing program 4: 19:09:05 executing program 1: 19:09:05 executing program 3: 19:09:05 executing program 0: 19:09:05 executing program 5: 19:09:05 executing program 4: 19:09:05 executing program 2: 19:09:05 executing program 0: 19:09:05 executing program 1: 19:09:05 executing program 3: 19:09:05 executing program 5: 19:09:05 executing program 4: 19:09:05 executing program 0: 19:09:05 executing program 1: 19:09:05 executing program 3: 19:09:05 executing program 2: 19:09:06 executing program 5: 19:09:06 executing program 4: 19:09:06 executing program 0: 19:09:06 executing program 2: 19:09:06 executing program 1: 19:09:06 executing program 3: 19:09:06 executing program 5: 19:09:06 executing program 0: 19:09:06 executing program 4: 19:09:06 executing program 1: 19:09:06 executing program 3: 19:09:06 executing program 5: 19:09:06 executing program 2: 19:09:06 executing program 1: 19:09:06 executing program 0: 19:09:06 executing program 3: 19:09:06 executing program 4: 19:09:06 executing program 5: 19:09:07 executing program 1: 19:09:07 executing program 2: 19:09:07 executing program 3: 19:09:07 executing program 5: 19:09:07 executing program 0: 19:09:07 executing program 4: 19:09:07 executing program 2: 19:09:07 executing program 5: 19:09:07 executing program 1: 19:09:07 executing program 3: 19:09:07 executing program 4: 19:09:07 executing program 0: 19:09:07 executing program 2: 19:09:07 executing program 1: 19:09:07 executing program 3: 19:09:07 executing program 5: 19:09:08 executing program 4: 19:09:08 executing program 1: 19:09:08 executing program 0: 19:09:08 executing program 2: 19:09:08 executing program 3: 19:09:08 executing program 5: 19:09:08 executing program 4: 19:09:08 executing program 1: 19:09:08 executing program 0: 19:09:08 executing program 2: 19:09:08 executing program 5: 19:09:08 executing program 4: 19:09:08 executing program 3: 19:09:08 executing program 2: 19:09:08 executing program 1: 19:09:08 executing program 0: 19:09:08 executing program 5: 19:09:08 executing program 2: 19:09:08 executing program 4: 19:09:09 executing program 3: 19:09:09 executing program 0: 19:09:09 executing program 5: 19:09:09 executing program 2: 19:09:09 executing program 1: 19:09:09 executing program 4: 19:09:09 executing program 0: 19:09:09 executing program 3: 19:09:09 executing program 2: 19:09:09 executing program 5: 19:09:09 executing program 1: 19:09:09 executing program 4: 19:09:09 executing program 3: 19:09:09 executing program 0: 19:09:09 executing program 5: 19:09:09 executing program 4: 19:09:09 executing program 2: 19:09:09 executing program 1: 19:09:09 executing program 3: 19:09:10 executing program 2: 19:09:10 executing program 4: 19:09:10 executing program 5: 19:09:10 executing program 0: 19:09:10 executing program 1: 19:09:10 executing program 3: 19:09:10 executing program 4: 19:09:10 executing program 0: 19:09:10 executing program 2: 19:09:10 executing program 1: 19:09:10 executing program 3: 19:09:10 executing program 4: 19:09:10 executing program 5: 19:09:10 executing program 1: 19:09:10 executing program 0: 19:09:10 executing program 4: 19:09:10 executing program 2: 19:09:10 executing program 5: 19:09:10 executing program 1: 19:09:10 executing program 3: 19:09:11 executing program 0: 19:09:11 executing program 5: 19:09:11 executing program 4: 19:09:11 executing program 1: 19:09:11 executing program 2: 19:09:11 executing program 3: 19:09:11 executing program 0: 19:09:11 executing program 4: 19:09:11 executing program 5: 19:09:11 executing program 3: 19:09:11 executing program 1: 19:09:11 executing program 2: 19:09:11 executing program 5: 19:09:11 executing program 0: 19:09:11 executing program 4: 19:09:11 executing program 3: 19:09:11 executing program 1: 19:09:12 executing program 5: 19:09:12 executing program 2: 19:09:12 executing program 4: 19:09:12 executing program 0: 19:09:12 executing program 3: 19:09:12 executing program 1: 19:09:12 executing program 5: 19:09:12 executing program 2: 19:09:12 executing program 0: 19:09:12 executing program 4: 19:09:12 executing program 3: 19:09:12 executing program 5: 19:09:12 executing program 2: 19:09:12 executing program 1: 19:09:12 executing program 4: 19:09:12 executing program 0: 19:09:12 executing program 5: 19:09:13 executing program 3: 19:09:13 executing program 4: 19:09:13 executing program 1: 19:09:13 executing program 2: 19:09:13 executing program 5: 19:09:13 executing program 0: 19:09:13 executing program 1: 19:09:13 executing program 3: 19:09:13 executing program 4: 19:09:13 executing program 2: 19:09:13 executing program 5: 19:09:13 executing program 0: 19:09:13 executing program 1: 19:09:13 executing program 3: 19:09:13 executing program 4: 19:09:13 executing program 2: 19:09:13 executing program 0: 19:09:13 executing program 5: 19:09:14 executing program 1: 19:09:14 executing program 2: 19:09:14 executing program 4: 19:09:14 executing program 3: 19:09:14 executing program 0: 19:09:14 executing program 5: 19:09:14 executing program 1: 19:09:14 executing program 3: 19:09:14 executing program 2: 19:09:14 executing program 0: 19:09:14 executing program 5: 19:09:14 executing program 4: 19:09:14 executing program 1: 19:09:14 executing program 3: 19:09:14 executing program 0: 19:09:14 executing program 2: 19:09:14 executing program 4: 19:09:14 executing program 1: 19:09:14 executing program 5: 19:09:15 executing program 0: 19:09:15 executing program 3: 19:09:15 executing program 2: 19:09:15 executing program 4: 19:09:15 executing program 5: 19:09:15 executing program 1: 19:09:15 executing program 3: 19:09:15 executing program 0: 19:09:15 executing program 4: 19:09:15 executing program 2: 19:09:15 executing program 5: 19:09:15 executing program 1: 19:09:15 executing program 3: 19:09:15 executing program 4: 19:09:15 executing program 2: 19:09:15 executing program 0: 19:09:15 executing program 5: 19:09:15 executing program 1: 19:09:16 executing program 3: 19:09:16 executing program 4: 19:09:16 executing program 5: 19:09:16 executing program 0: 19:09:16 executing program 2: 19:09:16 executing program 1: 19:09:16 executing program 3: 19:09:16 executing program 4: 19:09:16 executing program 5: 19:09:16 executing program 1: 19:09:16 executing program 0: 19:09:16 executing program 3: 19:09:16 executing program 2: 19:09:16 executing program 4: 19:09:16 executing program 1: 19:09:16 executing program 5: 19:09:16 executing program 3: 19:09:17 executing program 0: 19:09:17 executing program 2: 19:09:17 executing program 4: 19:09:17 executing program 1: 19:09:17 executing program 2: 19:09:17 executing program 3: 19:09:17 executing program 5: 19:09:17 executing program 0: 19:09:17 executing program 4: 19:09:17 executing program 1: 19:09:17 executing program 2: 19:09:17 executing program 3: 19:09:17 executing program 5: 19:09:17 executing program 0: 19:09:17 executing program 1: 19:09:17 executing program 4: 19:09:17 executing program 2: 19:09:17 executing program 3: 19:09:18 executing program 5: 19:09:18 executing program 1: 19:09:18 executing program 0: 19:09:18 executing program 4: 19:09:18 executing program 2: 19:09:18 executing program 3: 19:09:18 executing program 5: 19:09:18 executing program 1: 19:09:18 executing program 4: 19:09:18 executing program 0: 19:09:18 executing program 2: 19:09:18 executing program 3: 19:09:18 executing program 1: 19:09:18 executing program 4: 19:09:18 executing program 5: 19:09:18 executing program 0: 19:09:18 executing program 4: 19:09:19 executing program 3: 19:09:19 executing program 2: 19:09:19 executing program 1: 19:09:19 executing program 5: 19:09:19 executing program 4: 19:09:19 executing program 0: 19:09:19 executing program 3: 19:09:19 executing program 1: 19:09:19 executing program 2: 19:09:19 executing program 5: 19:09:19 executing program 4: 19:09:19 executing program 0: 19:09:19 executing program 3: 19:09:19 executing program 1: 19:09:19 executing program 5: 19:09:19 executing program 2: 19:09:19 executing program 0: 19:09:20 executing program 1: 19:09:20 executing program 3: 19:09:20 executing program 5: 19:09:20 executing program 4: 19:09:20 executing program 2: 19:09:20 executing program 1: 19:09:20 executing program 3: 19:09:20 executing program 0: 19:09:20 executing program 4: 19:09:20 executing program 5: 19:09:20 executing program 3: 19:09:20 executing program 2: 19:09:20 executing program 5: 19:09:20 executing program 1: 19:09:20 executing program 4: 19:09:20 executing program 0: 19:09:20 executing program 2: 19:09:20 executing program 5: 19:09:20 executing program 3: 19:09:21 executing program 0: 19:09:21 executing program 4: 19:09:21 executing program 1: 19:09:21 executing program 5: 19:09:21 executing program 2: 19:09:21 executing program 3: 19:09:21 executing program 0: 19:09:21 executing program 1: 19:09:21 executing program 4: 19:09:21 executing program 2: 19:09:21 executing program 5: 19:09:21 executing program 3: 19:09:21 executing program 0: 19:09:21 executing program 1: 19:09:21 executing program 4: 19:09:21 executing program 2: 19:09:21 executing program 3: 19:09:21 executing program 5: 19:09:22 executing program 1: 19:09:22 executing program 0: 19:09:22 executing program 3: 19:09:22 executing program 4: 19:09:22 executing program 2: 19:09:22 executing program 1: 19:09:22 executing program 5: 19:09:22 executing program 0: 19:09:22 executing program 1: 19:09:22 executing program 3: 19:09:22 executing program 2: 19:09:22 executing program 4: 19:09:22 executing program 5: 19:09:22 executing program 1: 19:09:22 executing program 0: 19:09:22 executing program 3: 19:09:23 executing program 4: 19:09:23 executing program 2: 19:09:23 executing program 5: 19:09:23 executing program 1: 19:09:23 executing program 3: 19:09:23 executing program 0: 19:09:23 executing program 4: 19:09:23 executing program 2: 19:09:23 executing program 1: 19:09:23 executing program 5: 19:09:23 executing program 0: 19:09:23 executing program 3: 19:09:23 executing program 4: 19:09:23 executing program 2: 19:09:23 executing program 0: 19:09:23 executing program 5: 19:09:23 executing program 1: 19:09:23 executing program 3: 19:09:23 executing program 4: 19:09:24 executing program 2: 19:09:24 executing program 0: 19:09:24 executing program 4: 19:09:24 executing program 1: 19:09:24 executing program 5: 19:09:24 executing program 3: 19:09:24 executing program 2: 19:09:24 executing program 4: 19:09:24 executing program 5: 19:09:24 executing program 2: 19:09:24 executing program 1: 19:09:24 executing program 0: 19:09:24 executing program 3: 19:09:24 executing program 5: 19:09:24 executing program 4: 19:09:24 executing program 2: 19:09:25 executing program 3: 19:09:25 executing program 0: 19:09:25 executing program 1: 19:09:25 executing program 4: 19:09:25 executing program 5: 19:09:25 executing program 0: 19:09:25 executing program 2: 19:09:25 executing program 3: 19:09:25 executing program 4: 19:09:25 executing program 1: 19:09:25 executing program 5: 19:09:25 executing program 0: 19:09:25 executing program 2: 19:09:25 executing program 4: 19:09:25 executing program 3: 19:09:25 executing program 0: 19:09:25 executing program 1: 19:09:25 executing program 5: 19:09:25 executing program 4: 19:09:26 executing program 2: 19:09:26 executing program 0: 19:09:26 executing program 3: 19:09:26 executing program 1: 19:09:26 executing program 4: 19:09:26 executing program 5: 19:09:26 executing program 2: 19:09:26 executing program 4: 19:09:26 executing program 3: 19:09:26 executing program 1: 19:09:26 executing program 0: 19:09:26 executing program 5: 19:09:26 executing program 2: 19:09:26 executing program 3: 19:09:26 executing program 4: 19:09:26 executing program 1: 19:09:26 executing program 5: 19:09:27 executing program 0: 19:09:27 executing program 3: 19:09:27 executing program 2: 19:09:27 executing program 4: 19:09:27 executing program 1: 19:09:27 executing program 5: 19:09:27 executing program 0: 19:09:27 executing program 3: 19:09:27 executing program 2: 19:09:27 executing program 4: 19:09:27 executing program 1: 19:09:27 executing program 0: r0 = perf_event_open(&(0x7f0000000a00)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fremovexattr(r0, &(0x7f0000000080)=@known='trusted.overlay.origin\x00') 19:09:27 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x802, 0x0) write$UHID_DESTROY(r0, &(0x7f0000000040), 0x200000db) 19:09:27 executing program 5: r0 = open(&(0x7f0000000200)='./file0\x00', 0x4008040, 0x0) r1 = gettid() fcntl$setownex(r0, 0xf, &(0x7f0000000280)={0x2, r1}) fcntl$setlease(r0, 0x400, 0x1) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) close(r0) 19:09:27 executing program 4: 19:09:27 executing program 2: 19:09:28 executing program 3: 19:09:28 executing program 1: 19:09:28 executing program 2: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'veth1_to_hsr\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0xfffffffffffffd86, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="7000000024000104e300"/20, @ANYRES32=r1, @ANYBLOB="00000000f1ffffff00000000280008001c0001000000000080000000000000000000000000000000020000000800020000000100050005000000000014000100706669666f5f686561645f64726f7000080002000000000045591aaa4ca81fc0275ba4d84750f879ade67f20f9971a83dd0e5349b1822e921cdacf7ccee6d05d31b3f20fd73fadf91c80997a7c8a997b5c79363274ae121af25e661e74307da78f027e1287ca444378c57758bbb6432d8b2aee14f7a0d0d5d475ad65aa0ecaf06bbbd3d9ec151d2e1599116baee77bdd11fda169f9951ea8b514923bcbec08f8c39e87adf7af7b967fa2e2185a324245c42f5799d4"], 0x70}}, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmmsg$alg(r2, &(0x7f0000000140)=[{0x0, 0xd2efff7f00000000, &(0x7f0000000100), 0xa, &(0x7f0000000100)}], 0x4924bd5, 0x0) 19:09:28 executing program 4: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) keyctl$setperm(0x3, 0x0, 0x0) openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x0) ioctl(r0, 0xfffffffffdffffb3, &(0x7f0000000180)) 19:09:28 executing program 5: r0 = open(&(0x7f0000000200)='./file0\x00', 0x4008040, 0x0) r1 = gettid() fcntl$setownex(r0, 0xf, &(0x7f0000000280)={0x2, r1}) fcntl$setlease(r0, 0x400, 0x1) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) close(r0) 19:09:28 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = fcntl$dupfd(r1, 0x0, r0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, 0x0, 0x0) 19:09:28 executing program 3: r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lseek(r0, 0x800002, 0x0) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000001c0)) writev(r0, &(0x7f0000000380)=[{&(0x7f0000000200)="e5", 0x1}], 0x1) lseek(r0, 0x0, 0x3) 19:09:28 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xf7d, 0x1, 0x0, 0x0, 0x0, 0x2, 0x444, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 19:09:28 executing program 4: r0 = creat(&(0x7f0000000300)='./file0\x00', 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='devpts\x00', 0x0, &(0x7f00000001c0)='/selinux/policy\x00') r1 = gettid() tkill(r1, 0x3c) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x9, 0x9}, 0x0) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) listen(r0, 0xd3) recvmmsg(r3, &(0x7f0000008880), 0x400000000000059, 0x0, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r5, 0x407, 0x0) sched_setattr(0x0, &(0x7f0000000200)={0x30, 0x6, 0x1, 0x8001, 0xfa68, 0x10000, 0x80000001, 0x1}, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0) 19:09:28 executing program 2: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'veth1_to_hsr\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0xfffffffffffffd86, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="7000000024000104e300"/20, @ANYRES32=r1, @ANYBLOB="00000000f1ffffff00000000280008001c0001000000000080000000000000000000000000000000020000000800020000000100050005000000000014000100706669666f5f686561645f64726f7000080002000000000045591aaa4ca81fc0275ba4d84750f879ade67f20f9971a83dd0e5349b1822e921cdacf7ccee6d05d31b3f20fd73fadf91c80997a7c8a997b5c79363274ae121af25e661e74307da78f027e1287ca444378c57758bbb6432d8b2aee14f7a0d0d5d475ad65aa0ecaf06bbbd3d9ec151d2e1599116baee77bdd11fda169f9951ea8b514923bcbec08f8c39e87adf7af7b967fa2e2185a324245c42f5799d4"], 0x70}}, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmmsg$alg(r2, &(0x7f0000000140)=[{0x0, 0xd2efff7f00000000, &(0x7f0000000100), 0xa, &(0x7f0000000100)}], 0x4924bd5, 0x0) 19:09:28 executing program 0: add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) perf_event_open(&(0x7f0000000040)={0x2, 0x5b, 0x68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$unix(0x1, 0x0, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x4000, 0x0) perf_event_open(&(0x7f0000000a00)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000000140)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) socket$inet6(0xa, 0x2, 0x0) sendfile(r0, r1, 0x0, 0x666d) ioctl$BLKRESETZONE(0xffffffffffffffff, 0x40101283, &(0x7f00000003c0)={0x0, 0xfffffffffffffffc}) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="0004010200000000fe8000000000000000000000008a0ea7af0bc29bfef15435c0470000aa00000000000000000000000000000001"], 0x28) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendfile(r0, r1, 0x0, 0xa195) 19:09:28 executing program 5: creat(&(0x7f0000000300)='./file0\x00', 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='devpts\x00', 0x0, &(0x7f0000000200)='/selinux/policy\x00') r0 = gettid() tkill(r0, 0x3c) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x9, 0x9}, 0x0) r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r2, &(0x7f0000008880), 0x400000000000059, 0x0, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r4, 0x407, 0x0) write(r4, &(0x7f0000000340), 0x41395527) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0) [ 2580.021403][T16285] devpts: called with bogus options 19:09:28 executing program 3: r0 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syz_tun\x00', 0x0}) bind$packet(r0, &(0x7f0000000000)={0x11, 0x800, r1, 0x1, 0x0, 0x6, @dev}, 0x14) syz_emit_ethernet(0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaaa8aaaaaaaaaaaaaa0800480000280000118500009078ac00040000000000000000ea2e0000000000fcffffffffffffff000006c38ff3fef1a5e85d3fc1785c4bd41cbef393e566b5bce731c38a8477fdb50c57d955f45fbfb489539588205969de04419a19dc80b080288724aff2cc08a655ac546a92221f4f42708fc021b611d97704418d690374beb474931602206f98400b922597829d95e7eb35a2b32f0bace79243a1896acd6f9a6d944094145e4ae71548"], 0x0) 19:09:28 executing program 1: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee67, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) io_setup(0x8, &(0x7f0000000180)=0x0) io_submit(r1, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x3, 0x1, 0x0, r0, &(0x7f0000000000), 0x10000}]) [ 2580.159467][ T26] audit: type=1326 audit(1572894568.782:16354): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=16283 comm="syz-executor.4" exe="/root/syz-executor.4" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45d05a code=0x0 [ 2580.243419][T16297] devpts: called with bogus options 19:09:28 executing program 2: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee67, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x21d, 0x2, 0x0, 0x0, 0x0, 0x0, 0x510, 0x88525, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='net/snmp\x00') preadv(r0, &(0x7f00000017c0), 0x375, 0x0) 19:09:28 executing program 5: [ 2580.260454][ T26] audit: type=1804 audit(1572894568.792:16355): pid=16295 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir729292021/syzkaller.BRkLqp/2281/file0" dev="sda1" ino=16998 res=1 [ 2580.324790][ T26] audit: type=1804 audit(1572894568.822:16356): pid=16291 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir729292021/syzkaller.BRkLqp/2281/file0" dev="sda1" ino=16998 res=1 19:09:29 executing program 0: 19:09:29 executing program 3: 19:09:29 executing program 2: 19:09:29 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xf7d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) creat(0x0, 0x0) mlock2(&(0x7f0000a4f000/0x4000)=nil, 0x4000, 0x0) [ 2580.789520][T16324] devpts: called with bogus options [ 2580.842404][ T26] audit: type=1326 audit(1572894569.472:16357): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=16283 comm="syz-executor.4" exe="/root/syz-executor.4" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45d05a code=0x0 19:09:29 executing program 4: r0 = creat(&(0x7f0000000300)='./file0\x00', 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='devpts\x00', 0x0, &(0x7f00000001c0)='/selinux/policy\x00') r1 = gettid() tkill(r1, 0x3c) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x9, 0x9}, 0x0) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) listen(r0, 0xd3) recvmmsg(r3, &(0x7f0000008880), 0x400000000000059, 0x0, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r5, 0x407, 0x0) sched_setattr(0x0, &(0x7f0000000200)={0x30, 0x6, 0x1, 0x8001, 0xfa68, 0x10000, 0x80000001, 0x1}, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0) 19:09:29 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, @perf_bp={&(0x7f0000000180), 0x8}, 0x5004, 0xfffffffffffff24b, 0x0, 0x0, 0x800}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x4000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f00005ff000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, 0x0) fcntl$setsig(0xffffffffffffffff, 0xa, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) write$FUSE_DIRENT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) creat(0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40046602, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x16c, 0x244) socket$nl_generic(0x10, 0x3, 0x10) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(0xffffffffffffffff, 0xc080661a, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000540)={@in={{0x2, 0x3, @local}}, 0x0, 0x200000000000025, 0x2, "a77760f5a7645bc43c241d69912d030c43244947a79015f0fe57917cb62a939a7a939ebddfce7bbba4fec2d82818a17900"}, 0xd8) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) pipe(0x0) ioctl$sock_inet_SIOCSIFBRDADDR(0xffffffffffffffff, 0x891a, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) socket(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) dup(0xffffffffffffffff) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000240)={{{@in=@loopback, @in6=@initdev}}, {{@in=@local}, 0x0, @in6=@ipv4={[], [], @loopback}}}, 0x0) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) recvmsg(r0, &(0x7f0000000140)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000000)=[{&(0x7f0000002340)=""/4096, 0x4890}], 0x1, &(0x7f0000000200)=""/20, 0x148, 0x93de}, 0x0) open(0x0, 0x0, 0x0) open_by_handle_at(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, 0x0, 0x0) write$binfmt_elf64(r0, &(0x7f0000000500)=ANY=[], 0xffffffdf) 19:09:29 executing program 3: 19:09:29 executing program 1: 19:09:29 executing program 2: 19:09:29 executing program 5: 19:09:29 executing program 1: 19:09:29 executing program 3: 19:09:29 executing program 2: 19:09:29 executing program 0: [ 2581.258409][T16342] devpts: called with bogus options 19:09:30 executing program 5: 19:09:30 executing program 1: 19:09:30 executing program 4: r0 = creat(&(0x7f0000000300)='./file0\x00', 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='devpts\x00', 0x0, &(0x7f00000001c0)='/selinux/policy\x00') r1 = gettid() tkill(r1, 0x3c) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x9, 0x9}, 0x0) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) listen(r0, 0xd3) recvmmsg(r3, &(0x7f0000008880), 0x400000000000059, 0x0, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r5, 0x407, 0x0) sched_setattr(0x0, &(0x7f0000000200)={0x30, 0x6, 0x1, 0x8001, 0xfa68, 0x10000, 0x80000001, 0x1}, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0) 19:09:30 executing program 3: 19:09:30 executing program 2: 19:09:30 executing program 0: 19:09:30 executing program 1: 19:09:30 executing program 2: 19:09:30 executing program 5: [ 2581.797966][T16366] devpts: called with bogus options 19:09:30 executing program 0: 19:09:30 executing program 3: 19:09:30 executing program 4: r0 = creat(&(0x7f0000000300)='./file0\x00', 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='devpts\x00', 0x0, &(0x7f00000001c0)='/selinux/policy\x00') r1 = gettid() tkill(r1, 0x3c) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x9, 0x9}, 0x0) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) listen(r0, 0xd3) recvmmsg(r3, &(0x7f0000008880), 0x400000000000059, 0x0, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r5, 0x407, 0x0) sched_setattr(0x0, &(0x7f0000000200)={0x30, 0x6, 0x1, 0x8001, 0xfa68, 0x10000, 0x80000001, 0x1}, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0) 19:09:30 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pivot_root(0x0, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f0000000300)='cgroup2\x00', 0x0, 0x0) rmdir(&(0x7f0000000240)='./file0//ile0\x00') fsetxattr$trusted_overlay_origin(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) 19:09:30 executing program 5: syz_genetlink_get_family_id$tipc2(0x0) syz_mount_image$vfat(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) open(0x0, 0x0, 0x0) open(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x82, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="8500000007000000250000000000000095000000000000007bfd775ba478b77c046cdb256559db173112b7d7acf822a3f19794119820392acf0b8324d80f1446f1be9866cc73a22620af2e6c292ab4e17a0013c4b1174e1051c51946428264443cd34fbea20400000000"], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) 19:09:30 executing program 0: wait4(0x0, 0x0, 0x0, 0x0) getpid() r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[]}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="740000002400070500"/20, @ANYRES32=r3, @ANYBLOB="00000000ffffffff0000000008000100736671004800020000000000000000000000000000000000000000000000000000000000000000000000000077000000000000000000000000000000000000000000000000000000000000f3"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="7c0000002c000107000000140000000000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000030000002f0001006270660050000200080004000000000004000500400002003c00010000000000020000200000000000000000000011000000000000000010000000000000001000"/100], 0x7c}}, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) 19:09:30 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(0x0, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(0x0, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) stat(0x0, 0x0) ioprio_set$uid(0x0, 0x0, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x20, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) getpeername$inet6(r1, 0x0, 0x0) socket(0x0, 0x0, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:09:30 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r2, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r2}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) getpeername$inet6(r3, 0x0, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2582.247829][T16382] devpts: called with bogus options 19:09:30 executing program 4: [ 2582.313085][T16389] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.0'. [ 2582.357420][T16396] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.0'. 19:09:31 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee67, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000280)='/dev/loop#\x00', 0x0, 0x0) memfd_create(0x0, 0x0) ioctl$BLKIOOPT(r0, 0x1279, &(0x7f0000000300)) dup(0xffffffffffffffff) setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, 0x0, 0x0) 19:09:31 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000001fd8)=@framed={{0xffffffb7, 0x0, 0x0, 0x0, 0x0, 0x74}, [@ldst={0x7, 0x0, 0x0, 0x0, 0x0, 0xe}]}, &(0x7f0000000080)='OPL\x00?\xcaY\b#\xf7t\xe2?\xb0Tn:\x88=\x85\x195f\xa7$\x84}\xc8\xa4', 0x1, 0xf2, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000280)}, 0x48) 19:09:31 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='io\x00') setxattr$trusted_overlay_redirect(0x0, 0x0, 0x0, 0x0, 0x0) write$P9_RCREATE(0xffffffffffffffff, 0x0, 0xffffffffffffffd4) ioctl$sock_SIOCGPGRP(r0, 0x8904, 0x0) tkill(0x0, 0x14) 19:09:31 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r2, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r2}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) getpeername$inet6(r3, 0x0, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:09:31 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r2, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r2}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) getpeername$inet6(r3, 0x0, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:09:31 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000180)=ANY=[@ANYBLOB="6e6e7400000100ce15638501040f5ca6633bc4142f93d0d9c344cd7a746fca63c33cb775870020002bed000000000000c75e00800000000000000000ba78030400cc000000ac0100000ef30ccfcfd76916dea566abd8a200003f49590000000040fece8503000021f1ffffff9f34096a6a7f8bc9d6db697d2705f9642419515506ed0f365f4bbf007da53e31dbac3bba761e80a914a341130b760049608baad68cac676f64ae96bf1d5ed36d21e00046ca090000002c3eca"], 0x1) 19:09:31 executing program 4: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x7ff}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$SG_GET_PACK_ID(0xffffffffffffffff, 0x227c, 0x0) tkill(0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r1, &(0x7f00000000c0)={0x2, 0x0, @loopback}, 0x10) sendfile(r1, r0, 0x0, 0x7ffff000) 19:09:31 executing program 5: syz_genetlink_get_family_id$tipc2(0x0) syz_mount_image$vfat(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) open(0x0, 0x0, 0x0) open(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x82, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="8500000007000000250000000000000095000000000000007bfd775ba478b77c046cdb256559db173112b7d7acf822a3f19794119820392acf0b8324d80f1446f1be9866cc73a22620af2e6c292ab4e17a0013c4b1174e1051c51946428264443cd34fbea20400000000"], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) 19:09:32 executing program 0: syz_genetlink_get_family_id$tipc2(0x0) syz_mount_image$vfat(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) open(0x0, 0x0, 0x0) open(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x82, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="8500000007000000250000000000000095000000000000007bfd775ba478b77c046cdb256559db173112b7d7acf822a3f19794119820392acf0b8324d80f1446f1be9866cc73a22620af2e6c292ab4e17a0013c4b1174e1051c51946428264443cd34fbea20400000000"], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) 19:09:32 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r2, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r2}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) getpeername$inet6(r3, 0x0, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:09:32 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000080)='./file0\x00', 0x43e) write$binfmt_script(r0, &(0x7f0000000dc0)={'#! ', './file0'}, 0x7d) close(r0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000880)=[{0x0, 0x0, &(0x7f0000000040), 0x0, &(0x7f00000000c0)=[@iv={0x48, 0x117, 0x2, 0x33, "227023d7880c1dec977991c532470cc693b6277f9d286a88a13974adf407d201917cc4572c9fe616a6a711d76d57b7dc18172a"}, @assoc={0x18, 0x117, 0x4, 0x356b}, @assoc={0x18, 0x117, 0x4, 0x1f}], 0x78, 0x404005d}, {0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000240)="7423b956e67101b48d039018192d5e8cee6cf36926b46de473671dbef02080c3", 0x20}, {&(0x7f00000002c0)="750e60724e2748ec86be4969855d78dd4b3a58f62f", 0x15}, {&(0x7f0000000300)="73c66fa66dc7ac48d0440ae58d329e070de3995652a1e5bef9f691de41d85604a1aa35ac72281db789d9f69abbf059c642b0066a7978a0b9fe00b475dfb17f6cfb3f13246e54a943699f", 0x4a}, {&(0x7f0000000380)="38783e944b924e22ef3ae59d55e18dee10012bf87cd727e208b2c8ac07863c725afb5dd6fdeea698cd78935cbd364aee35a72b9e6daee0c8f19b04d3df09c7d5d6cc", 0x42}, {0x0}], 0x5, &(0x7f0000000840)=[@iv={0x20, 0x117, 0x2, 0x6, "9c8e0fb05212"}, @assoc={0x18, 0x117, 0x4, 0x2}], 0x38}], 0x2, 0x0) execve(&(0x7f0000000000)='./file0\x00', &(0x7f00000003c0), 0x0) 19:09:32 executing program 5: clone(0x7ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit_group(0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000003c0)=@newlink={0x38, 0x10, 0x705, 0xfaf20000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_LINKINFO={0x18, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_LINK={0x8, 0x3, r2}]]}}}]}, 0x38}}, 0x0) 19:09:32 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e23, @multicast2}, 0x10) write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f0000000040)={0x7}, 0x7) socket$inet6_udp(0xa, 0x2, 0x0) bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendto$inet(r0, 0x0, 0x38f4168b7592eaea, 0xed13f8ac3df0acdb, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r0, &(0x7f0000000480), 0xfffffffffffffdce, 0x5d8, 0x0, 0x150) 19:09:32 executing program 4: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x7ff}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$SG_GET_PACK_ID(0xffffffffffffffff, 0x227c, 0x0) tkill(0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r1, &(0x7f00000000c0)={0x2, 0x0, @loopback}, 0x10) sendfile(r1, r0, 0x0, 0x7ffff000) 19:09:32 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r2, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r2}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) getpeername$inet6(r3, 0x0, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:09:32 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0x80000000b9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r1 = getpid() sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0}, 0x0) fsetxattr$security_selinux(0xffffffffffffffff, &(0x7f00000000c0)='security.selinux\x00', 0x0, 0x0, 0x0) tkill(r1, 0x9) r2 = socket$packet(0x11, 0x3, 0x300) open_by_handle_at(0xffffffffffffffff, 0x0, 0x0) r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff) inotify_add_watch(r3, 0x0, 0x91000430) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x8) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f000095bffc)={0x0, 0x0, 0xfffffffffffffffc}, 0x4) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r4 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x1d7) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r10, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002011400010000000000", @ANYRES32=0x0, @ANYBLOB="000000a800c76f4503775e3a23a7073abc7e54d66704d2654729"], 0x48}}, 0x0) sendmsg$nl_route(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=@ipv4_newaddr={0x20, 0x14, 0x401, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, r10}, [@IFA_LOCAL={0x8, 0x2, @broadcast}]}, 0x20}}, 0x0) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2000000014000104000000000700000002000000", @ANYRES32=r10, @ANYBLOB="0800020000000006"], 0x20}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=@ipv4_newaddr={0x20, 0x11, 0x401, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, r10}, [@IFA_LOCAL={0x8}]}, 0x20}}, 0x0) r11 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r11, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r12) setsockopt$inet6_IPV6_IPSEC_POLICY(r4, 0x29, 0x22, &(0x7f0000000180)={{{@in=@multicast2, @in=@loopback, 0x4e22, 0x8000, 0x4e23, 0x8, 0x2, 0xb0, 0x20, 0x51, r10, r12}, {0x7, 0x18b, 0xff, 0x0, 0x969, 0x7ff, 0x51c, 0x200}, {0x8000, 0x8000, 0xffffffffffff7fff, 0xf668}, 0x80000001, 0x6e6bb2, 0x1, 0x5171dc18361c6e3f, 0x3, 0x3}, {{@in=@empty, 0x4d3, 0x33}, 0xa, @in6=@empty, 0x3501, 0x7, 0x2, 0x5, 0x8000, 0x72, 0x213}}, 0xe8) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000100)={0x28, 0x0, 0x2711, @hyper}, 0x10) r13 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r0, r13, 0x0, 0xedc0) 19:09:32 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r2, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r2}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) getpeername$inet6(r3, 0x0, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:09:32 executing program 2: r0 = creat(&(0x7f0000000080)='./file0\x00', 0x43e) write$binfmt_script(r0, &(0x7f0000000dc0)=ANY=[@ANYBLOB='#'], 0x1) close(r0) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) 19:09:33 executing program 4: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x7ff}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$SG_GET_PACK_ID(0xffffffffffffffff, 0x227c, 0x0) tkill(0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r1, &(0x7f00000000c0)={0x2, 0x0, @loopback}, 0x10) sendfile(r1, r0, 0x0, 0x7ffff000) 19:09:33 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x4}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000080)='./file0\x00', 0x43e) write$binfmt_script(r0, &(0x7f0000000dc0)={'#! ', './file0'}, 0x7d) close(r0) execve(&(0x7f0000000000)='./file0\x00', &(0x7f00000003c0), 0x0) 19:09:33 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r2, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r2}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) getpeername$inet6(r3, 0x0, 0x0) socket(0x3, 0x803, 0x0) 19:09:33 executing program 2: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@allow_other='allow_other'}]}}) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) 19:09:33 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r2, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r2}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) getpeername$inet6(r3, 0x0, 0x0) socket(0x3, 0x803, 0x0) 19:09:33 executing program 5: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000080), 0x4) openat$apparmor_task_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000180)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000380)='TIPCv2\x00') sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, 0x0}, 0x0) readlinkat(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)=""/72, 0x48) syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x200090, 0x0) r1 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = open(&(0x7f0000002bc0)='./file0\x00', 0x40c2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write(r2, &(0x7f0000000600)='4', 0x4100) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ptrace$peekuser(0x3, 0x0, 0x0) 19:09:33 executing program 0: socket$packet(0x11, 0x8000000000000003, 0x300) socket(0x10, 0x3, 0x0) r0 = memfd_create(&(0x7f0000000240)='.^\x00', 0x0) r1 = dup(r0) accept4$inet(r1, &(0x7f0000000400)={0x2, 0x0, @initdev}, 0x0, 0x0) getsockopt$EBT_SO_GET_INIT_INFO(0xffffffffffffffff, 0x0, 0x82, &(0x7f0000000500)={'nat\x00'}, &(0x7f0000000680)=0x50) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'bond0\x00'}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_LOOKUP_ELEM(0x4, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ptmx\x00', 0x120180, 0x0) syz_open_pts(0xffffffffffffffff, 0x18080) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x20004, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="060000000000080029a458891b0f018f54d2dd880ac96edb80b1364e66"], 0x0, 0x1d}, 0x20) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe], 0x1f004}) ioctl$KVM_RUN(r4, 0xae80, 0x0) bind$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random="65ed59501ed8"}, 0x14) chroot(&(0x7f0000000140)='./file0\x00') setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="540000001000050700"/19, @ANYRES32=0x0, @ANYBLOB="0000000000000000340012000000010069703667726574617000000020000000000000000108000100a0f1765503dc85ac78e26932b5198dae0ddf5f4b31269c98ba9568185759a74dbdc261e740dc65daa214975b823ba8f6f6e4f197da74a8767683162e7841b9f5f1e671d56ef75183c0e2c456b53821f876813becdf901e041ee826a74ba41de1028d50ecbbc48b3e6898ca96d930aae1c8e22887a5ae8451f0863ecdf62a363eb8", @ANYRES32], 0x4}}, 0x0) setsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000300)={{{@in=@loopback, @in=@loopback, 0x4e24, 0x8000, 0x4e21, 0x200, 0x2, 0x0, 0x7e82ee9d3f9060d, 0xff822a13e66b7db1, r7, 0xffffffffffffffff}, {0x0, 0x7f, 0x101, 0x8000, 0x0, 0x100000001, 0x2, 0xff}, {0x3, 0x0, 0x2}, 0x6, 0x6e6bb8, 0x0, 0xf523a04e12325132, 0x0, 0x3}, {{@in=@remote, 0x4d5, 0xa}, 0x46d9317c31fe8257, @in=@dev={0xac, 0x14, 0x14, 0x1e}, 0x3500, 0x0, 0x0, 0x6, 0x5694, 0x0, 0x3f}}, 0xe8) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000040)={0x0, 0x800, 0x3ff, 0x3f, 0x0, 0xff, 0x7, 0x0, 0x5, 0x0, 0x40}) 19:09:33 executing program 2: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = open(&(0x7f0000000140)='./file0\x00', 0x68042, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0xa, 0x5, 0x7, 0x9, 0x0, 0xffffffffffffffff, 0x0, [], 0x0, r0, 0x0, 0x100}, 0x3c) [ 2585.414197][ T26] audit: type=1800 audit(1572894574.042:16358): pid=16540 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17065 res=0 19:09:34 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r2, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r2}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) getpeername$inet6(r3, 0x0, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:09:34 executing program 4: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x7ff}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$SG_GET_PACK_ID(0xffffffffffffffff, 0x227c, 0x0) tkill(0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r1, &(0x7f00000000c0)={0x2, 0x0, @loopback}, 0x10) sendfile(r1, r0, 0x0, 0x7ffff000) [ 2585.680521][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2585.686452][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2585.692357][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2585.698103][ C1] protocol 88fb is buggy, dev hsr_slave_1 19:09:34 executing program 5: socket$packet(0x11, 0x0, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000080), 0x4) openat$apparmor_task_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket(0x9, 0x5, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000380)='TIPCv2\x00') sendmsg$TIPC_NL_MON_SET(r0, 0x0, 0x0) readlinkat(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)=""/72, 0x48) syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x200090, 0x0) r1 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = open(&(0x7f0000002bc0)='./file0\x00', 0x40c2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write(r2, &(0x7f0000000600)='4', 0x4100) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='auxv\x00') preadv(r3, &(0x7f0000000480), 0x10000000000001e2, 0x0) ioctl$sock_FIOGETOWN(r3, 0x8903, &(0x7f0000000040)=0x0) ptrace$peekuser(0x3, r4, 0x4) syz_open_procfs(0x0, 0x0) creat(0x0, 0x0) epoll_create1(0x0) 19:09:34 executing program 2: socket$packet(0x11, 0x8000000000000003, 0x300) r0 = socket(0x10, 0x3, 0x0) r1 = memfd_create(&(0x7f0000000240)='.^\x00', 0x0) r2 = dup(r1) fcntl$dupfd(r0, 0x0, r2) r3 = accept4$inet(r2, &(0x7f0000000400)={0x2, 0x0, @initdev}, &(0x7f00000004c0)=0x10, 0x0) getsockopt$EBT_SO_GET_INIT_INFO(r3, 0x0, 0x82, &(0x7f0000000500)={'nat\x00'}, &(0x7f0000000680)=0x50) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'bond0\x00', 0x0}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_LOOKUP_ELEM(0x4, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ptmx\x00', 0x120180, 0x0) syz_open_pts(0xffffffffffffffff, 0x18080) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x20004, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="060000000000080029a458891b0f018f54d2dd880ac96edb80b1364e66"], 0x0, 0x1d}, 0x20) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe], 0x1f004}) ioctl$KVM_RUN(r7, 0xae80, 0x0) bind$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @random="65ed59501ed8"}, 0x14) chroot(&(0x7f0000000140)='./file0\x00') setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f00000000c0)=@req3={0x0, 0x6, 0x8000, 0x6}, 0x1c) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="540000001000050700"/19, @ANYRES32=0x0, @ANYBLOB="0000000000000000340012000000010069703667726574617000000020000000000000000108000100a0f1765503dc85ac78e26932b5198dae0ddf5f4b31269c98ba9568185759a74dbdc261e740dc65daa214975b823ba8f6f6e4f197da74a8767683162e7841b9f5f1e671d56ef75183c0e2c456b53821f876813becdf901e041ee826a74ba41de1028d50ecbbc48b3e6898ca96d930aae1c8e22887a5ae8451f0863ecdf62a363eb8be9bbf8e8c", @ANYRES32], 0x4}}, 0x0) setsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000300)={{{@in=@loopback, @in=@loopback, 0x4e24, 0x8000, 0x4e21, 0x200, 0x2, 0x0, 0x7e82ee9d3f9060d, 0xff822a13e66b7db1, r10, 0xffffffffffffffff}, {0x0, 0x7f, 0x101, 0x8000, 0x0, 0x100000001, 0x2, 0xff}, {0x3, 0x0, 0x2}, 0x6, 0x6e6bb8, 0x0, 0xf523a04e12325132, 0x0, 0x3}, {{@in=@remote, 0x4d5, 0xa}, 0x46d9317c31fe8257, @in=@dev={0xac, 0x14, 0x14, 0x1e}, 0x3500, 0x0, 0x0, 0x6, 0x5694, 0x0, 0x3f}}, 0xe8) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000040)={0x0, 0x800, 0x3ff, 0x3f, 0x0, 0xff, 0x7, 0x0, 0x5, 0x0, 0x40}) 19:09:34 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r2, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r2}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) getpeername$inet6(r3, 0x0, 0x0) socket(0x3, 0x803, 0x0) 19:09:34 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r2, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r2}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) getpeername$inet6(r3, 0x0, 0x0) socket(0x3, 0x803, 0x0) [ 2586.190054][ T26] audit: type=1800 audit(1572894574.812:16359): pid=16563 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="loop5" ino=558 res=0 19:09:34 executing program 0: socket$packet(0x11, 0x8000000000000003, 0x300) socket(0x10, 0x3, 0x0) r0 = memfd_create(&(0x7f0000000240)='.^\x00', 0x0) r1 = dup(r0) accept4$inet(r1, &(0x7f0000000400)={0x2, 0x0, @initdev}, 0x0, 0x0) getsockopt$EBT_SO_GET_INIT_INFO(0xffffffffffffffff, 0x0, 0x82, &(0x7f0000000500)={'nat\x00'}, &(0x7f0000000680)=0x50) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'bond0\x00'}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_LOOKUP_ELEM(0x4, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ptmx\x00', 0x120180, 0x0) syz_open_pts(0xffffffffffffffff, 0x18080) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x20004, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="060000000000080029a458891b0f018f54d2dd880ac96edb80b1364e66"], 0x0, 0x1d}, 0x20) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe], 0x1f004}) ioctl$KVM_RUN(r4, 0xae80, 0x0) bind$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random="65ed59501ed8"}, 0x14) chroot(&(0x7f0000000140)='./file0\x00') setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="540000001000050700"/19, @ANYRES32=0x0, @ANYBLOB="0000000000000000340012000000010069703667726574617000000020000000000000000108000100a0f1765503dc85ac78e26932b5198dae0ddf5f4b31269c98ba9568185759a74dbdc261e740dc65daa214975b823ba8f6f6e4f197da74a8767683162e7841b9f5f1e671d56ef75183c0e2c456b53821f876813becdf901e041ee826a74ba41de1028d50ecbbc48b3e6898ca96d930aae1c8e22887a5ae8451f0863ecdf62a363eb8", @ANYRES32], 0x4}}, 0x0) setsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000300)={{{@in=@loopback, @in=@loopback, 0x4e24, 0x8000, 0x4e21, 0x200, 0x2, 0x0, 0x7e82ee9d3f9060d, 0xff822a13e66b7db1, r7, 0xffffffffffffffff}, {0x0, 0x7f, 0x101, 0x8000, 0x0, 0x100000001, 0x2, 0xff}, {0x3, 0x0, 0x2}, 0x6, 0x6e6bb8, 0x0, 0xf523a04e12325132, 0x0, 0x3}, {{@in=@remote, 0x4d5, 0xa}, 0x46d9317c31fe8257, @in=@dev={0xac, 0x14, 0x14, 0x1e}, 0x3500, 0x0, 0x0, 0x6, 0x5694, 0x0, 0x3f}}, 0xe8) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000040)={0x0, 0x800, 0x3ff, 0x3f, 0x0, 0xff, 0x7, 0x0, 0x5, 0x0, 0x40}) 19:09:35 executing program 4: socket$packet(0x11, 0x8000000000000003, 0x300) socket(0x10, 0x3, 0x0) r0 = memfd_create(&(0x7f0000000240)='.^\x00', 0x0) r1 = dup(r0) accept4$inet(r1, &(0x7f0000000400)={0x2, 0x0, @initdev}, 0x0, 0x0) getsockopt$EBT_SO_GET_INIT_INFO(0xffffffffffffffff, 0x0, 0x82, &(0x7f0000000500)={'nat\x00'}, &(0x7f0000000680)=0x50) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'bond0\x00'}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_LOOKUP_ELEM(0x4, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ptmx\x00', 0x120180, 0x0) syz_open_pts(0xffffffffffffffff, 0x18080) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x20004, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="060000000000080029a458891b0f018f54d2dd880ac96edb80b1364e66"], 0x0, 0x1d}, 0x20) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe], 0x1f004}) ioctl$KVM_RUN(r4, 0xae80, 0x0) bind$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random="65ed59501ed8"}, 0x14) chroot(&(0x7f0000000140)='./file0\x00') setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="540000001000050700"/19, @ANYRES32=0x0, @ANYBLOB="0000000000000000340012000000010069703667726574617000000020000000000000000108000100a0f1765503dc85ac78e26932b5198dae0ddf5f4b31269c98ba9568185759a74dbdc261e740dc65daa214975b823ba8f6f6e4f197da74a8767683162e7841b9f5f1e671d56ef75183c0e2c456b53821f876813becdf901e041ee826a74ba41de1028d50ecbbc48b3e6898ca96d930aae1c8e22887a5ae8451f0863ecdf62a363eb8", @ANYRES32], 0x4}}, 0x0) setsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000300)={{{@in=@loopback, @in=@loopback, 0x4e24, 0x8000, 0x4e21, 0x200, 0x2, 0x0, 0x7e82ee9d3f9060d, 0xff822a13e66b7db1, r7, 0xffffffffffffffff}, {0x0, 0x7f, 0x101, 0x8000, 0x0, 0x100000001, 0x2, 0xff}, {0x3, 0x0, 0x2}, 0x6, 0x6e6bb8, 0x0, 0xf523a04e12325132, 0x0, 0x3}, {{@in=@remote, 0x4d5, 0xa}, 0x46d9317c31fe8257, @in=@dev={0xac, 0x14, 0x14, 0x1e}, 0x3500, 0x0, 0x0, 0x6, 0x5694, 0x0, 0x3f}}, 0xe8) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000040)={0x0, 0x800, 0x3ff, 0x3f, 0x0, 0xff, 0x7, 0x0, 0x5, 0x0, 0x40}) 19:09:35 executing program 5: socket$packet(0x11, 0x0, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000080), 0x4) openat$apparmor_task_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket(0x9, 0x5, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000380)='TIPCv2\x00') sendmsg$TIPC_NL_MON_SET(r0, 0x0, 0x0) readlinkat(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)=""/72, 0x48) syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x200090, 0x0) r1 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = open(&(0x7f0000002bc0)='./file0\x00', 0x40c2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write(r2, &(0x7f0000000600)='4', 0x4100) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='auxv\x00') preadv(r3, &(0x7f0000000480), 0x10000000000001e2, 0x0) ioctl$sock_FIOGETOWN(r3, 0x8903, &(0x7f0000000040)=0x0) ptrace$peekuser(0x3, r4, 0x4) syz_open_procfs(0x0, 0x0) creat(0x0, 0x0) epoll_create1(0x0) 19:09:35 executing program 2: socket$packet(0x11, 0x8000000000000003, 0x300) r0 = socket(0x10, 0x3, 0x0) r1 = memfd_create(&(0x7f0000000240)='.^\x00', 0x0) r2 = dup(r1) fcntl$dupfd(r0, 0x0, r2) r3 = accept4$inet(r2, &(0x7f0000000400)={0x2, 0x0, @initdev}, &(0x7f00000004c0)=0x10, 0x0) getsockopt$EBT_SO_GET_INIT_INFO(r3, 0x0, 0x82, &(0x7f0000000500)={'nat\x00'}, &(0x7f0000000680)=0x50) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'bond0\x00', 0x0}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_LOOKUP_ELEM(0x4, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ptmx\x00', 0x120180, 0x0) syz_open_pts(0xffffffffffffffff, 0x18080) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x20004, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="060000000000080029a458891b0f018f54d2dd880ac96edb80b1364e66"], 0x0, 0x1d}, 0x20) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe], 0x1f004}) ioctl$KVM_RUN(r7, 0xae80, 0x0) bind$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @random="65ed59501ed8"}, 0x14) chroot(&(0x7f0000000140)='./file0\x00') setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f00000000c0)=@req3={0x0, 0x6, 0x8000, 0x6}, 0x1c) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="540000001000050700"/19, @ANYRES32=0x0, @ANYBLOB="0000000000000000340012000000010069703667726574617000000020000000000000000108000100a0f1765503dc85ac78e26932b5198dae0ddf5f4b31269c98ba9568185759a74dbdc261e740dc65daa214975b823ba8f6f6e4f197da74a8767683162e7841b9f5f1e671d56ef75183c0e2c456b53821f876813becdf901e041ee826a74ba41de1028d50ecbbc48b3e6898ca96d930aae1c8e22887a5ae8451f0863ecdf62a363eb8be9bbf8e8c", @ANYRES32], 0x4}}, 0x0) setsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000300)={{{@in=@loopback, @in=@loopback, 0x4e24, 0x8000, 0x4e21, 0x200, 0x2, 0x0, 0x7e82ee9d3f9060d, 0xff822a13e66b7db1, r10, 0xffffffffffffffff}, {0x0, 0x7f, 0x101, 0x8000, 0x0, 0x100000001, 0x2, 0xff}, {0x3, 0x0, 0x2}, 0x6, 0x6e6bb8, 0x0, 0xf523a04e12325132, 0x0, 0x3}, {{@in=@remote, 0x4d5, 0xa}, 0x46d9317c31fe8257, @in=@dev={0xac, 0x14, 0x14, 0x1e}, 0x3500, 0x0, 0x0, 0x6, 0x5694, 0x0, 0x3f}}, 0xe8) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000040)={0x0, 0x800, 0x3ff, 0x3f, 0x0, 0xff, 0x7, 0x0, 0x5, 0x0, 0x40}) [ 2586.870492][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2586.876361][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2586.950528][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2586.956318][ C0] protocol 88fb is buggy, dev hsr_slave_1 19:09:35 executing program 0: socket$packet(0x11, 0x8000000000000003, 0x300) socket(0x10, 0x3, 0x0) r0 = memfd_create(&(0x7f0000000240)='.^\x00', 0x0) r1 = dup(r0) accept4$inet(r1, &(0x7f0000000400)={0x2, 0x0, @initdev}, 0x0, 0x0) getsockopt$EBT_SO_GET_INIT_INFO(0xffffffffffffffff, 0x0, 0x82, &(0x7f0000000500)={'nat\x00'}, &(0x7f0000000680)=0x50) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'bond0\x00'}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_LOOKUP_ELEM(0x4, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ptmx\x00', 0x120180, 0x0) syz_open_pts(0xffffffffffffffff, 0x18080) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x20004, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="060000000000080029a458891b0f018f54d2dd880ac96edb80b1364e66"], 0x0, 0x1d}, 0x20) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe], 0x1f004}) ioctl$KVM_RUN(r4, 0xae80, 0x0) bind$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random="65ed59501ed8"}, 0x14) chroot(&(0x7f0000000140)='./file0\x00') setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="540000001000050700"/19, @ANYRES32=0x0, @ANYBLOB="0000000000000000340012000000010069703667726574617000000020000000000000000108000100a0f1765503dc85ac78e26932b5198dae0ddf5f4b31269c98ba9568185759a74dbdc261e740dc65daa214975b823ba8f6f6e4f197da74a8767683162e7841b9f5f1e671d56ef75183c0e2c456b53821f876813becdf901e041ee826a74ba41de1028d50ecbbc48b3e6898ca96d930aae1c8e22887a5ae8451f0863ecdf62a363eb8", @ANYRES32], 0x4}}, 0x0) setsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000300)={{{@in=@loopback, @in=@loopback, 0x4e24, 0x8000, 0x4e21, 0x200, 0x2, 0x0, 0x7e82ee9d3f9060d, 0xff822a13e66b7db1, r7, 0xffffffffffffffff}, {0x0, 0x7f, 0x101, 0x8000, 0x0, 0x100000001, 0x2, 0xff}, {0x3, 0x0, 0x2}, 0x6, 0x6e6bb8, 0x0, 0xf523a04e12325132, 0x0, 0x3}, {{@in=@remote, 0x4d5, 0xa}, 0x46d9317c31fe8257, @in=@dev={0xac, 0x14, 0x14, 0x1e}, 0x3500, 0x0, 0x0, 0x6, 0x5694, 0x0, 0x3f}}, 0xe8) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000040)={0x0, 0x800, 0x3ff, 0x3f, 0x0, 0xff, 0x7, 0x0, 0x5, 0x0, 0x40}) 19:09:35 executing program 4: socket$packet(0x11, 0x8000000000000003, 0x300) socket(0x10, 0x3, 0x0) r0 = memfd_create(&(0x7f0000000240)='.^\x00', 0x0) r1 = dup(r0) accept4$inet(r1, &(0x7f0000000400)={0x2, 0x0, @initdev}, 0x0, 0x0) getsockopt$EBT_SO_GET_INIT_INFO(0xffffffffffffffff, 0x0, 0x82, &(0x7f0000000500)={'nat\x00'}, &(0x7f0000000680)=0x50) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'bond0\x00'}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_LOOKUP_ELEM(0x4, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ptmx\x00', 0x120180, 0x0) syz_open_pts(0xffffffffffffffff, 0x18080) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x20004, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="060000000000080029a458891b0f018f54d2dd880ac96edb80b1364e66"], 0x0, 0x1d}, 0x20) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe], 0x1f004}) ioctl$KVM_RUN(r4, 0xae80, 0x0) bind$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random="65ed59501ed8"}, 0x14) chroot(&(0x7f0000000140)='./file0\x00') setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="540000001000050700"/19, @ANYRES32=0x0, @ANYBLOB="0000000000000000340012000000010069703667726574617000000020000000000000000108000100a0f1765503dc85ac78e26932b5198dae0ddf5f4b31269c98ba9568185759a74dbdc261e740dc65daa214975b823ba8f6f6e4f197da74a8767683162e7841b9f5f1e671d56ef75183c0e2c456b53821f876813becdf901e041ee826a74ba41de1028d50ecbbc48b3e6898ca96d930aae1c8e22887a5ae8451f0863ecdf62a363eb8", @ANYRES32], 0x4}}, 0x0) setsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000300)={{{@in=@loopback, @in=@loopback, 0x4e24, 0x8000, 0x4e21, 0x200, 0x2, 0x0, 0x7e82ee9d3f9060d, 0xff822a13e66b7db1, r7, 0xffffffffffffffff}, {0x0, 0x7f, 0x101, 0x8000, 0x0, 0x100000001, 0x2, 0xff}, {0x3, 0x0, 0x2}, 0x6, 0x6e6bb8, 0x0, 0xf523a04e12325132, 0x0, 0x3}, {{@in=@remote, 0x4d5, 0xa}, 0x46d9317c31fe8257, @in=@dev={0xac, 0x14, 0x14, 0x1e}, 0x3500, 0x0, 0x0, 0x6, 0x5694, 0x0, 0x3f}}, 0xe8) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000040)={0x0, 0x800, 0x3ff, 0x3f, 0x0, 0xff, 0x7, 0x0, 0x5, 0x0, 0x40}) [ 2587.140993][ T26] audit: type=1800 audit(1572894575.752:16360): pid=16602 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17017 res=0 19:09:36 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r2, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r2}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) getpeername$inet6(r3, 0x0, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:09:36 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r2, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r2}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) getpeername$inet6(r3, 0x0, 0x0) socket(0x3, 0x803, 0x0) 19:09:36 executing program 5: socket$packet(0x11, 0x0, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000080), 0x4) openat$apparmor_task_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket(0x9, 0x5, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000380)='TIPCv2\x00') sendmsg$TIPC_NL_MON_SET(r0, 0x0, 0x0) readlinkat(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)=""/72, 0x48) syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x200090, 0x0) r1 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = open(&(0x7f0000002bc0)='./file0\x00', 0x40c2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write(r2, &(0x7f0000000600)='4', 0x4100) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='auxv\x00') preadv(r3, &(0x7f0000000480), 0x10000000000001e2, 0x0) ioctl$sock_FIOGETOWN(r3, 0x8903, &(0x7f0000000040)=0x0) ptrace$peekuser(0x3, r4, 0x4) syz_open_procfs(0x0, 0x0) creat(0x0, 0x0) epoll_create1(0x0) 19:09:36 executing program 2: socket$packet(0x11, 0x8000000000000003, 0x300) socket(0x10, 0x3, 0x0) r0 = memfd_create(&(0x7f0000000240)='.^\x00', 0x0) r1 = dup(r0) accept4$inet(r1, &(0x7f0000000400)={0x2, 0x0, @initdev}, 0x0, 0x0) getsockopt$EBT_SO_GET_INIT_INFO(0xffffffffffffffff, 0x0, 0x82, &(0x7f0000000500)={'nat\x00'}, &(0x7f0000000680)=0x50) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'bond0\x00'}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_LOOKUP_ELEM(0x4, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ptmx\x00', 0x120180, 0x0) syz_open_pts(0xffffffffffffffff, 0x18080) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x20004, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="060000000000080029a458891b0f018f54d2dd880ac96edb80b1364e66"], 0x0, 0x1d}, 0x20) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe], 0x1f004}) ioctl$KVM_RUN(r4, 0xae80, 0x0) bind$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random="65ed59501ed8"}, 0x14) chroot(&(0x7f0000000140)='./file0\x00') setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="540000001000050700"/19, @ANYRES32=0x0, @ANYBLOB="0000000000000000340012000000010069703667726574617000000020000000000000000108000100a0f1765503dc85ac78e26932b5198dae0ddf5f4b31269c98ba9568185759a74dbdc261e740dc65daa214975b823ba8f6f6e4f197da74a8767683162e7841b9f5f1e671d56ef75183c0e2c456b53821f876813becdf901e041ee826a74ba41de1028d50ecbbc48b3e6898ca96d930aae1c8e22887a5ae8451f0863ecdf62a363eb8", @ANYRES32], 0x4}}, 0x0) setsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000300)={{{@in=@loopback, @in=@loopback, 0x4e24, 0x8000, 0x4e21, 0x200, 0x2, 0x0, 0x7e82ee9d3f9060d, 0xff822a13e66b7db1, r7, 0xffffffffffffffff}, {0x0, 0x7f, 0x101, 0x8000, 0x0, 0x100000001, 0x2, 0xff}, {0x3, 0x0, 0x2}, 0x6, 0x6e6bb8, 0x0, 0xf523a04e12325132, 0x0, 0x3}, {{@in=@remote, 0x4d5, 0xa}, 0x46d9317c31fe8257, @in=@dev={0xac, 0x14, 0x14, 0x1e}, 0x3500, 0x0, 0x0, 0x6, 0x5694, 0x0, 0x3f}}, 0xe8) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000040)={0x0, 0x800, 0x3ff, 0x3f, 0x0, 0xff, 0x7, 0x0, 0x5, 0x0, 0x40}) [ 2587.750512][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2587.756335][ C1] protocol 88fb is buggy, dev hsr_slave_1 19:09:36 executing program 0: socket$packet(0x11, 0x8000000000000003, 0x300) r0 = socket(0x10, 0x3, 0x0) r1 = memfd_create(&(0x7f0000000240)='.^\x00', 0x0) r2 = dup(r1) fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) r3 = accept4$inet(r2, &(0x7f0000000400)={0x2, 0x0, @initdev}, &(0x7f00000004c0)=0x10, 0x140800) getsockopt$EBT_SO_GET_INIT_INFO(r3, 0x0, 0x82, &(0x7f0000000500)={'nat\x00'}, &(0x7f0000000680)=0x50) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'bond0\x00', 0x0}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_LOOKUP_ELEM(0x4, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ptmx\x00', 0x120180, 0x0) syz_open_pts(0xffffffffffffffff, 0x18080) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x20004, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="060000000000080029a458891b0f018f54d2dd880ac96edb80b1364e66"], 0x0, 0x1d}, 0x20) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe], 0x1f004}) ioctl$KVM_RUN(r7, 0xae80, 0x0) bind$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @random="65ed59501ed8"}, 0x14) chroot(&(0x7f0000000140)='./file0\x00') setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f00000000c0)=@req3={0x0, 0x6, 0x8000, 0x6}, 0x1c) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="540000001000050700"/19, @ANYRES32=0x0, @ANYBLOB="0000000000000000340012000000010069703667726574617000000020000000000000000108000100a0f1765503dc85ac78e26932b5198dae0ddf5f4b31269c98ba9568185759a74dbdc261e740dc65daa214975b823ba8f6f6e4f197da74a8767683162e7841b9f5f1e671d56ef75183c0e2c456b53821f876813becdf901e041ee826a74ba41de1028d50ecbbc48b3e6898ca96d930aae1c8e22887a5ae8451f0863ecdf62a363eb8be9bbf8e8c", @ANYRES32], 0x4}}, 0x0) setsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000300)={{{@in=@loopback, @in=@loopback, 0x4e24, 0x8000, 0x4e21, 0x200, 0x2, 0x0, 0x7e82ee9d3f9060d, 0xff822a13e66b7db1, r10, 0xffffffffffffffff}, {0x0, 0x7f, 0x101, 0x8000, 0x0, 0x100000001, 0x2, 0xff}, {0x3, 0x0, 0x2}, 0x6, 0x6e6bb8, 0x0, 0xf523a04e12325132, 0x0, 0x3}, {{@in=@remote, 0x4d5, 0xa}, 0x46d9317c31fe8257, @in=@dev={0xac, 0x14, 0x14, 0x1e}, 0x3500, 0x0, 0x0, 0x6, 0x5694, 0x0, 0x3f}}, 0xe8) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000040)={0x0, 0x800, 0x3ff, 0x3f, 0x0, 0xff, 0x7, 0x0, 0x5, 0x0, 0x40}) 19:09:36 executing program 4: socket$packet(0x11, 0x8000000000000003, 0x300) socket(0x10, 0x3, 0x0) r0 = memfd_create(&(0x7f0000000240)='.^\x00', 0x0) r1 = dup(r0) accept4$inet(r1, &(0x7f0000000400)={0x2, 0x0, @initdev}, 0x0, 0x0) getsockopt$EBT_SO_GET_INIT_INFO(0xffffffffffffffff, 0x0, 0x82, &(0x7f0000000500)={'nat\x00'}, &(0x7f0000000680)=0x50) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'bond0\x00'}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_LOOKUP_ELEM(0x4, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ptmx\x00', 0x120180, 0x0) syz_open_pts(0xffffffffffffffff, 0x18080) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x20004, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="060000000000080029a458891b0f018f54d2dd880ac96edb80b1364e66"], 0x0, 0x1d}, 0x20) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe], 0x1f004}) ioctl$KVM_RUN(r4, 0xae80, 0x0) bind$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random="65ed59501ed8"}, 0x14) chroot(&(0x7f0000000140)='./file0\x00') setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="540000001000050700"/19, @ANYRES32=0x0, @ANYBLOB="0000000000000000340012000000010069703667726574617000000020000000000000000108000100a0f1765503dc85ac78e26932b5198dae0ddf5f4b31269c98ba9568185759a74dbdc261e740dc65daa214975b823ba8f6f6e4f197da74a8767683162e7841b9f5f1e671d56ef75183c0e2c456b53821f876813becdf901e041ee826a74ba41de1028d50ecbbc48b3e6898ca96d930aae1c8e22887a5ae8451f0863ecdf62a363eb8", @ANYRES32], 0x4}}, 0x0) setsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000300)={{{@in=@loopback, @in=@loopback, 0x4e24, 0x8000, 0x4e21, 0x200, 0x2, 0x0, 0x7e82ee9d3f9060d, 0xff822a13e66b7db1, r7, 0xffffffffffffffff}, {0x0, 0x7f, 0x101, 0x8000, 0x0, 0x100000001, 0x2, 0xff}, {0x3, 0x0, 0x2}, 0x6, 0x6e6bb8, 0x0, 0xf523a04e12325132, 0x0, 0x3}, {{@in=@remote, 0x4d5, 0xa}, 0x46d9317c31fe8257, @in=@dev={0xac, 0x14, 0x14, 0x1e}, 0x3500, 0x0, 0x0, 0x6, 0x5694, 0x0, 0x3f}}, 0xe8) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000040)={0x0, 0x800, 0x3ff, 0x3f, 0x0, 0xff, 0x7, 0x0, 0x5, 0x0, 0x40}) 19:09:37 executing program 5: socket$packet(0x11, 0x0, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000080), 0x4) openat$apparmor_task_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket(0x9, 0x5, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000380)='TIPCv2\x00') sendmsg$TIPC_NL_MON_SET(r0, 0x0, 0x0) readlinkat(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)=""/72, 0x48) syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x200090, 0x0) r1 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = open(&(0x7f0000002bc0)='./file0\x00', 0x40c2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write(r2, &(0x7f0000000600)='4', 0x4100) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='auxv\x00') preadv(r3, &(0x7f0000000480), 0x10000000000001e2, 0x0) ioctl$sock_FIOGETOWN(r3, 0x8903, &(0x7f0000000040)=0x0) ptrace$peekuser(0x3, r4, 0x4) syz_open_procfs(0x0, 0x0) creat(0x0, 0x0) epoll_create1(0x0) 19:09:37 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r2, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r2}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) getpeername$inet6(r3, 0x0, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:09:37 executing program 2: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x50000}]}) setsockopt$inet_mtu(0xffffffffffffff9c, 0x0, 0xa, &(0x7f0000000100), 0x0) 19:09:37 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0x80000000b9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r1 = getpid() openat$zero(0xffffffffffffff9c, &(0x7f0000000140)='/dev/zero\x00', 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0}, 0x0) fsetxattr$security_selinux(0xffffffffffffffff, &(0x7f00000000c0)='security.selinux\x00', 0x0, 0x0, 0x0) tkill(r1, 0x9) r2 = socket$packet(0x11, 0x3, 0x300) r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff) inotify_add_watch(r3, 0x0, 0x91000430) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x8) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f000095bffc)={0x0, 0x0, 0xfffffffffffffffc}, 0x4) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r4 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x1d7) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r10, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002011400010000000000", @ANYRES32=0x0, @ANYBLOB="000000a800c76f4503775e3a23a7073abc7e54d66704d2654729"], 0x48}}, 0x0) sendmsg$nl_route(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=@ipv4_newaddr={0x20, 0x14, 0x401, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, r10}, [@IFA_LOCAL={0x8, 0x2, @broadcast}]}, 0x20}}, 0x0) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2000000014000104000000000700000002000000", @ANYRES32=r10, @ANYBLOB="0800020000000006"], 0x20}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=@ipv4_newaddr={0x20, 0x11, 0x401, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, r10}, [@IFA_LOCAL={0x8}]}, 0x20}}, 0x0) r11 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r11, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r12) setsockopt$inet6_IPV6_IPSEC_POLICY(r4, 0x29, 0x22, &(0x7f0000000180)={{{@in=@multicast2, @in=@loopback, 0x4e22, 0x8000, 0x4e23, 0x8, 0x2, 0xb0, 0x20, 0x51, r10, r12}, {0x7, 0x18b, 0xff, 0x0, 0x969, 0x7ff, 0x51c, 0x200}, {0x8000, 0x8000, 0xffffffffffff7fff, 0xf668}, 0x80000001, 0x6e6bb2, 0x1, 0x5171dc18361c6e3f, 0x3, 0x3}, {{@in=@empty, 0x0, 0x33}, 0xa, @in6=@empty, 0x3501, 0x7, 0x2, 0x5, 0x8000, 0x72, 0x213}}, 0xe8) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000100)={0x28, 0x0, 0x2711, @hyper}, 0x10) syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') [ 2588.787398][ T26] audit: type=1800 audit(1572894577.412:16361): pid=16652 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17022 res=0 19:09:37 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0x80000000b9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r1 = getpid() openat$zero(0xffffffffffffff9c, &(0x7f0000000140)='/dev/zero\x00', 0x408200, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0}, 0x0) fsetxattr$security_selinux(0xffffffffffffffff, &(0x7f00000000c0)='security.selinux\x00', 0x0, 0x0, 0x0) tkill(r1, 0x9) r2 = socket$packet(0x11, 0x3, 0x300) open_by_handle_at(0xffffffffffffffff, 0x0, 0x0) r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff) inotify_add_watch(r3, 0x0, 0x91000430) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x8) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f000095bffc)={0x0, 0x0, 0xfffffffffffffffc}, 0x4) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r4 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x1d7) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r10, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002011400010000000000", @ANYRES32=0x0, @ANYBLOB="000000a800c76f4503775e3a23a7073abc7e54d66704d2654729"], 0x48}}, 0x0) sendmsg$nl_route(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=@ipv4_newaddr={0x20, 0x14, 0x401, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, r10}, [@IFA_LOCAL={0x8, 0x2, @broadcast}]}, 0x20}}, 0x0) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2000000014000104000000000700000002000000", @ANYRES32=r10, @ANYBLOB="0800020000000006"], 0x20}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=@ipv4_newaddr={0x20, 0x11, 0x401, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, r10}, [@IFA_LOCAL={0x8}]}, 0x20}}, 0x0) r11 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r11, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r12) setsockopt$inet6_IPV6_IPSEC_POLICY(r4, 0x29, 0x22, &(0x7f0000000180)={{{@in=@multicast2, @in=@loopback, 0x4e22, 0x8000, 0x4e23, 0x8, 0x2, 0xb0, 0x20, 0x51, r10, r12}, {0x7, 0x18b, 0xff, 0x0, 0x969, 0x7ff, 0x51c, 0x200}, {0x8000, 0x8000, 0xffffffffffff7fff, 0xf668}, 0x80000001, 0x6e6bb2, 0x1, 0x5171dc18361c6e3f, 0x3, 0x3}, {{@in=@empty, 0x4d3, 0x33}, 0xa, @in6=@empty, 0x3501, 0x7, 0x2, 0x5, 0x8000, 0x72}}, 0xe8) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000100)={0x28, 0x0, 0x2711, @hyper}, 0x10) r13 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r0, r13, 0x0, 0xedc0) 19:09:37 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r2, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r2}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) getpeername$inet6(r3, 0x0, 0x0) socket(0x3, 0x803, 0x0) 19:09:37 executing program 2: r0 = fanotify_init(0x0, 0x0) r1 = epoll_create1(0x0) r2 = fcntl$dupfd(r1, 0x2, 0xffffffffffffffff) fanotify_mark(r0, 0x31, 0x2, r2, 0x0) 19:09:38 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) inotify_init1(0x800) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:09:38 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0x80000000b9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r1 = getpid() openat$zero(0xffffffffffffff9c, &(0x7f0000000140)='/dev/zero\x00', 0x408200, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0}, 0x0) fsetxattr$security_selinux(0xffffffffffffffff, &(0x7f00000000c0)='security.selinux\x00', 0x0, 0x0, 0x0) tkill(r1, 0x9) r2 = socket$packet(0x11, 0x3, 0x300) open_by_handle_at(0xffffffffffffffff, 0x0, 0x0) r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff) inotify_add_watch(r3, 0x0, 0x91000430) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x8) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f000095bffc)={0x0, 0x0, 0xfffffffffffffffc}, 0x4) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r4 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x1d7) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r10, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002011400010000000000", @ANYRES32=0x0, @ANYBLOB="000000a800c76f4503775e3a23a7073abc7e54d66704d2654729"], 0x48}}, 0x0) sendmsg$nl_route(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=@ipv4_newaddr={0x20, 0x14, 0x401, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, r10}, [@IFA_LOCAL={0x8, 0x2, @broadcast}]}, 0x20}}, 0x0) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2000000014000104000000000700000002000000", @ANYRES32=r10, @ANYBLOB="0800020000000006"], 0x20}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=@ipv4_newaddr={0x20, 0x11, 0x401, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, r10}, [@IFA_LOCAL={0x8}]}, 0x20}}, 0x0) r11 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r11, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r12) setsockopt$inet6_IPV6_IPSEC_POLICY(r4, 0x29, 0x22, &(0x7f0000000180)={{{@in=@multicast2, @in=@loopback, 0x4e22, 0x8000, 0x4e23, 0x8, 0x2, 0xb0, 0x20, 0x51, r10, r12}, {0x7, 0x18b, 0xff, 0x0, 0x969, 0x7ff, 0x51c, 0x200}, {0x8000, 0x8000, 0xffffffffffff7fff, 0xf668}, 0x80000001, 0x6e6bb2, 0x1, 0x5171dc18361c6e3f, 0x3, 0x3}, {{@in=@empty, 0x4d3, 0x33}, 0xa, @in6=@empty, 0x3501, 0x7, 0x2, 0x5, 0x8000, 0x72}}, 0xe8) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000100)={0x28, 0x0, 0x2711, @hyper}, 0x10) r13 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r0, r13, 0x0, 0xedc0) 19:09:38 executing program 2: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e23, @multicast2}, 0x10) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28460, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$P9_RXATTRCREATE(0xffffffffffffffff, 0x0, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendto$inet(r0, 0x0, 0x38f4168b7592eaea, 0xed13f8ac3df0acdb, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='sit0\x00', 0x10) setsockopt$inet_mtu(r0, 0x0, 0xa, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000480), 0xfffffffffffffdce, 0x5d8, 0x0, 0x150) [ 2589.655032][ T26] audit: type=1800 audit(1572894578.282:16362): pid=16682 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16741 res=0 [ 2589.784808][ T26] audit: type=1804 audit(1572894578.312:16363): pid=16682 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1909/file0" dev="sda1" ino=16741 res=1 19:09:38 executing program 0: syz_open_dev$evdev(&(0x7f0000000100)='/d_\n\n\x97a\x83\xa1\xa5\xffd\x04e\x89\x88#\x00', 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r0, &(0x7f0000000000), 0x0) write$char_usb(r0, &(0x7f0000000040)="b08385eb087c1cb4040000008909e51c47493a7ed57c90c176d2689b298b6ae77eca5a980dc529017e166bf884a3770c204cc5d96f81ef723fd8623098b00eadbaaaa624e51f32a77b01fdaaeb62f5c0883b9673c431f771484f542de386a57ece", 0x61) write$char_usb(0xffffffffffffffff, &(0x7f0000000140)="d217adebf7b6c824a85e7f3f844fa74c98072e8fd254d46c8ece8717c09aaaea2d879205e1eac431390295385fc8d2bb149611be9d5f0a3555c21fdb4dc2a038599dc5a832b25d00c9302de298203b67ba29a3d27a2aa493d7eed56c5dbbc6df19bf383ba4a4152a0bd2533dcbfbc4cb77199f37b192a9b98f375aa8c3ffdaa15e14c84dc9ef11ee501365de65a0e7fb0490d44b077f467f16dfa2237d1fd8e7d2ca1297", 0xa4) r1 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev\v\xc8h\xbb\xc0\xc5}Bvent#\x00', 0x0, 0x125401) write$char_usb(0xffffffffffffffff, 0x0, 0x0) ioctl$EVIOCSCLOCKID(r1, 0x6611, 0x0) syz_open_dev$evdev(0x0, 0x0, 0x0) [ 2590.009376][ T26] audit: type=1804 audit(1572894578.352:16364): pid=16685 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1909/file0" dev="sda1" ino=16741 res=1 19:09:38 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r2, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r2}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) getpeername$inet6(r3, 0x0, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:09:39 executing program 2: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e23, @multicast2}, 0x10) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28460, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$P9_RXATTRCREATE(0xffffffffffffffff, 0x0, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendto$inet(r0, 0x0, 0x38f4168b7592eaea, 0xed13f8ac3df0acdb, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='sit0\x00', 0x10) setsockopt$inet_mtu(r0, 0x0, 0xa, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000480), 0xfffffffffffffdce, 0x5d8, 0x0, 0x150) 19:09:39 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) inotify_init1(0x800) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:09:39 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r2, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r2}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) getpeername$inet6(r3, 0x0, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2590.460908][ T26] audit: type=1804 audit(1572894579.092:16365): pid=16697 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1909/file0" dev="sda1" ino=16741 res=1 19:09:39 executing program 0: r0 = getpid() perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x0) syz_open_procfs(0x0, 0x0) prctl$PR_SET_PTRACER(0x59616d61, r0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="223215d8061800000000718e14899f537a496cdc4382fd6a72520db98f97c048b82ea15718cd2f932d82d395d930af"], 0x1}}, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x29) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x9}) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r1, 0x0, 0x0) [ 2590.629648][ T26] audit: type=1804 audit(1572894579.092:16366): pid=16696 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1909/file0" dev="sda1" ino=16741 res=1 [ 2590.865588][ T26] audit: type=1800 audit(1572894579.342:16367): pid=16712 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16886 res=0 19:09:39 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) [ 2590.994047][ T26] audit: type=1804 audit(1572894579.372:16368): pid=16712 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1910/file0" dev="sda1" ino=16886 res=1 19:09:39 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0, 0x3fd}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/tcp6\x00') preadv(r0, &(0x7f00000017c0), 0x3cc, 0x1f000000) ioctl$TIOCGSOFTCAR(0xffffffffffffffff, 0x5419, &(0x7f0000000040)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r2 = dup2(r1, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) [ 2591.255931][ T26] audit: type=1804 audit(1572894579.462:16369): pid=16718 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1910/file0" dev="sda1" ino=16886 res=1 19:09:40 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) inotify_init1(0x800) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:09:40 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_emit_ethernet(0x4a, &(0x7f00000001c0)={@local, @dev, [], {@ipv6={0x86dd, {0x0, 0x6, "db652b", 0x14, 0x0, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd]}, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) [ 2591.623587][ T26] audit: type=1800 audit(1572894580.252:16370): pid=16732 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16661 res=0 [ 2591.701202][ T26] audit: type=1804 audit(1572894580.282:16371): pid=16732 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1911/file0" dev="sda1" ino=16661 res=1 19:09:40 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r2, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r2}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) getpeername$inet6(r3, 0x0, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:09:40 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r2, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r2}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2591.833428][ T26] audit: type=1804 audit(1572894580.412:16372): pid=16738 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1911/file0" dev="sda1" ino=16661 res=1 19:09:40 executing program 2: clone(0x200, 0x0, 0x0, 0x0, 0x0) mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) creat(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x200010a) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) creat(0x0, 0x0) select(0x0, 0x0, 0x0, 0x0, 0x0) open$dir(&(0x7f0000000240)='./file0\x00', 0x841, 0x0) 19:09:40 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r2, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r2}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:09:41 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) inotify_init1(0x800) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:09:41 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r2, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r2}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) getpeername$inet6(r3, 0x0, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2592.627120][ T26] audit: type=1800 audit(1572894581.252:16373): pid=16764 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16490 res=0 19:09:41 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r2, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r2}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2592.694592][ T26] audit: type=1804 audit(1572894581.322:16374): pid=16764 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1912/file0" dev="sda1" ino=16490 res=1 19:09:41 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r2, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r2}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:09:42 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:09:56 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:09:56 executing program 2: clone(0x200, 0x0, 0x0, 0x0, 0x0) mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) creat(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x200010a) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) creat(0x0, 0x0) select(0x0, 0x0, 0x0, 0x0, 0x0) open$dir(&(0x7f0000000240)='./file0\x00', 0x841, 0x0) 19:09:56 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) inotify_init1(0x800) sendfile(r0, r1, 0x0, 0x7fffffff) sendfile(0xffffffffffffffff, r0, 0x0, 0xffffffff) 19:09:56 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r2, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r2}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:09:56 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r2, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r2}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:09:56 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) [ 2608.266734][ T26] kauditd_printk_skb: 1 callbacks suppressed [ 2608.266754][ T26] audit: type=1800 audit(1572894596.882:16376): pid=16794 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16897 res=0 [ 2608.377621][ T26] audit: type=1804 audit(1572894596.892:16377): pid=16794 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1913/file0" dev="sda1" ino=16897 res=1 19:09:57 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:09:57 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r2, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r2}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:09:57 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r2, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r2}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:09:57 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r1) ptrace$cont(0x9, r0, 0x0, 0x0) 19:09:57 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r1, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r1}}]}) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:09:57 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r2, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r2}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:09:59 executing program 0: 19:09:59 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) inotify_init1(0x800) sendfile(r0, r1, 0x0, 0x7fffffff) sendfile(0xffffffffffffffff, r0, 0x0, 0xffffffff) 19:09:59 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r1, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r1}}]}) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:09:59 executing program 2: 19:09:59 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r1, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r1}}]}) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2611.411841][ T26] audit: type=1800 audit(1572894600.042:16378): pid=16860 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17282 res=0 19:10:00 executing program 0: [ 2611.516394][ T26] audit: type=1804 audit(1572894600.042:16379): pid=16860 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1914/file0" dev="sda1" ino=17282 res=1 19:10:00 executing program 2: 19:10:00 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r1) ptrace$cont(0x9, r0, 0x0, 0x0) 19:10:00 executing program 2: 19:10:00 executing program 0: 19:10:00 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r1, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r1}}]}) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:00 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) inotify_init1(0x800) sendfile(r0, r1, 0x0, 0x7fffffff) sendfile(0xffffffffffffffff, r0, 0x0, 0xffffffff) [ 2612.363858][ T26] audit: type=1800 audit(1572894600.992:16380): pid=16881 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17250 res=0 [ 2612.446792][ T26] audit: type=1804 audit(1572894601.022:16381): pid=16881 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1915/file0" dev="sda1" ino=17250 res=1 19:10:01 executing program 0: 19:10:01 executing program 2: 19:10:01 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r2, 0x100000000) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:01 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r1, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r1}}]}) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:01 executing program 2: 19:10:01 executing program 0: 19:10:01 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r2, 0x100000000) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:03 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r1) ptrace$cont(0x9, r0, 0x0, 0x0) 19:10:03 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) inotify_init1(0x800) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, r0, 0x0, 0xffffffff) 19:10:03 executing program 2: 19:10:03 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r1, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r1}}]}) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:03 executing program 0: 19:10:03 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r2, 0x100000000) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2615.309191][ T26] audit: type=1800 audit(1572894603.932:16382): pid=16924 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17377 res=0 19:10:04 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) inotify_init1(0x800) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, r0, 0x0, 0xffffffff) 19:10:04 executing program 2: [ 2615.417504][ T26] audit: type=1804 audit(1572894603.932:16383): pid=16924 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1916/file0" dev="sda1" ino=17377 res=1 19:10:04 executing program 0: 19:10:04 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) inotify_init1(0x800) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, r0, 0x0, 0xffffffff) 19:10:04 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r1, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2615.625005][ T26] audit: type=1804 audit(1572894603.962:16384): pid=16924 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1916/file0" dev="sda1" ino=17377 res=1 19:10:04 executing program 2: [ 2615.785357][ T26] audit: type=1800 audit(1572894604.202:16385): pid=16941 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17129 res=0 [ 2615.901689][ T26] audit: type=1804 audit(1572894604.212:16386): pid=16941 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1917/file0" dev="sda1" ino=17129 res=1 [ 2615.984764][ T26] audit: type=1804 audit(1572894604.222:16387): pid=16941 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1917/file0" dev="sda1" ino=17129 res=1 [ 2616.089468][ T26] audit: type=1800 audit(1572894604.452:16388): pid=16949 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17361 res=0 [ 2616.110388][ T26] audit: type=1804 audit(1572894604.452:16389): pid=16949 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1918/file0" dev="sda1" ino=17361 res=1 [ 2616.206919][ T26] audit: type=1804 audit(1572894604.462:16390): pid=16949 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1918/file0" dev="sda1" ino=17361 res=1 19:10:07 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:10:07 executing program 0: 19:10:07 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:10:07 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r1, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:07 executing program 2: 19:10:07 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r2}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2618.530169][ T26] audit: type=1800 audit(1572894607.152:16391): pid=16967 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17133 res=0 19:10:07 executing program 2: 19:10:07 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x74, 0x8000000000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)}], 0x0, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) write(0xffffffffffffffff, &(0x7f0000000140), 0x0) syz_genetlink_get_family_id$ipvs(0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) add_key$keyring(&(0x7f0000000300)='keyring\x00', 0x0, 0x0, 0x0, 0x0) 19:10:07 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r1, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:07 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r2}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:07 executing program 2: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x74, 0x8000000000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write(0xffffffffffffffff, &(0x7f0000000280)="1c0000001a00", 0x6) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x4000, 0x0) write(r0, &(0x7f0000000600)="bb8f9f640903127a53527c6fbfe65d43b0e0586f2d40c7e7df58cac83420e83662d6e39bb6d5430622431454eedeeaee423d8f210bc3525fa7927c18d5fbc91ab13c2041136047d8da9375934d00f325499bfe7712208d387d41c31821c2a22d1325b556528e9b790b74053d1ed631c6ec8126d37c87216173138c00cef396868029af5b76bebac5e38b74d8bbc6ae66b6e202b6d505710377710ea7d43edf00e1a4c1c670bb4c263ce777da81abdd5ba5a5c82f67232f9b4d6f21b2e6afa8b38e4642b0daa2acbc0478d89b88e8b2094d4248855e5e81992e60be3afff0f3c3799350615489a901a659abdeca0c615a622ebf64175f990320e0356d4a11ed62eff72b709c23dd65942e8b534d7d775d370c1e435654a2634e6ee3649c4c3bcbe39e866f1eb9972af1a9cef42e701798a53dc92a242aadbac343e1765cf8ea5665e22deda69777e52b1e9e5d3edc022256939e1eee013448294911139d5b9c6241049fecdf9b31f4cdf6cff65d71b5071ef70e1798347c8846aa5b905e83050e3e606986ed3f603d18c5cdeb11cda1ce3abddea9376231af130e19fc7601ec1ab8cb5a7de9e2174547f18225b09a54fc8720dbb91eb69c1be88e601c3c9df4f2758f39a5151951b9c6dbb419ffd783a34c9fad10f201b8724d31865e2fc1fcf48db2be713053b43a0e3943c1e2b08e8a26e946c439d891db2a80b5ffa054bc8d0177d3214056250c61a537d2ec7630fb90395df2cd6aa9c5e573365db580520bdc3f1c6b2be992e1516a4b810a11935dc780699e461d9715f70c6d103ff49bf168f3cff4c0d0d6ba5671fcd2975450b0e1a3474139cb0f2d3476fcd87a8bccbeb2f5f8a821017b879aa5b9d1fafa9f4c429a74cd2da782114d97bf031746a817dd0293c4eddc3a9ecb5afe496f4971474ccd827449409f07cf94dda2e7dbe8520b5afff10a7e3b0b4289a167fc692635b5b7426d9e771b95860b09a3e752c867213c772e48ba30a78feecc7ff26e63e1749c62b52d377ac5cc52db830c965e04ccfcfb24ceacc69cfdc2094124dd27b2d68f699476a2562bab1de117ffc2b0702ee8b0b77f85fecec3a25b37ab7eb06232c9a73b4470f1727c82581d81942abf42d3ea37957927ad3dbd0ebe46678a9f4d25c47acaac83c14210a54b71fed40df017e2be27f01e3e6ea3ea381ca14efd202858e6535ad4f79a8cdf47e385b740a70c14e3651731a45cc0ca4a56f2e903cad0384efcc364caf67e09551d35c682ebc90a9286c4d274ba1b8ced742ede4e55a62db7ef9a96fde2add05b41599fd72a79ba280cc125cb266ef21b7eeafe3ee6aa78eef33fc66454549c3ec298cb683a55a32208cf6ce88b560166159d59e65f30540f62c5437652ea7f2a02f87ca242dd2250f58e75938a9a3ded51ae6598c2aba53287ff5cdaab17be7f4310f8e07e310d52778de79e1c2e4391b254be38910aa1cf6e1ca0e75d24be97d59f7025f16c6fbd549529b74e319c58f50438765ef0e3dc394eeb75dec41b3d80435b17520c97f5cd7ee692fb86d188fb0089fbf737dc1b96b9cc49be23a38a8cd92e5075f349993d7866369dd25eccbe1481477a05fee14e0edd1617921d7fcaa8fdc642e63b64388fa5b63442ff1466b1938d02546750b01ed9c980282ccbe10f204741249aed88c555ed6fdf7f68af9209807a71bbf4f31bef5a4223466da74ba8b034df529aef6ec6610a0d25973961e50e02af22d0ca8be1b9804a5918acbdb536e8f2f441ec9d640ed15133ee747440c86fc4526c9195954528673d25c8390170f3c19cb0b0c30b9e634c7ebae96946ae97c19eabca92226da925d22be37abbe0740938ea899ec42fd529a3b1063981e4c154219df5cf5af60a29b5a8ee530905725a14b28900eae937e705401ba8f632a7bca00d9724a992afdc9ed14aac71b8e3a7ee5ca095888feb195b4e083c3b611a1c2f8d092febe3b9f5f0df61e8d3c31a643c935b76bc1ad4265164e755484beb06610510bc51e8c6da8d71123bbe83a5e4128f41cf5c486d6a60496c300c406f990bee485cbdef794f2663ee66d2b18d8e55210c25c04b1a0c6d9c5f904e72806d2d4f5e5439bcdf146343cdffe4d0d70d42a9959cff9bd50c37cd478b0b0add16aae4dc839b46bca2ac7547144b6a422aed5e2db661bcb31a82bc0fc678e71a6cb090ef772860f3008b4152b5d281033be4a77b367baec3ab8ce7c83c601b11c8199bafcd15161a5454a6a982dbc3c2e3a5172b6a63e4904817075754eccbb0188c9cb2e5da9600f567485014887463b40f189b7ec3c5c0f36d502509e402c285765c78417ce6b3aab130ee79622dcd8ada842233e73a14554ee5e4995e32b3fe4075e247eb9bdeef64d1a7436c9b5782fb2f84f74e4c6e976289729c37b5bb8200a9480d181a6b11f5ec229b818134b8334967ae935ac1d81be4776fae4cb68b6fa330e93bd8de388b38455d569159bcd166df030a6dfedf28caf4608de7243f5df2c76f6680c301d819dc67d24d2f780432a931700a253b0a5b075195c6dbfd1fe17a1c11a3dffa872a07b877adc66d069fffb6d8326e1998c5a337c3d530250cae335ceffcf81dc438a47e73490d050a053813dbe6674e42c91ae94b4a88144f36adc1b08b4bcd6ddf4058c4e08d4dc83d5fbd843ee27eaf50b297c220350260d9abbeeb6deb921e50cae0ea590cfb6f00fb3c71520f565bb769705e2481ef27cf537d29f163c9fe3d39ed9fd18dc8b0c976cd302283e430807a9d751357f89092532d89fe280c69ad36e3541b5da9dea13fd19d0434c760fe295dfd9b9e63453c7853914c50b1b77ccd4b33c8b1f31fcb1aec040ffe2f9d728d8ea84297bac2e22230ebd1488c503b05b2e433cc37ce9fc123b7d3eb244b4549e9a841e73b664c8f6621ea5a4c9ff9c1da032255311f2c063a682baf4c97e7ba552bf71af4bd64f43872b846d15c65c487089be272cfa24a33f8c50930ea0bc4b089505fb8e9e688d35a978813c38add66548d7575727ded0e7e64a5ce897da6b940df4c3dddb8b4871d773f6ebf02058518c55c19aadb0f266caf18777ae68d2bfcfb2225961fcd10538ba664fd053a443320072707533ab761b9397bd0559126b84fe9196463ae50633017ea2d80940311d9c867102b1017f34af1965d8eb61be616a0d40656e2bbb750aee6f74f788c8acb2578e8686f5f8da6a19e979c152b7ee7c7f16902120588e2ff630144b5f929ffc593e946d9717c5968aa16c2d73d689fb5cce117acda3e23e5e0116de1cb6bddfa1a84cefb22c1e2c3753017696f27b9aec5d44f15411247643b84dd4410e784b4eb5b9c68fea671976f9b51c6526e2ddb40659611b0b3bcc7e249c77396fdb8c864ea9318f9de7fd3936fcbdc732c2f8b9556ec9afeb15d5e2df890351d66074d53dddc6e8dba8c91d733623ac95a49eb69c7de37ff2364ccddb01f6500750a012c2acf32a9f6bbd9e92d17ef858fbc34575db414ea42ad87a65b11ae5506469db256c421328f45aec73bdf18562447dc2840bbe9fc84dedd0fe6276fa174f21210d40193530ec7a70a9e60bfd6b00cba4d483be59950f16fa0dbd089b5fd0bb078badfcf42270cc62fe37be22b0d81f755263d74636fa466d2574ca62b58c649936d21e949de73ea45df3acade6609413f56fc218d6f11947bf1fd629d38d8acce90ee3c1a51117601ae126bec537e3e76ce7ecc53cfeefee8aaa104aa853a65aadf27bac9849ee0122793b11cd8e4f32fb07afa39e439cb738c30a6df958160aac15c26032a61aaf614b2e6601581fb0ab8d115e045005dee3df8ea42643cbcbb0b111130c42c94b7e874cfee50d5c2eb13b3a38c417fce9d740b7d43120431a7d44bc3934ee87b112401cbee3553837b6a0b4b3faaceb46eca4064301c8060870350e256ac9d5557f674536b9d9717a82fa211e7dfb52ca410d8a4f2f6b733c2a082f247538a6c40f56cf64204e62515db692f32733ff6f4b0787ef305d5e80881375467ae603ac3600e688c42f89a4fea4fdda09a8d59e19457c654a98c8129a8c65bae3310af2b170729e18400c915d0a2f4c4fc51747846630b95ec181228bda7ef48ad389815aa82de6c4a3b0746c28c01f9ec697ff17f095e1cf9d2fe78fdab9cbb1ca7aefc8af6a0cd98444735fad79e394a8f9c2fd358c3cde4ca6d57a620d0bb52dc6ff93f034b596f407c21511cc2c5ec8b0ede7f5c0acca61939ac7f2cad820c15133e69507eaa739e9a88936f4a74f0ad1574a1591f31f582a76157d89805cb3ba5e8d10509bf7a08e928653b4f05ba797a06765b74c8759fc34178624c08a2b99e59bcff5d33af2b0f9176b56c35f4da31c751a4c2fd88a1997cd9fc9bbf78220731d4c8cea23be1fd29c36b34d8458b7021ebcfafdc7e54096e517da3eb684298f742532d776164d9c9658e5faca0a3b08afca1bc27ed357884f49fe51bd0c38057f4288f1917e36e3865310b5eed140aef6150ae363293cf7467abd5e06cd7af5e2c49e7c5253a1155741e380bccb023a0faed93d9a64512d72436f1ef4ac0904a413e45164c23413bd57274a0a951c41a9a43aed094d4ea5c480ce64663cc9d36723179e2b19a48e9277a6591bbd888a06e0f2f142cd4495be4ba7274d69ba32a2788b935b2f18c5f336cb9de062829e2e0bb476efb36c3f53a766c14314f31637a464ac59d378ad7f51bef8d88715613653a427038e0d3e4dc3948bb1d70eb55c91c92f7510b1c0387253b458d2c90d17238f9eb239c680179a6c1e0759be367963e3b4d7395fd3911626582a094e6a8d0e746242f94267a4c57d5b2360ce3a6f7f3e3c10e124a54ed24d1585bc7b731cf731c94ee00ebf070b999b9bf28d76bfec9dcf12fcce2b9c4444c706ec6b943b5f39e9151a764ba1cd0cd6c1c7cdc3aa824cf17da705be27a18fbee41be39d6ae4dd4312f5f4bfee2c5bb21d941666f9d79b0f80c9b1bace84a05d2b0e3be1c3fd04d72b4b0124595c435813969d413960fddc858730a433383f3bc0472cb7683ea569e001f", 0xe00) sendfile(r0, r1, 0x0, 0x12000) 19:10:07 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:10:07 executing program 0: write$char_usb(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe2$9p(0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x94}], 0x100001c9, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='net/snmp\x00') preadv(r1, &(0x7f0000000480), 0x1000000000000300, 0x0) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uhid\x00', 0x802, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, 0x0, &(0x7f0000000600)) dup3(0xffffffffffffffff, r2, 0x40000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendto$packet(0xffffffffffffffff, &(0x7f0000000500), 0x0, 0x55, &(0x7f0000000640)={0x11, 0xf8, 0x0, 0x1, 0x7fff, 0x6, @broadcast}, 0x14) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendto$packet(0xffffffffffffffff, &(0x7f0000000500), 0x0, 0x0, &(0x7f0000000640)={0x11, 0xf8, 0x0, 0x1, 0x7fff, 0x6, @broadcast}, 0x14) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) 19:10:07 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r2}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:07 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) getpid() sendfile(r0, r1, 0x0, 0x7fffffff) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, r0, 0x0, 0xffffffff) 19:10:08 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:08 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x0, 0x1, &(0x7f0000000100)=[{&(0x7f0000000200)="800000003804000019000300e6010000fffffffffffffffd0200000001000600000000000000000080000000000000006d5ebe730200ffff53ef", 0x3a, 0x400}], 0x0, 0x0) 19:10:08 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000004840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) 19:10:08 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:08 executing program 2: write$char_usb(0xffffffffffffffff, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe2$9p(0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x94}], 0x100001c9, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000300)='net/snmp\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000300, 0x0) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uhid\x00', 0x802, 0x0) socket$netlink(0x10, 0x3, 0x0) dup3(0xffffffffffffffff, r1, 0x40000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendto$packet(0xffffffffffffffff, &(0x7f0000000500), 0x0, 0x55, &(0x7f0000000640)={0x11, 0xf8, 0x0, 0x1, 0x7fff, 0x6, @broadcast}, 0x14) dup(0xffffffffffffffff) 19:10:09 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) getpid() sendfile(r0, r1, 0x0, 0x7fffffff) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, r0, 0x0, 0xffffffff) 19:10:09 executing program 2: write$char_usb(0xffffffffffffffff, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe2$9p(0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x94}], 0x100001c9, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000300)='net/snmp\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000300, 0x0) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uhid\x00', 0x802, 0x0) socket$netlink(0x10, 0x3, 0x0) dup3(0xffffffffffffffff, r1, 0x40000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendto$packet(0xffffffffffffffff, &(0x7f0000000500), 0x0, 0x55, &(0x7f0000000640)={0x11, 0xf8, 0x0, 0x1, 0x7fff, 0x6, @broadcast}, 0x14) dup(0xffffffffffffffff) 19:10:09 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2620.913033][ T26] kauditd_printk_skb: 10 callbacks suppressed [ 2620.913050][ T26] audit: type=1800 audit(1572894609.542:16402): pid=17053 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16802 res=0 [ 2621.008354][ T26] audit: type=1804 audit(1572894609.542:16403): pid=17053 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1921/file0" dev="sda1" ino=16802 res=1 [ 2621.072392][ T26] audit: type=1804 audit(1572894609.612:16404): pid=17055 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1921/file0" dev="sda1" ino=16802 res=1 19:10:10 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:10:10 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000004840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) 19:10:10 executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000004840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) 19:10:10 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:10 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:10 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) getpid() sendfile(r0, r1, 0x0, 0x7fffffff) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, r0, 0x0, 0xffffffff) [ 2622.188347][ T26] audit: type=1800 audit(1572894610.812:16405): pid=17067 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16836 res=0 [ 2622.266066][ T26] audit: type=1804 audit(1572894610.842:16406): pid=17067 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1922/file0" dev="sda1" ino=16836 res=1 [ 2622.491999][ T26] audit: type=1804 audit(1572894610.892:16407): pid=17078 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1922/file0" dev="sda1" ino=16836 res=1 19:10:11 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:11 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:11 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:11 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:11 executing program 0: pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) write$P9_RVERSION(r1, &(0x7f0000000340)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e00"], 0x15) mmap$perf(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_CREATE_OPEN(r2, &(0x7f0000000400)={0xa0}, 0xa0) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='9p\x00', 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2]) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) 19:10:11 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x1600bd7f, &(0x7f0000000240)={0x0, {{0xa, 0x0, 0x0, @local}}}, 0x90) 19:10:14 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:10:14 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:14 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, r0, 0x0, 0xffffffff) 19:10:14 executing program 2: openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x0, 0x0) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000100)) r0 = syz_open_procfs(0x0, &(0x7f0000000200)='fd/4\x00\xa7$\xbf\x05l\xb8\t\xd0\x06\xae\b\x86$dV\x92M%\xfd)0m6Z\x05\xae\xa7\rM\bp\xa6Q\x871B\x973\xfe\x05\x12\xf3\xd496\xf9\x1aM6\xb2|\xc5\x05\xbc\xe71g\xe4<&\xd2\xd8g\xb6\xa2U\xae\x9a\x17F\xa5xi\xe8_\xa8R\x96d\x99\xf6_E\xd0\x8f<\xa840\xd6\x84\xd0\x17\xafP\'\xdc{\b\x94\x00Y+\x18N\\\xc9\x1f\a\xf9X\x125\xb9\xd6\xbf\x1a4V\x10\xa6Uq\xceN\xeb\xa8M\xb2?\xda\xfb\xb1\x9d\x94\x13O\xab\xde\xc0t\x8c\")\x05~\x0f\xb8\xf3\xf6d\xbe\xad\xee\"\xaa\x91\x05\xcb9A\x1a\x8d&\x9e\x81\xcf\x9eWvT\x8a\xbfl\x8a\x83%\xec\x94\xfd\x90\xeb\xb3\xa3\xa8\x90\x90\xdb\xc2X\xf48\xd1\x83Eu\xe5c\xd7\xb7qe\xab\xae\xef*\x9e\x95\xde\xa0\x894r[\\\xc4?\xb7\xcfo\xdb\xbeR\xc5\xbc\xb34\xbe}\xf7n/4}\xbc.t\x94\x1c%\xcb\x93\xea\"Aa(\xd6FX\xd8\b\xd1\x10N{\xe8\xbc)\xc8\x1e6\xff\x95\xa3\xf3\x84\xf4\xa5\xe8f\xc2@\x1f7h\xb3\xd6\xab\x9a\x03\x95>V\\\xc4%T\x94M\xc7`\x83\xa1\xa0\xc8gn\xe3\xfe\xef[\xb3\xbd\x18R\x1b=\xab\x97$\x03\xaa\x84C\x0eWD\xeea\xf5\xb9\x82\xea\xbd5:\"\xf6f/\xa1\x8f%8\xa8\x1e\xcf\xb6\xa7\xe1\x1b1\x94\xc1G\xf9\xfc\xc77\x1c\x00'/370) write$char_usb(r0, 0x0, 0x10) getpid() r1 = syz_open_procfs(0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000180), &(0x7f00000001c0)=0xc) write$FUSE_BMAP(r1, 0x0, 0x829c9d5c89c1d6df) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6(0xa, 0x3, 0x6) r3 = syz_open_procfs(0x0, &(0x7f0000000600)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') sendfile(r2, r3, 0x0, 0x4000000000dc) ioctl$KVM_SET_CPUID(r3, 0x4008ae8a, &(0x7f0000000580)=ANY=[@ANYBLOB="09000000000000000d00000804890000050000000000000001000000000000000800008000100000030000000002000008020000000000000100004002000000010000008b0000000300000000000600000000010000000000000d000000090000000000000005000000898cffff000000000100004006000000080000008ff5ffff5ac800000000000000000040070000001227ffff0300000000000000000000000a0000000180000042b6000000040000a7000000000000000100004001000000ff0f0000a00000000700000000000000"]) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000380)) r4 = perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext={0x7f, 0x20}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xc, 0x16, &(0x7f00000007c0)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d0301000000000095000000000000006926000000000000bf67000000000000570600000fff07006706000002000000070600000ee60000bf2500000000000063350000000000006507000002000000070700004c0000001f75000000000000bf54000000000000070400000400f9ffad320100000000008400000000000000050000000000000095000000000000006e8ad524a56601a5fc9a76d1fd2735636b3e7523984e4dc87ca658e5f2e9407e5c2501d119febf3a1b93db85604036882f47b1fb3f1403b816f511c8c56e56e40b00095505f85fc9f189084c7fddccf25036dd4f235f37e36fb120b826de04200bb9bd141e3a33f63b983f2b8a5fb2e102965734732a7cbfd93618127a445715067b89d6c34980858787142fd5a209bf98d36431447cf69b5333f9d9f8408733ed9997d24f76b74b58b2a2e00d275cfd363fe44ca98dcd2d51769a5448cf1d00"/383], &(0x7f0000000100)='GPL\x00'}, 0x48) socket$inet_tcp(0x2, 0x1, 0x0) socket(0x0, 0x1, 0xa) dup3(r4, 0xffffffffffffffff, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000240)=0x202, 0x4000000000dc) getsockopt$XDP_MMAP_OFFSETS(0xffffffffffffffff, 0x11b, 0x1, &(0x7f00000006c0), &(0x7f0000000140)=0x80) socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000140)='./file0\x00', 0x1fffc, 0x1, &(0x7f0000000040)=[{&(0x7f00000000c0)="dc2ac86d4b66732e66617400080441000500077008f80000d8c32d8cbe59628cf9d9ed7b2c5a659ca9c36c257ee7d1ff48", 0x31}], 0x0, 0x0) 19:10:14 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, @perf_bp={&(0x7f0000000180), 0x8}, 0x5004, 0xfffffffffffff24b, 0x0, 0x0, 0x800}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x4000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f00005ff000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, 0x0) fcntl$setsig(0xffffffffffffffff, 0xa, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) write$FUSE_DIRENT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) creat(0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40046602, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x16c, 0x244) socket$nl_generic(0x10, 0x3, 0x10) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(0xffffffffffffffff, 0xc080661a, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000540)={@in={{0x2, 0x3, @local}}, 0x0, 0x200000000000025, 0x2, "a77760f5a7645bc43c241d69912d030c43244947a79015f0fe57917cb62a939a7a939ebddfce7bbba4fec2d82818a17900"}, 0xd8) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) pipe(0x0) ioctl$sock_inet_SIOCSIFBRDADDR(0xffffffffffffffff, 0x891a, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x3, 0x0) r3 = memfd_create(&(0x7f0000000240)='.^\x00', 0x0) r4 = dup(r3) fcntl$dupfd(r2, 0x0, r4) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000240)={{{@in=@loopback, @in6=@initdev}}, {{@in=@local}, 0x0, @in6=@ipv4={[], [], @loopback}}}, &(0x7f0000000100)=0xffffffffffffffab) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) recvmsg(r0, &(0x7f0000000140)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000000)=[{&(0x7f0000002340)=""/4096, 0x4890}], 0x7, &(0x7f0000000200)=""/20, 0x148, 0x93de}, 0x0) r5 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) open_by_handle_at(r5, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, 0x0, 0x0) write$binfmt_elf64(r0, &(0x7f0000000500)=ANY=[], 0xffffffdf) 19:10:14 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2625.630516][ T26] audit: type=1800 audit(1572894614.252:16408): pid=17134 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17299 res=0 [ 2625.754400][ T26] audit: type=1804 audit(1572894614.262:16409): pid=17134 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1923/file0" dev="sda1" ino=17299 res=1 19:10:14 executing program 0: openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x0, 0x0) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000100)) r0 = syz_open_procfs(0x0, &(0x7f0000000200)='fd/4\x00\xa7$\xbf\x05l\xb8\t\xd0\x06\xae\b\x86$dV\x92M%\xfd)0m6Z\x05\xae\xa7\rM\bp\xa6Q\x871B\x973\xfe\x05\x12\xf3\xd496\xf9\x1aM6\xb2|\xc5\x05\xbc\xe71g\xe4<&\xd2\xd8g\xb6\xa2U\xae\x9a\x17F\xa5xi\xe8_\xa8R\x96d\x99\xf6_E\xd0\x8f<\xa840\xd6\x84\xd0\x17\xafP\'\xdc{\b\x94\x00Y+\x18N\\\xc9\x1f\a\xf9X\x125\xb9\xd6\xbf\x1a4V\x10\xa6Uq\xceN\xeb\xa8M\xb2?\xda\xfb\xb1\x9d\x94\x13O\xab\xde\xc0t\x8c\")\x05~\x0f\xb8\xf3\xf6d\xbe\xad\xee\"\xaa\x91\x05\xcb9A\x1a\x8d&\x9e\x81\xcf\x9eWvT\x8a\xbfl\x8a\x83%\xec\x94\xfd\x90\xeb\xb3\xa3\xa8\x90\x90\xdb\xc2X\xf48\xd1\x83Eu\xe5c\xd7\xb7qe\xab\xae\xef*\x9e\x95\xde\xa0\x894r[\\\xc4?\xb7\xcfo\xdb\xbeR\xc5\xbc\xb34\xbe}\xf7n/4}\xbc.t\x94\x1c%\xcb\x93\xea\"Aa(\xd6FX\xd8\b\xd1\x10N{\xe8\xbc)\xc8\x1e6\xff\x95\xa3\xf3\x84\xf4\xa5\xe8f\xc2@\x1f7h\xb3\xd6\xab\x9a\x03\x95>V\\\xc4%T\x94M\xc7`\x83\xa1\xa0\xc8gn\xe3\xfe\xef[\xb3\xbd\x18R\x1b=\xab\x97$\x03\xaa\x84C\x0eWD\xeea\xf5\xb9\x82\xea\xbd5:\"\xf6f/\xa1\x8f%8\xa8\x1e\xcf\xb6\xa7\xe1\x1b1\x94\xc1G\xf9\xfc\xc77\x1c\x00'/370) write$char_usb(r0, 0x0, 0x10) getpid() r1 = syz_open_procfs(0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000180), &(0x7f00000001c0)=0xc) write$FUSE_BMAP(r1, 0x0, 0x829c9d5c89c1d6df) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6(0xa, 0x3, 0x6) r3 = syz_open_procfs(0x0, &(0x7f0000000600)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') sendfile(r2, r3, 0x0, 0x4000000000dc) ioctl$KVM_SET_CPUID(r3, 0x4008ae8a, &(0x7f0000000580)=ANY=[@ANYBLOB="09000000000000000d00000804890000050000000000000001000000000000000800008000100000030000000002000008020000000000000100004002000000010000008b0000000300000000000600000000010000000000000d000000090000000000000005000000898cffff000000000100004006000000080000008ff5ffff5ac800000000000000000040070000001227ffff0300000000000000000000000a0000000180000042b6000000040000a7000000000000000100004001000000ff0f0000a00000000700000000000000"]) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000380)) r4 = perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext={0x7f, 0x20}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xc, 0x16, &(0x7f00000007c0)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d0301000000000095000000000000006926000000000000bf67000000000000570600000fff07006706000002000000070600000ee60000bf2500000000000063350000000000006507000002000000070700004c0000001f75000000000000bf54000000000000070400000400f9ffad320100000000008400000000000000050000000000000095000000000000006e8ad524a56601a5fc9a76d1fd2735636b3e7523984e4dc87ca658e5f2e9407e5c2501d119febf3a1b93db85604036882f47b1fb3f1403b816f511c8c56e56e40b00095505f85fc9f189084c7fddccf25036dd4f235f37e36fb120b826de04200bb9bd141e3a33f63b983f2b8a5fb2e102965734732a7cbfd93618127a445715067b89d6c34980858787142fd5a209bf98d36431447cf69b5333f9d9f8408733ed9997d24f76b74b58b2a2e00d275cfd363fe44ca98dcd2d51769a5448cf1d00"/383], &(0x7f0000000100)='GPL\x00'}, 0x48) socket$inet_tcp(0x2, 0x1, 0x0) socket(0x0, 0x1, 0xa) dup3(r4, 0xffffffffffffffff, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) r5 = socket$inet6(0xa, 0x3, 0x6) r6 = syz_open_procfs(0x0, &(0x7f0000000600)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') sendfile(r5, r6, &(0x7f0000000240)=0x202, 0x4000000000dc) getsockopt$XDP_MMAP_OFFSETS(r6, 0x11b, 0x1, &(0x7f00000006c0), &(0x7f0000000140)=0x80) socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000140)='./file0\x00', 0x1fffc, 0x1, &(0x7f0000000040)=[{&(0x7f00000000c0)="dc2ac86d4b66732e66617400080441000500077008f80000d8c32d8cbe59628cf9d9ed7b2c5a659ca9c36c257ee7d1ff48", 0x31}], 0x0, 0x0) [ 2626.008730][ T26] audit: type=1804 audit(1572894614.312:16410): pid=17141 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1923/file0" dev="sda1" ino=17299 res=1 19:10:15 executing program 2: openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x0, 0x0) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000100)) r0 = syz_open_procfs(0x0, &(0x7f0000000200)='fd/4\x00\xa7$\xbf\x05l\xb8\t\xd0\x06\xae\b\x86$dV\x92M%\xfd)0m6Z\x05\xae\xa7\rM\bp\xa6Q\x871B\x973\xfe\x05\x12\xf3\xd496\xf9\x1aM6\xb2|\xc5\x05\xbc\xe71g\xe4<&\xd2\xd8g\xb6\xa2U\xae\x9a\x17F\xa5xi\xe8_\xa8R\x96d\x99\xf6_E\xd0\x8f<\xa840\xd6\x84\xd0\x17\xafP\'\xdc{\b\x94\x00Y+\x18N\\\xc9\x1f\a\xf9X\x125\xb9\xd6\xbf\x1a4V\x10\xa6Uq\xceN\xeb\xa8M\xb2?\xda\xfb\xb1\x9d\x94\x13O\xab\xde\xc0t\x8c\")\x05~\x0f\xb8\xf3\xf6d\xbe\xad\xee\"\xaa\x91\x05\xcb9A\x1a\x8d&\x9e\x81\xcf\x9eWvT\x8a\xbfl\x8a\x83%\xec\x94\xfd\x90\xeb\xb3\xa3\xa8\x90\x90\xdb\xc2X\xf48\xd1\x83Eu\xe5c\xd7\xb7qe\xab\xae\xef*\x9e\x95\xde\xa0\x894r[\\\xc4?\xb7\xcfo\xdb\xbeR\xc5\xbc\xb34\xbe}\xf7n/4}\xbc.t\x94\x1c%\xcb\x93\xea\"Aa(\xd6FX\xd8\b\xd1\x10N{\xe8\xbc)\xc8\x1e6\xff\x95\xa3\xf3\x84\xf4\xa5\xe8f\xc2@\x1f7h\xb3\xd6\xab\x9a\x03\x95>V\\\xc4%T\x94M\xc7`\x83\xa1\xa0\xc8gn\xe3\xfe\xef[\xb3\xbd\x18R\x1b=\xab\x97$\x03\xaa\x84C\x0eWD\xeea\xf5\xb9\x82\xea\xbd5:\"\xf6f/\xa1\x8f%8\xa8\x1e\xcf\xb6\xa7\xe1\x1b1\x94\xc1G\xf9\xfc\xc77\x1c\x00'/370) write$char_usb(r0, 0x0, 0x10) getpid() r1 = syz_open_procfs(0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000180), &(0x7f00000001c0)=0xc) write$FUSE_BMAP(r1, 0x0, 0x829c9d5c89c1d6df) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6(0xa, 0x3, 0x6) r3 = syz_open_procfs(0x0, &(0x7f0000000600)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') sendfile(r2, r3, 0x0, 0x4000000000dc) ioctl$KVM_SET_CPUID(r3, 0x4008ae8a, &(0x7f0000000580)=ANY=[@ANYBLOB="09000000000000000d00000804890000050000000000000001000000000000000800008000100000030000000002000008020000000000000100004002000000010000008b0000000300000000000600000000010000000000000d000000090000000000000005000000898cffff000000000100004006000000080000008ff5ffff5ac800000000000000000040070000001227ffff0300000000000000000000000a0000000180000042b6000000040000a7000000000000000100004001000000ff0f0000a00000000700000000000000"]) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000380)) r4 = perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext={0x7f, 0x20}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xc, 0x16, &(0x7f00000007c0)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d0301000000000095000000000000006926000000000000bf67000000000000570600000fff07006706000002000000070600000ee60000bf2500000000000063350000000000006507000002000000070700004c0000001f75000000000000bf54000000000000070400000400f9ffad320100000000008400000000000000050000000000000095000000000000006e8ad524a56601a5fc9a76d1fd2735636b3e7523984e4dc87ca658e5f2e9407e5c2501d119febf3a1b93db85604036882f47b1fb3f1403b816f511c8c56e56e40b00095505f85fc9f189084c7fddccf25036dd4f235f37e36fb120b826de04200bb9bd141e3a33f63b983f2b8a5fb2e102965734732a7cbfd93618127a445715067b89d6c34980858787142fd5a209bf98d36431447cf69b5333f9d9f8408733ed9997d24f76b74b58b2a2e00d275cfd363fe44ca98dcd2d51769a5448cf1d00"/383], &(0x7f0000000100)='GPL\x00'}, 0x48) socket$inet_tcp(0x2, 0x1, 0x0) socket(0x0, 0x1, 0xa) dup3(r4, 0xffffffffffffffff, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000240)=0x202, 0x4000000000dc) getsockopt$XDP_MMAP_OFFSETS(0xffffffffffffffff, 0x11b, 0x1, &(0x7f00000006c0), &(0x7f0000000140)=0x80) socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000140)='./file0\x00', 0x1fffc, 0x1, &(0x7f0000000040)=[{&(0x7f00000000c0)="dc2ac86d4b66732e66617400080441000500077008f80000d8c32d8cbe59628cf9d9ed7b2c5a659ca9c36c257ee7d1ff48", 0x31}], 0x0, 0x0) 19:10:15 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, r0, 0x0, 0xffffffff) 19:10:15 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:15 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:15 executing program 0: openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x0, 0x0) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000100)) r0 = syz_open_procfs(0x0, &(0x7f0000000200)='fd/4\x00\xa7$\xbf\x05l\xb8\t\xd0\x06\xae\b\x86$dV\x92M%\xfd)0m6Z\x05\xae\xa7\rM\bp\xa6Q\x871B\x973\xfe\x05\x12\xf3\xd496\xf9\x1aM6\xb2|\xc5\x05\xbc\xe71g\xe4<&\xd2\xd8g\xb6\xa2U\xae\x9a\x17F\xa5xi\xe8_\xa8R\x96d\x99\xf6_E\xd0\x8f<\xa840\xd6\x84\xd0\x17\xafP\'\xdc{\b\x94\x00Y+\x18N\\\xc9\x1f\a\xf9X\x125\xb9\xd6\xbf\x1a4V\x10\xa6Uq\xceN\xeb\xa8M\xb2?\xda\xfb\xb1\x9d\x94\x13O\xab\xde\xc0t\x8c\")\x05~\x0f\xb8\xf3\xf6d\xbe\xad\xee\"\xaa\x91\x05\xcb9A\x1a\x8d&\x9e\x81\xcf\x9eWvT\x8a\xbfl\x8a\x83%\xec\x94\xfd\x90\xeb\xb3\xa3\xa8\x90\x90\xdb\xc2X\xf48\xd1\x83Eu\xe5c\xd7\xb7qe\xab\xae\xef*\x9e\x95\xde\xa0\x894r[\\\xc4?\xb7\xcfo\xdb\xbeR\xc5\xbc\xb34\xbe}\xf7n/4}\xbc.t\x94\x1c%\xcb\x93\xea\"Aa(\xd6FX\xd8\b\xd1\x10N{\xe8\xbc)\xc8\x1e6\xff\x95\xa3\xf3\x84\xf4\xa5\xe8f\xc2@\x1f7h\xb3\xd6\xab\x9a\x03\x95>V\\\xc4%T\x94M\xc7`\x83\xa1\xa0\xc8gn\xe3\xfe\xef[\xb3\xbd\x18R\x1b=\xab\x97$\x03\xaa\x84C\x0eWD\xeea\xf5\xb9\x82\xea\xbd5:\"\xf6f/\xa1\x8f%8\xa8\x1e\xcf\xb6\xa7\xe1\x1b1\x94\xc1G\xf9\xfc\xc77\x1c\x00'/370) write$char_usb(r0, 0x0, 0x10) getpid() r1 = syz_open_procfs(0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000180), &(0x7f00000001c0)=0xc) write$FUSE_BMAP(r1, 0x0, 0x829c9d5c89c1d6df) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6(0xa, 0x3, 0x6) r3 = syz_open_procfs(0x0, &(0x7f0000000600)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') sendfile(r2, r3, 0x0, 0x4000000000dc) ioctl$KVM_SET_CPUID(r3, 0x4008ae8a, &(0x7f0000000580)=ANY=[@ANYBLOB="09000000000000000d00000804890000050000000000000001000000000000000800008000100000030000000002000008020000000000000100004002000000010000008b0000000300000000000600000000010000000000000d000000090000000000000005000000898cffff000000000100004006000000080000008ff5ffff5ac800000000000000000040070000001227ffff0300000000000000000000000a0000000180000042b6000000040000a7000000000000000100004001000000ff0f0000a00000000700000000000000"]) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000380)) r4 = perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext={0x7f, 0x20}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xc, 0x16, &(0x7f00000007c0)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d0301000000000095000000000000006926000000000000bf67000000000000570600000fff07006706000002000000070600000ee60000bf2500000000000063350000000000006507000002000000070700004c0000001f75000000000000bf54000000000000070400000400f9ffad320100000000008400000000000000050000000000000095000000000000006e8ad524a56601a5fc9a76d1fd2735636b3e7523984e4dc87ca658e5f2e9407e5c2501d119febf3a1b93db85604036882f47b1fb3f1403b816f511c8c56e56e40b00095505f85fc9f189084c7fddccf25036dd4f235f37e36fb120b826de04200bb9bd141e3a33f63b983f2b8a5fb2e102965734732a7cbfd93618127a445715067b89d6c34980858787142fd5a209bf98d36431447cf69b5333f9d9f8408733ed9997d24f76b74b58b2a2e00d275cfd363fe44ca98dcd2d51769a5448cf1d00"/383], &(0x7f0000000100)='GPL\x00'}, 0x48) socket$inet_tcp(0x2, 0x1, 0x0) socket(0x0, 0x1, 0xa) dup3(r4, 0xffffffffffffffff, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) r5 = socket$inet6(0xa, 0x3, 0x6) r6 = syz_open_procfs(0x0, &(0x7f0000000600)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') sendfile(r5, r6, &(0x7f0000000240)=0x202, 0x4000000000dc) getsockopt$XDP_MMAP_OFFSETS(r6, 0x11b, 0x1, &(0x7f00000006c0), &(0x7f0000000140)=0x80) socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000140)='./file0\x00', 0x1fffc, 0x1, &(0x7f0000000040)=[{&(0x7f00000000c0)="dc2ac86d4b66732e66617400080441000500077008f80000d8c32d8cbe59628cf9d9ed7b2c5a659ca9c36c257ee7d1ff48", 0x31}], 0x0, 0x0) [ 2626.838127][ T26] audit: type=1800 audit(1572894615.462:16411): pid=17180 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17203 res=0 [ 2627.006734][ T26] audit: type=1804 audit(1572894615.462:16412): pid=17180 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1924/file0" dev="sda1" ino=17203 res=1 [ 2627.176766][ T26] audit: type=1804 audit(1572894615.532:16413): pid=17185 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1924/file0" dev="sda1" ino=17203 res=1 19:10:17 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:10:17 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:17 executing program 2: openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x0, 0x0) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000100)) r0 = syz_open_procfs(0x0, &(0x7f0000000200)='fd/4\x00\xa7$\xbf\x05l\xb8\t\xd0\x06\xae\b\x86$dV\x92M%\xfd)0m6Z\x05\xae\xa7\rM\bp\xa6Q\x871B\x973\xfe\x05\x12\xf3\xd496\xf9\x1aM6\xb2|\xc5\x05\xbc\xe71g\xe4<&\xd2\xd8g\xb6\xa2U\xae\x9a\x17F\xa5xi\xe8_\xa8R\x96d\x99\xf6_E\xd0\x8f<\xa840\xd6\x84\xd0\x17\xafP\'\xdc{\b\x94\x00Y+\x18N\\\xc9\x1f\a\xf9X\x125\xb9\xd6\xbf\x1a4V\x10\xa6Uq\xceN\xeb\xa8M\xb2?\xda\xfb\xb1\x9d\x94\x13O\xab\xde\xc0t\x8c\")\x05~\x0f\xb8\xf3\xf6d\xbe\xad\xee\"\xaa\x91\x05\xcb9A\x1a\x8d&\x9e\x81\xcf\x9eWvT\x8a\xbfl\x8a\x83%\xec\x94\xfd\x90\xeb\xb3\xa3\xa8\x90\x90\xdb\xc2X\xf48\xd1\x83Eu\xe5c\xd7\xb7qe\xab\xae\xef*\x9e\x95\xde\xa0\x894r[\\\xc4?\xb7\xcfo\xdb\xbeR\xc5\xbc\xb34\xbe}\xf7n/4}\xbc.t\x94\x1c%\xcb\x93\xea\"Aa(\xd6FX\xd8\b\xd1\x10N{\xe8\xbc)\xc8\x1e6\xff\x95\xa3\xf3\x84\xf4\xa5\xe8f\xc2@\x1f7h\xb3\xd6\xab\x9a\x03\x95>V\\\xc4%T\x94M\xc7`\x83\xa1\xa0\xc8gn\xe3\xfe\xef[\xb3\xbd\x18R\x1b=\xab\x97$\x03\xaa\x84C\x0eWD\xeea\xf5\xb9\x82\xea\xbd5:\"\xf6f/\xa1\x8f%8\xa8\x1e\xcf\xb6\xa7\xe1\x1b1\x94\xc1G\xf9\xfc\xc77\x1c\x00'/370) write$char_usb(r0, 0x0, 0x10) getpid() r1 = syz_open_procfs(0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000180), &(0x7f00000001c0)=0xc) write$FUSE_BMAP(r1, 0x0, 0x829c9d5c89c1d6df) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6(0xa, 0x3, 0x6) r3 = syz_open_procfs(0x0, &(0x7f0000000600)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') sendfile(r2, r3, 0x0, 0x4000000000dc) ioctl$KVM_SET_CPUID(r3, 0x4008ae8a, &(0x7f0000000580)=ANY=[@ANYBLOB="09000000000000000d00000804890000050000000000000001000000000000000800008000100000030000000002000008020000000000000100004002000000010000008b0000000300000000000600000000010000000000000d000000090000000000000005000000898cffff000000000100004006000000080000008ff5ffff5ac800000000000000000040070000001227ffff0300000000000000000000000a0000000180000042b6000000040000a7000000000000000100004001000000ff0f0000a00000000700000000000000"]) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000380)) r4 = perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext={0x7f, 0x20}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xc, 0x16, &(0x7f00000007c0)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d0301000000000095000000000000006926000000000000bf67000000000000570600000fff07006706000002000000070600000ee60000bf2500000000000063350000000000006507000002000000070700004c0000001f75000000000000bf54000000000000070400000400f9ffad320100000000008400000000000000050000000000000095000000000000006e8ad524a56601a5fc9a76d1fd2735636b3e7523984e4dc87ca658e5f2e9407e5c2501d119febf3a1b93db85604036882f47b1fb3f1403b816f511c8c56e56e40b00095505f85fc9f189084c7fddccf25036dd4f235f37e36fb120b826de04200bb9bd141e3a33f63b983f2b8a5fb2e102965734732a7cbfd93618127a445715067b89d6c34980858787142fd5a209bf98d36431447cf69b5333f9d9f8408733ed9997d24f76b74b58b2a2e00d275cfd363fe44ca98dcd2d51769a5448cf1d00"/383], &(0x7f0000000100)='GPL\x00'}, 0x48) socket$inet_tcp(0x2, 0x1, 0x0) socket(0x0, 0x1, 0xa) dup3(r4, 0xffffffffffffffff, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) r5 = socket$inet6(0xa, 0x3, 0x6) r6 = syz_open_procfs(0x0, &(0x7f0000000600)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') sendfile(r5, r6, &(0x7f0000000240)=0x202, 0x4000000000dc) getsockopt$XDP_MMAP_OFFSETS(r6, 0x11b, 0x1, &(0x7f00000006c0), &(0x7f0000000140)=0x80) socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000140)='./file0\x00', 0x1fffc, 0x1, &(0x7f0000000040)=[{&(0x7f00000000c0)="dc2ac86d4b66732e66617400080441000500077008f80000d8c32d8cbe59628cf9d9ed7b2c5a659ca9c36c257ee7d1ff48", 0x31}], 0x0, 0x0) 19:10:17 executing program 0: openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x0, 0x0) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000100)) r0 = syz_open_procfs(0x0, &(0x7f0000000200)='fd/4\x00\xa7$\xbf\x05l\xb8\t\xd0\x06\xae\b\x86$dV\x92M%\xfd)0m6Z\x05\xae\xa7\rM\bp\xa6Q\x871B\x973\xfe\x05\x12\xf3\xd496\xf9\x1aM6\xb2|\xc5\x05\xbc\xe71g\xe4<&\xd2\xd8g\xb6\xa2U\xae\x9a\x17F\xa5xi\xe8_\xa8R\x96d\x99\xf6_E\xd0\x8f<\xa840\xd6\x84\xd0\x17\xafP\'\xdc{\b\x94\x00Y+\x18N\\\xc9\x1f\a\xf9X\x125\xb9\xd6\xbf\x1a4V\x10\xa6Uq\xceN\xeb\xa8M\xb2?\xda\xfb\xb1\x9d\x94\x13O\xab\xde\xc0t\x8c\")\x05~\x0f\xb8\xf3\xf6d\xbe\xad\xee\"\xaa\x91\x05\xcb9A\x1a\x8d&\x9e\x81\xcf\x9eWvT\x8a\xbfl\x8a\x83%\xec\x94\xfd\x90\xeb\xb3\xa3\xa8\x90\x90\xdb\xc2X\xf48\xd1\x83Eu\xe5c\xd7\xb7qe\xab\xae\xef*\x9e\x95\xde\xa0\x894r[\\\xc4?\xb7\xcfo\xdb\xbeR\xc5\xbc\xb34\xbe}\xf7n/4}\xbc.t\x94\x1c%\xcb\x93\xea\"Aa(\xd6FX\xd8\b\xd1\x10N{\xe8\xbc)\xc8\x1e6\xff\x95\xa3\xf3\x84\xf4\xa5\xe8f\xc2@\x1f7h\xb3\xd6\xab\x9a\x03\x95>V\\\xc4%T\x94M\xc7`\x83\xa1\xa0\xc8gn\xe3\xfe\xef[\xb3\xbd\x18R\x1b=\xab\x97$\x03\xaa\x84C\x0eWD\xeea\xf5\xb9\x82\xea\xbd5:\"\xf6f/\xa1\x8f%8\xa8\x1e\xcf\xb6\xa7\xe1\x1b1\x94\xc1G\xf9\xfc\xc77\x1c\x00'/370) write$char_usb(r0, 0x0, 0x10) getpid() r1 = syz_open_procfs(0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000180), &(0x7f00000001c0)=0xc) write$FUSE_BMAP(r1, 0x0, 0x829c9d5c89c1d6df) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6(0xa, 0x3, 0x6) r3 = syz_open_procfs(0x0, &(0x7f0000000600)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') sendfile(r2, r3, 0x0, 0x4000000000dc) ioctl$KVM_SET_CPUID(r3, 0x4008ae8a, &(0x7f0000000580)=ANY=[@ANYBLOB="09000000000000000d00000804890000050000000000000001000000000000000800008000100000030000000002000008020000000000000100004002000000010000008b0000000300000000000600000000010000000000000d000000090000000000000005000000898cffff000000000100004006000000080000008ff5ffff5ac800000000000000000040070000001227ffff0300000000000000000000000a0000000180000042b6000000040000a7000000000000000100004001000000ff0f0000a00000000700000000000000"]) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000380)) r4 = perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext={0x7f, 0x20}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xc, 0x16, &(0x7f00000007c0)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d0301000000000095000000000000006926000000000000bf67000000000000570600000fff07006706000002000000070600000ee60000bf2500000000000063350000000000006507000002000000070700004c0000001f75000000000000bf54000000000000070400000400f9ffad320100000000008400000000000000050000000000000095000000000000006e8ad524a56601a5fc9a76d1fd2735636b3e7523984e4dc87ca658e5f2e9407e5c2501d119febf3a1b93db85604036882f47b1fb3f1403b816f511c8c56e56e40b00095505f85fc9f189084c7fddccf25036dd4f235f37e36fb120b826de04200bb9bd141e3a33f63b983f2b8a5fb2e102965734732a7cbfd93618127a445715067b89d6c34980858787142fd5a209bf98d36431447cf69b5333f9d9f8408733ed9997d24f76b74b58b2a2e00d275cfd363fe44ca98dcd2d51769a5448cf1d00"/383], &(0x7f0000000100)='GPL\x00'}, 0x48) socket$inet_tcp(0x2, 0x1, 0x0) socket(0x0, 0x1, 0xa) dup3(r4, 0xffffffffffffffff, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) r5 = socket$inet6(0xa, 0x3, 0x6) r6 = syz_open_procfs(0x0, &(0x7f0000000600)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') sendfile(r5, r6, &(0x7f0000000240)=0x202, 0x4000000000dc) getsockopt$XDP_MMAP_OFFSETS(r6, 0x11b, 0x1, &(0x7f00000006c0), &(0x7f0000000140)=0x80) socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000140)='./file0\x00', 0x1fffc, 0x1, &(0x7f0000000040)=[{&(0x7f00000000c0)="dc2ac86d4b66732e66617400080441000500077008f80000d8c32d8cbe59628cf9d9ed7b2c5a659ca9c36c257ee7d1ff48", 0x31}], 0x0, 0x0) 19:10:17 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:17 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, r0, 0x0, 0xffffffff) [ 2628.769280][ T26] audit: type=1800 audit(1572894617.392:16414): pid=17206 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17475 res=0 [ 2628.835765][ T26] audit: type=1804 audit(1572894617.422:16415): pid=17206 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1925/file0" dev="sda1" ino=17475 res=1 19:10:17 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2628.967925][ T26] audit: type=1804 audit(1572894617.492:16416): pid=17217 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1925/file0" dev="sda1" ino=17475 res=1 19:10:17 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:18 executing program 0: openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x0, 0x0) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000100)) r0 = syz_open_procfs(0x0, &(0x7f0000000200)='fd/4\x00\xa7$\xbf\x05l\xb8\t\xd0\x06\xae\b\x86$dV\x92M%\xfd)0m6Z\x05\xae\xa7\rM\bp\xa6Q\x871B\x973\xfe\x05\x12\xf3\xd496\xf9\x1aM6\xb2|\xc5\x05\xbc\xe71g\xe4<&\xd2\xd8g\xb6\xa2U\xae\x9a\x17F\xa5xi\xe8_\xa8R\x96d\x99\xf6_E\xd0\x8f<\xa840\xd6\x84\xd0\x17\xafP\'\xdc{\b\x94\x00Y+\x18N\\\xc9\x1f\a\xf9X\x125\xb9\xd6\xbf\x1a4V\x10\xa6Uq\xceN\xeb\xa8M\xb2?\xda\xfb\xb1\x9d\x94\x13O\xab\xde\xc0t\x8c\")\x05~\x0f\xb8\xf3\xf6d\xbe\xad\xee\"\xaa\x91\x05\xcb9A\x1a\x8d&\x9e\x81\xcf\x9eWvT\x8a\xbfl\x8a\x83%\xec\x94\xfd\x90\xeb\xb3\xa3\xa8\x90\x90\xdb\xc2X\xf48\xd1\x83Eu\xe5c\xd7\xb7qe\xab\xae\xef*\x9e\x95\xde\xa0\x894r[\\\xc4?\xb7\xcfo\xdb\xbeR\xc5\xbc\xb34\xbe}\xf7n/4}\xbc.t\x94\x1c%\xcb\x93\xea\"Aa(\xd6FX\xd8\b\xd1\x10N{\xe8\xbc)\xc8\x1e6\xff\x95\xa3\xf3\x84\xf4\xa5\xe8f\xc2@\x1f7h\xb3\xd6\xab\x9a\x03\x95>V\\\xc4%T\x94M\xc7`\x83\xa1\xa0\xc8gn\xe3\xfe\xef[\xb3\xbd\x18R\x1b=\xab\x97$\x03\xaa\x84C\x0eWD\xeea\xf5\xb9\x82\xea\xbd5:\"\xf6f/\xa1\x8f%8\xa8\x1e\xcf\xb6\xa7\xe1\x1b1\x94\xc1G\xf9\xfc\xc77\x1c\x00'/370) write$char_usb(r0, 0x0, 0x10) getpid() r1 = syz_open_procfs(0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000180), &(0x7f00000001c0)=0xc) write$FUSE_BMAP(r1, 0x0, 0x829c9d5c89c1d6df) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6(0xa, 0x3, 0x6) r3 = syz_open_procfs(0x0, &(0x7f0000000600)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') sendfile(r2, r3, 0x0, 0x4000000000dc) ioctl$KVM_SET_CPUID(r3, 0x4008ae8a, &(0x7f0000000580)=ANY=[@ANYBLOB="09000000000000000d00000804890000050000000000000001000000000000000800008000100000030000000002000008020000000000000100004002000000010000008b0000000300000000000600000000010000000000000d000000090000000000000005000000898cffff000000000100004006000000080000008ff5ffff5ac800000000000000000040070000001227ffff0300000000000000000000000a0000000180000042b6000000040000a7000000000000000100004001000000ff0f0000a00000000700000000000000"]) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000380)) r4 = perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext={0x7f, 0x20}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xc, 0x16, &(0x7f00000007c0)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d0301000000000095000000000000006926000000000000bf67000000000000570600000fff07006706000002000000070600000ee60000bf2500000000000063350000000000006507000002000000070700004c0000001f75000000000000bf54000000000000070400000400f9ffad320100000000008400000000000000050000000000000095000000000000006e8ad524a56601a5fc9a76d1fd2735636b3e7523984e4dc87ca658e5f2e9407e5c2501d119febf3a1b93db85604036882f47b1fb3f1403b816f511c8c56e56e40b00095505f85fc9f189084c7fddccf25036dd4f235f37e36fb120b826de04200bb9bd141e3a33f63b983f2b8a5fb2e102965734732a7cbfd93618127a445715067b89d6c34980858787142fd5a209bf98d36431447cf69b5333f9d9f8408733ed9997d24f76b74b58b2a2e00d275cfd363fe44ca98dcd2d51769a5448cf1d00"/383], &(0x7f0000000100)='GPL\x00'}, 0x48) socket$inet_tcp(0x2, 0x1, 0x0) socket(0x0, 0x1, 0xa) dup3(r4, 0xffffffffffffffff, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) r5 = socket$inet6(0xa, 0x3, 0x6) r6 = syz_open_procfs(0x0, &(0x7f0000000600)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') sendfile(r5, r6, &(0x7f0000000240)=0x202, 0x4000000000dc) getsockopt$XDP_MMAP_OFFSETS(r6, 0x11b, 0x1, &(0x7f00000006c0), &(0x7f0000000140)=0x80) socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000140)='./file0\x00', 0x1fffc, 0x1, &(0x7f0000000040)=[{&(0x7f00000000c0)="dc2ac86d4b66732e66617400080441000500077008f80000d8c32d8cbe59628cf9d9ed7b2c5a659ca9c36c257ee7d1ff48", 0x31}], 0x0, 0x0) 19:10:18 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:18 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:18 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = memfd_create(&(0x7f0000000040)='\x00\x00\x00\x00\x00\x00\x00\x00\x00l\x91@]y\x00\x00\x00\x00g\xb8\xda\xc1\x84=[\x1f\r\x06\x00\x00\x00\x00\x00\x00\x00|\x88O\xbaI\xa3*@\x9e\xca\x8b\xde\xefC\xfd \xde\x9ao\xd4\xc4\xac\xb7', 0x0) ftruncate(r1, 0x40000) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @loopback}, 0x10) sendfile(r0, r1, 0x0, 0xffe4) 19:10:20 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:10:20 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:10:20 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:20 executing program 2: 19:10:20 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:20 executing program 0: 19:10:20 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) [ 2632.006471][ T26] audit: type=1800 audit(1572894620.632:16417): pid=17280 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17745 res=0 19:10:20 executing program 0: 19:10:20 executing program 2: [ 2632.114512][ T26] audit: type=1804 audit(1572894620.632:16418): pid=17280 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1926/file0" dev="sda1" ino=17745 res=1 19:10:20 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2632.256658][ T26] audit: type=1804 audit(1572894620.662:16419): pid=17280 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1926/file0" dev="sda1" ino=17745 res=1 19:10:20 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) [ 2632.427566][ T26] audit: type=1800 audit(1572894620.872:16420): pid=17292 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17442 res=0 19:10:21 executing program 0: [ 2632.515461][ T26] audit: type=1804 audit(1572894620.872:16421): pid=17292 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1927/file0" dev="sda1" ino=17442 res=1 [ 2632.750542][ T26] audit: type=1804 audit(1572894620.912:16422): pid=17292 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1927/file0" dev="sda1" ino=17442 res=1 [ 2632.855045][ T26] audit: type=1800 audit(1572894621.172:16423): pid=17301 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16576 res=0 [ 2632.920551][ T26] audit: type=1804 audit(1572894621.172:16424): pid=17301 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1928/file0" dev="sda1" ino=16576 res=1 [ 2633.000547][ T26] audit: type=1804 audit(1572894621.202:16425): pid=17301 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1928/file0" dev="sda1" ino=16576 res=1 19:10:23 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:10:23 executing program 2: 19:10:23 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0x7fffffff) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, r0, 0x0, 0xffffffff) 19:10:23 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:23 executing program 0: 19:10:23 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2635.116010][ T26] audit: type=1800 audit(1572894623.742:16426): pid=17317 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17857 res=0 19:10:23 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0x7fffffff) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, r0, 0x0, 0xffffffff) 19:10:23 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:23 executing program 0: 19:10:23 executing program 2: 19:10:24 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0x7fffffff) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, r0, 0x0, 0xffffffff) 19:10:24 executing program 0: 19:10:26 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:10:26 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:26 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(0xffffffffffffffff, r0, 0x0, 0x7fffffff) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, 0xffffffffffffffff, 0x0, 0xffffffff) 19:10:26 executing program 2: 19:10:26 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:26 executing program 0: 19:10:26 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(0xffffffffffffffff, r0, 0x0, 0x7fffffff) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, 0xffffffffffffffff, 0x0, 0xffffffff) 19:10:27 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) clone(0x0, 0x0, 0x0, 0x0, 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) write$P9_RVERSION(r1, &(0x7f0000000340)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e00"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_CREATE_OPEN(r2, &(0x7f0000000400)={0xa0}, 0xa0) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='9p\x00', 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2]) r3 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) io_setup(0x20000000002, &(0x7f0000000240)) tee(0xffffffffffffffff, r4, 0x800, 0x0) read(r0, &(0x7f00000004c0)=""/229, 0xe5) getdents64(r3, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) 19:10:27 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKBSZSET(r0, 0x40041271, &(0x7f0000000040)) 19:10:27 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(0xffffffffffffffff, r0, 0x0, 0x7fffffff) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, 0xffffffffffffffff, 0x0, 0xffffffff) 19:10:27 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:10:27 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:10:27 executing program 0: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, r0, 0x0) write$binfmt_misc(r0, &(0x7f00000004c0)=ANY=[@ANYBLOB="c1"], 0x1) perf_event_open(&(0x7f0000000180)={0x6, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 2638.945168][ T26] kauditd_printk_skb: 2 callbacks suppressed [ 2638.945263][ T26] audit: type=1800 audit(1572894627.572:16429): pid=17387 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17882 res=0 19:10:27 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2639.014767][ T26] audit: type=1804 audit(1572894627.632:16430): pid=17388 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1935/file0" dev="sda1" ino=17882 res=1 19:10:27 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) clone(0x0, 0x0, 0x0, 0x0, 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) write$P9_RVERSION(r1, &(0x7f0000000340)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e00"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_CREATE_OPEN(r2, &(0x7f0000000400)={0xa0}, 0xa0) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='9p\x00', 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2]) r3 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) io_setup(0x20000000002, &(0x7f0000000240)) tee(0xffffffffffffffff, r4, 0x800, 0x0) read(r0, &(0x7f00000004c0)=""/229, 0xe5) getdents64(r3, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) [ 2639.160941][ T26] audit: type=1804 audit(1572894627.682:16431): pid=17388 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1935/file0" dev="sda1" ino=17882 res=1 19:10:27 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:28 executing program 0: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, r0, 0x0) write$binfmt_misc(r0, &(0x7f00000004c0)=ANY=[@ANYBLOB="c1"], 0x1) perf_event_open(&(0x7f0000000180)={0x6, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 19:10:28 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) clone(0x0, 0x0, 0x0, 0x0, 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) write$P9_RVERSION(r1, &(0x7f0000000340)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e00"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_CREATE_OPEN(r2, &(0x7f0000000400)={0xa0}, 0xa0) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='9p\x00', 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2]) r3 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) io_setup(0x20000000002, &(0x7f0000000240)) tee(0xffffffffffffffff, r4, 0x800, 0x0) read(r0, &(0x7f00000004c0)=""/229, 0xe5) getdents64(r3, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) 19:10:28 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:10:28 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$tipc2(0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003070000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d64050000000000650404000100000004040000f4067d03b7030000000000006a0a00fe18000000850000002b000000b70000000000000095000000000000000d7a28073a4102e4aeb54f36633e27c279341bf489fdb4c05e96e3046f04e77969be0634674d0942b66b249b3518598e7e290b39a6f2fc2a5e019bc6b45684f002cf57bf887e83fbb2215b8a34e601c4dca4c6970a469beb625b67fca0bb1ef6d3c6958da4bddac602e0048bbb8de874602f060000002af21b75fe26aa5e85ae281993bfa213923bb755c1f1abd196407b4c8fabe27ba5f005ff9787dfd6e7608eb638e6fc4e0bc6bd5ff35928a5b5fa723028eb6ddd35ea79b92beeb52265a4b04ba50fd46a504116fb8ed84c2be021a6c9da73f24ad7b965af8f522371c9a43c80ee6b397bea247e2d714010d43fe66bbf4f05fe410bd701d0350f8dde2a20a0aeffb9843947c3bced2e00463d9c039bfdd58709e898c7ebad73fc4852621ad19c854622f7c7d79ec3ab4494353ba2130be57f838b948cfcaebb10d22dceaa3b9382cc4a670000000000000087fff621e3072ec94f6c73018974f63b45c87a7fdfea50c5bd945120da2f090000000000000094bfaafd3169039961fab0cd13000010e713b0c36228233e886850bd5920b6196a15d61d355c65347857d4330a03837de840b8bcb9cc17cb8ce2f00c7de343477ff2d6620379797961d06afbfa5265054a430f3d9570bdd8dae14be4fe8c8761f8ddcd7ca3bc452935f9083ab91d1481059b3edcb43f608f641e4484c7751a2a2cbc5a9903392eed60629fb95500000000293efcf4df206af7c2fd785852"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r0, 0x18000000000002a0, 0xe, 0x0, &(0x7f00000006c0)="b9ff0300000d698cb89e40f02cea", 0x0, 0x400}, 0x28) [ 2640.084461][ T26] audit: type=1800 audit(1572894628.712:16432): pid=17418 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17882 res=0 [ 2640.122171][ T26] audit: type=1804 audit(1572894628.732:16433): pid=17418 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1936/file0" dev="sda1" ino=17882 res=1 19:10:28 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xc, 0x16, &(0x7f00000007c0)=ANY=[@ANYBLOB="61125000000000006113500000000000bf2000000000000007000000080000003d0301000000000095000000000000006926000000000000bf67000000000000570600000fff07006706000002000000070600000ee60000bf2500000000000063350000000000006507000002000000070700004c0000001f75000000000000bf54000000000000070400000400f9ffad320100000000008400000000000000050000000000000095000000000000006e8ad524a56601a5fc9a76d1fd2735636b3e7523984e4dc87ca658e5f2e9407e5c2501d119febf3a1b93db85604036882f47b1fb3f1403b816f511c8c56e56e40b00095505f85fc9f189084c7fddccf25036dd4f235f37e36fb120b826de04200bb9bd141e3a33f63b983f2b8a5fb2e102965734732a7cbfd93618127a445715067b89d6c34980858787142fd5a209bf98d36431447cf69b5333f9d9f8408733ed9997d24f76b74b58b2a2e00d275cfd363fe44ca98dcd2d51769a5448cf1d00"/383], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfe41}, 0x48) [ 2640.228651][ T26] audit: type=1804 audit(1572894628.782:16434): pid=17423 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1936/file0" dev="sda1" ino=17882 res=1 19:10:29 executing program 0: socketpair$unix(0x1, 0x1, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r0 = getpid() tkill(r0, 0x9) socket$inet6(0xa, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r4, @ANYBLOB="000000000000fff0280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\a'], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="740000002400070500"/20, @ANYRES32=r4, @ANYBLOB="00000000ffffffff0000000008000100736671004800020000000000000000000000000000000000000000000000000000000000000000000000000077000000000000000000000000000000000000000000000000000000000000f3"], 0x74}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="7c0000002c000107000000140000000000000000", @ANYRES32=r4, @ANYBLOB="000f00000000000003000000080001006270660050000200080004000000000004000500400002003c00010000000000020000200000000000000000000011000000000000000010000000000000001000"/100], 0x7c}}, 0x0) r6 = open(0x0, 0x101041, 0x51) ioctl$PERF_EVENT_IOC_PERIOD(r6, 0x40082404, 0x0) 19:10:30 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:10:30 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:30 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:30 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x3d, 0x0) write$binfmt_aout(r0, &(0x7f00000000c0)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ppoll(&(0x7f0000000540)=[{r2}], 0x1, 0x0, 0x0, 0x0) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, 0x0) 19:10:30 executing program 0: bind$inet6(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x10001) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000340)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c80, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(0xffffffffffffffff, 0x4c80, 0x0) ioctl$EXT4_IOC_PRECACHE_EXTENTS(0xffffffffffffffff, 0x6612) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000180)={'bond_slave_0\x00', &(0x7f0000000480)=ANY=[@ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000096093de17b168f7c"]}) pwrite64(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x0) sync_file_range(0xffffffffffffffff, 0x81, 0x0, 0x0) ioctl$TCSETXF(0xffffffffffffffff, 0x5434, &(0x7f0000000080)={0x0, 0xffffffff, [0x20, 0x0, 0x0, 0x4], 0xfffffffffffffff9}) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$TIOCGSERIAL(0xffffffffffffffff, 0x541e, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/33}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, 0x0) 19:10:30 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) [ 2641.937408][ T26] audit: type=1800 audit(1572894630.562:16435): pid=17448 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17983 res=0 [ 2642.078914][ T26] audit: type=1804 audit(1572894630.572:16436): pid=17448 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1937/file0" dev="sda1" ino=17983 res=1 19:10:30 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup2(r1, r0) [ 2642.276677][ T26] audit: type=1804 audit(1572894630.632:16437): pid=17455 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1937/file0" dev="sda1" ino=17983 res=1 19:10:31 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup2(r1, r0) 19:10:31 executing program 5: sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:10:31 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x3d, 0x0) write$binfmt_aout(r0, &(0x7f00000000c0)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ppoll(&(0x7f0000000540)=[{r2}], 0x1, 0x0, 0x0, 0x0) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, 0x0) 19:10:31 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:31 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup2(r1, r0) [ 2643.178984][ T26] audit: type=1800 audit(1572894631.802:16438): pid=17474 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16622 res=0 19:10:33 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:10:33 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:33 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup2(r1, r0) 19:10:33 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:33 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) r1 = fcntl$dupfd(r0, 0x80c, 0xffffffffffffffff) write$vhci(r1, &(0x7f0000000540)=ANY=[@ANYBLOB="03d62fba3a7695c419e84eecd91fdae4eb1894930100008000000000661881627771e4dc6fc5f2b4b71846260cc2ff133be480a6396192b8561f36410701e662196deede5b41c2e76966e9ea775f922cae98f45c491b60d0654346aa74f1d020d00eeb0b43867e9d78e2e26a23df39d8753d68d4f5ddacb48862441fdef999b0d7c49c487be55c82d7c5726a5070b219ddc73f204ae6877479f1e1392ec23a50f4e59ebc5e17d93a6dfc2a6e1c907695b9ba24a8043f2f56e347c77ae92b0242d422c949b5de379a4cd1ba6b89f68192733ceef354eb3f0db393f1c2cae5e78f927b9c2c"], 0xe4) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r1, 0xc08c5335, &(0x7f0000000100)={0x9, 0x1, 0x95, 'queue1\x00'}) r2 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) open_by_handle_at(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="08000001000000"], 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r2, 0xc08c5334, &(0x7f00000003c0)={0x1, 0x4, 0xb4, 'queue0\x00', 0xaff}) fcntl$dupfd(r2, 0x406, r0) syz_genetlink_get_family_id$devlink(&(0x7f0000000240)='devlink\x00') recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f00000002c0)=@ipx, 0x80, 0x0, 0x30d, 0x0, 0x295}}], 0x1, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/3\x00') preadv(r3, &(0x7f00000017c0), 0x244, 0x0) 19:10:33 executing program 5: sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) [ 2644.977711][ T26] kauditd_printk_skb: 2 callbacks suppressed [ 2644.977728][ T26] audit: type=1800 audit(1572894633.602:16441): pid=17497 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17901 res=0 [ 2645.080768][ T26] audit: type=1804 audit(1572894633.622:16442): pid=17497 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1939/file0" dev="sda1" ino=17901 res=1 19:10:33 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:33 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r2) dup2(r1, r0) 19:10:33 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) [ 2645.182879][ T26] audit: type=1804 audit(1572894633.682:16443): pid=17507 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1939/file0" dev="sda1" ino=17901 res=1 19:10:33 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:34 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) r1 = fcntl$dupfd(r0, 0x80c, 0xffffffffffffffff) write$vhci(r1, &(0x7f0000000540)=ANY=[@ANYBLOB="03d62fba3a7695c419e84eecd91fdae4eb1894930100008000000000661881627771e4dc6fc5f2b4b71846260cc2ff133be480a6396192b8561f36410701e662196deede5b41c2e76966e9ea775f922cae98f45c491b60d0654346aa74f1d020d00eeb0b43867e9d78e2e26a23df39d8753d68d4f5ddacb48862441fdef999b0d7c49c487be55c82d7c5726a5070b219ddc73f204ae6877479f1e1392ec23a50f4e59ebc5e17d93a6dfc2a6e1c907695b9ba24a8043f2f56e347c77ae92b0242d422c949b5de379a4cd1ba6b89f68192733ceef354eb3f0db393f1c2cae5e78f927b9c2c"], 0xe4) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r1, 0xc08c5335, &(0x7f0000000100)={0x9, 0x1, 0x95, 'queue1\x00'}) r2 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) open_by_handle_at(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="08000001000000"], 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r2, 0xc08c5334, &(0x7f00000003c0)={0x1, 0x4, 0xb4, 'queue0\x00', 0xaff}) fcntl$dupfd(r2, 0x406, r0) syz_genetlink_get_family_id$devlink(&(0x7f0000000240)='devlink\x00') recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f00000002c0)=@ipx, 0x80, 0x0, 0x30d, 0x0, 0x295}}], 0x1, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/3\x00') preadv(r3, &(0x7f00000017c0), 0x244, 0x0) 19:10:34 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:34 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r2) dup2(r1, r0) 19:10:34 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:34 executing program 5: sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:10:34 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r2) dup2(r1, r0) 19:10:34 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) r1 = fcntl$dupfd(r0, 0x80c, 0xffffffffffffffff) write$vhci(r1, &(0x7f0000000540)=ANY=[@ANYBLOB="03d62fba3a7695c419e84eecd91fdae4eb1894930100008000000000661881627771e4dc6fc5f2b4b71846260cc2ff133be480a6396192b8561f36410701e662196deede5b41c2e76966e9ea775f922cae98f45c491b60d0654346aa74f1d020d00eeb0b43867e9d78e2e26a23df39d8753d68d4f5ddacb48862441fdef999b0d7c49c487be55c82d7c5726a5070b219ddc73f204ae6877479f1e1392ec23a50f4e59ebc5e17d93a6dfc2a6e1c907695b9ba24a8043f2f56e347c77ae92b0242d422c949b5de379a4cd1ba6b89f68192733ceef354eb3f0db393f1c2cae5e78f927b9c2c"], 0xe4) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r1, 0xc08c5335, &(0x7f0000000100)={0x9, 0x1, 0x95, 'queue1\x00'}) r2 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) open_by_handle_at(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="08000001000000"], 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r2, 0xc08c5334, &(0x7f00000003c0)={0x1, 0x4, 0xb4, 'queue0\x00', 0xaff}) fcntl$dupfd(r2, 0x406, r0) syz_genetlink_get_family_id$devlink(&(0x7f0000000240)='devlink\x00') recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f00000002c0)=@ipx, 0x80, 0x0, 0x30d, 0x0, 0x295}}], 0x1, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/3\x00') preadv(r3, &(0x7f00000017c0), 0x244, 0x0) 19:10:34 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2646.103294][ T26] audit: type=1800 audit(1572894634.732:16444): pid=17552 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16618 res=0 19:10:34 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2646.218823][ T26] audit: type=1804 audit(1572894634.732:16445): pid=17552 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1940/file0" dev="sda1" ino=16618 res=1 [ 2646.329674][ T26] audit: type=1804 audit(1572894634.812:16446): pid=17558 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1940/file0" dev="sda1" ino=16618 res=1 19:10:35 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r1, r0) [ 2646.435798][T17569] cgroup: fork rejected by pids controller in /syz3 19:10:37 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:10:37 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:37 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) r1 = fcntl$dupfd(r0, 0x80c, 0xffffffffffffffff) write$vhci(r1, &(0x7f0000000540)=ANY=[@ANYBLOB="03d62fba3a7695c419e84eecd91fdae4eb1894930100008000000000661881627771e4dc6fc5f2b4b71846260cc2ff133be480a6396192b8561f36410701e662196deede5b41c2e76966e9ea775f922cae98f45c491b60d0654346aa74f1d020d00eeb0b43867e9d78e2e26a23df39d8753d68d4f5ddacb48862441fdef999b0d7c49c487be55c82d7c5726a5070b219ddc73f204ae6877479f1e1392ec23a50f4e59ebc5e17d93a6dfc2a6e1c907695b9ba24a8043f2f56e347c77ae92b0242d422c949b5de379a4cd1ba6b89f68192733ceef354eb3f0db393f1c2cae5e78f927b9c2c"], 0xe4) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r1, 0xc08c5335, &(0x7f0000000100)={0x9, 0x1, 0x95, 'queue1\x00'}) r2 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) open_by_handle_at(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="08000001000000"], 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r2, 0xc08c5334, &(0x7f00000003c0)={0x1, 0x4, 0xb4, 'queue0\x00', 0xaff}) fcntl$dupfd(r2, 0x406, r0) syz_genetlink_get_family_id$devlink(&(0x7f0000000240)='devlink\x00') recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f00000002c0)=@ipx, 0x80, 0x0, 0x30d, 0x0, 0x295}}], 0x1, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/3\x00') preadv(r3, &(0x7f00000017c0), 0x244, 0x0) 19:10:37 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r1, r0) 19:10:37 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:37 executing program 5: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) [ 2648.424412][ T26] audit: type=1800 audit(1572894637.052:16447): pid=17687 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17224 res=0 [ 2648.488067][ T26] audit: type=1804 audit(1572894637.072:16448): pid=17687 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1941/file0" dev="sda1" ino=17224 res=1 19:10:37 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r1, r0) 19:10:37 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2648.665093][ T26] audit: type=1804 audit(1572894637.172:16449): pid=17696 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1941/file0" dev="sda1" ino=17224 res=1 19:10:37 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:37 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) r1 = fcntl$dupfd(r0, 0x80c, 0xffffffffffffffff) write$vhci(r1, &(0x7f0000000540)=ANY=[@ANYBLOB="03d62fba3a7695c419e84eecd91fdae4eb1894930100008000000000661881627771e4dc6fc5f2b4b71846260cc2ff133be480a6396192b8561f36410701e662196deede5b41c2e76966e9ea775f922cae98f45c491b60d0654346aa74f1d020d00eeb0b43867e9d78e2e26a23df39d8753d68d4f5ddacb48862441fdef999b0d7c49c487be55c82d7c5726a5070b219ddc73f204ae6877479f1e1392ec23a50f4e59ebc5e17d93a6dfc2a6e1c907695b9ba24a8043f2f56e347c77ae92b0242d422c949b5de379a4cd1ba6b89f68192733ceef354eb3f0db393f1c2cae5e78f927b9c2c"], 0xe4) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r1, 0xc08c5335, &(0x7f0000000100)={0x9, 0x1, 0x95, 'queue1\x00'}) r2 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) open_by_handle_at(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="08000001000000"], 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r2, 0xc08c5334, &(0x7f00000003c0)={0x1, 0x4, 0xb4, 'queue0\x00', 0xaff}) fcntl$dupfd(r2, 0x406, r0) syz_genetlink_get_family_id$devlink(&(0x7f0000000240)='devlink\x00') recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f00000002c0)=@ipx, 0x80, 0x0, 0x30d, 0x0, 0x295}}], 0x1, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/3\x00') 19:10:37 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup2(r1, r0) 19:10:37 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:40 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:10:40 executing program 5: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:10:40 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) r1 = fcntl$dupfd(r0, 0x80c, 0xffffffffffffffff) write$vhci(r1, &(0x7f0000000540)=ANY=[@ANYBLOB="03d62fba3a7695c419e84eecd91fdae4eb1894930100008000000000661881627771e4dc6fc5f2b4b71846260cc2ff133be480a6396192b8561f36410701e662196deede5b41c2e76966e9ea775f922cae98f45c491b60d0654346aa74f1d020d00eeb0b43867e9d78e2e26a23df39d8753d68d4f5ddacb48862441fdef999b0d7c49c487be55c82d7c5726a5070b219ddc73f204ae6877479f1e1392ec23a50f4e59ebc5e17d93a6dfc2a6e1c907695b9ba24a8043f2f56e347c77ae92b0242d422c949b5de379a4cd1ba6b89f68192733ceef354eb3f0db393f1c2cae5e78f927b9c2c"], 0xe4) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r1, 0xc08c5335, &(0x7f0000000100)={0x9, 0x1, 0x95, 'queue1\x00'}) r2 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) open_by_handle_at(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="08000001000000"], 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r2, 0xc08c5334, &(0x7f00000003c0)={0x1, 0x4, 0xb4, 'queue0\x00', 0xaff}) fcntl$dupfd(r2, 0x406, r0) syz_genetlink_get_family_id$devlink(&(0x7f0000000240)='devlink\x00') recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f00000002c0)=@ipx, 0x80, 0x0, 0x30d, 0x0, 0x295}}], 0x1, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 19:10:40 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup2(r1, r0) 19:10:40 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:40 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2651.624292][ T26] audit: type=1800 audit(1572894640.252:16450): pid=17739 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16850 res=0 19:10:40 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) r1 = fcntl$dupfd(r0, 0x80c, 0xffffffffffffffff) write$vhci(r1, &(0x7f0000000540)=ANY=[@ANYBLOB="03d62fba3a7695c419e84eecd91fdae4eb1894930100008000000000661881627771e4dc6fc5f2b4b71846260cc2ff133be480a6396192b8561f36410701e662196deede5b41c2e76966e9ea775f922cae98f45c491b60d0654346aa74f1d020d00eeb0b43867e9d78e2e26a23df39d8753d68d4f5ddacb48862441fdef999b0d7c49c487be55c82d7c5726a5070b219ddc73f204ae6877479f1e1392ec23a50f4e59ebc5e17d93a6dfc2a6e1c907695b9ba24a8043f2f56e347c77ae92b0242d422c949b5de379a4cd1ba6b89f68192733ceef354eb3f0db393f1c2cae5e78f927b9c2c"], 0xe4) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r1, 0xc08c5335, &(0x7f0000000100)={0x9, 0x1, 0x95, 'queue1\x00'}) r2 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) open_by_handle_at(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="08000001000000"], 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r2, 0xc08c5334, &(0x7f00000003c0)={0x1, 0x4, 0xb4, 'queue0\x00', 0xaff}) fcntl$dupfd(r2, 0x406, r0) syz_genetlink_get_family_id$devlink(&(0x7f0000000240)='devlink\x00') recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f00000002c0)=@ipx, 0x80, 0x0, 0x30d, 0x0, 0x295}}], 0x1, 0x0, 0x0) [ 2651.708163][ T26] audit: type=1804 audit(1572894640.292:16451): pid=17739 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1942/file0" dev="sda1" ino=16850 res=1 19:10:40 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup2(r1, r0) 19:10:40 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:40 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) [ 2651.852945][ T26] audit: type=1804 audit(1572894640.372:16452): pid=17746 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1942/file0" dev="sda1" ino=16850 res=1 19:10:40 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) r1 = fcntl$dupfd(r0, 0x80c, 0xffffffffffffffff) write$vhci(r1, &(0x7f0000000540)=ANY=[@ANYBLOB="03d62fba3a7695c419e84eecd91fdae4eb1894930100008000000000661881627771e4dc6fc5f2b4b71846260cc2ff133be480a6396192b8561f36410701e662196deede5b41c2e76966e9ea775f922cae98f45c491b60d0654346aa74f1d020d00eeb0b43867e9d78e2e26a23df39d8753d68d4f5ddacb48862441fdef999b0d7c49c487be55c82d7c5726a5070b219ddc73f204ae6877479f1e1392ec23a50f4e59ebc5e17d93a6dfc2a6e1c907695b9ba24a8043f2f56e347c77ae92b0242d422c949b5de379a4cd1ba6b89f68192733ceef354eb3f0db393f1c2cae5e78f927b9c2c"], 0xe4) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r1, 0xc08c5335, &(0x7f0000000100)={0x9, 0x1, 0x95, 'queue1\x00'}) r2 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) open_by_handle_at(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="08000001000000"], 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r2, 0xc08c5334, &(0x7f00000003c0)={0x1, 0x4, 0xb4, 'queue0\x00', 0xaff}) fcntl$dupfd(r2, 0x406, r0) syz_genetlink_get_family_id$devlink(&(0x7f0000000240)='devlink\x00') 19:10:40 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup2(0xffffffffffffffff, r0) 19:10:41 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:41 executing program 5: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:10:41 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:41 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup2(0xffffffffffffffff, r0) 19:10:41 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) r1 = fcntl$dupfd(r0, 0x80c, 0xffffffffffffffff) write$vhci(r1, &(0x7f0000000540)=ANY=[@ANYBLOB="03d62fba3a7695c419e84eecd91fdae4eb1894930100008000000000661881627771e4dc6fc5f2b4b71846260cc2ff133be480a6396192b8561f36410701e662196deede5b41c2e76966e9ea775f922cae98f45c491b60d0654346aa74f1d020d00eeb0b43867e9d78e2e26a23df39d8753d68d4f5ddacb48862441fdef999b0d7c49c487be55c82d7c5726a5070b219ddc73f204ae6877479f1e1392ec23a50f4e59ebc5e17d93a6dfc2a6e1c907695b9ba24a8043f2f56e347c77ae92b0242d422c949b5de379a4cd1ba6b89f68192733ceef354eb3f0db393f1c2cae5e78f927b9c2c"], 0xe4) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r1, 0xc08c5335, &(0x7f0000000100)={0x9, 0x1, 0x95, 'queue1\x00'}) r2 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) open_by_handle_at(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="08000001000000"], 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r2, 0xc08c5334, &(0x7f00000003c0)={0x1, 0x4, 0xb4, 'queue0\x00', 0xaff}) fcntl$dupfd(r2, 0x406, r0) 19:10:41 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) r1 = fcntl$dupfd(r0, 0x80c, 0xffffffffffffffff) write$vhci(r1, &(0x7f0000000540)=ANY=[@ANYBLOB="03d62fba3a7695c419e84eecd91fdae4eb1894930100008000000000661881627771e4dc6fc5f2b4b71846260cc2ff133be480a6396192b8561f36410701e662196deede5b41c2e76966e9ea775f922cae98f45c491b60d0654346aa74f1d020d00eeb0b43867e9d78e2e26a23df39d8753d68d4f5ddacb48862441fdef999b0d7c49c487be55c82d7c5726a5070b219ddc73f204ae6877479f1e1392ec23a50f4e59ebc5e17d93a6dfc2a6e1c907695b9ba24a8043f2f56e347c77ae92b0242d422c949b5de379a4cd1ba6b89f68192733ceef354eb3f0db393f1c2cae5e78f927b9c2c"], 0xe4) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r1, 0xc08c5335, &(0x7f0000000100)={0x9, 0x1, 0x95, 'queue1\x00'}) r2 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) open_by_handle_at(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="08000001000000"], 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r2, 0xc08c5334, &(0x7f00000003c0)={0x1, 0x4, 0xb4, 'queue0\x00', 0xaff}) [ 2652.732181][ T26] audit: type=1800 audit(1572894641.362:16453): pid=17784 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16886 res=0 19:10:41 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup2(0xffffffffffffffff, r0) [ 2652.865033][ T26] audit: type=1804 audit(1572894641.402:16454): pid=17784 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1943/file0" dev="sda1" ino=16886 res=1 19:10:41 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:41 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2652.944562][ T26] audit: type=1804 audit(1572894641.472:16455): pid=17790 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1943/file0" dev="sda1" ino=16886 res=1 [ 2653.140020][T17802] fuse: Bad value for 'fd' 19:10:43 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:10:43 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) r1 = fcntl$dupfd(r0, 0x80c, 0xffffffffffffffff) write$vhci(r1, &(0x7f0000000540)=ANY=[@ANYBLOB="03d62fba3a7695c419e84eecd91fdae4eb1894930100008000000000661881627771e4dc6fc5f2b4b71846260cc2ff133be480a6396192b8561f36410701e662196deede5b41c2e76966e9ea775f922cae98f45c491b60d0654346aa74f1d020d00eeb0b43867e9d78e2e26a23df39d8753d68d4f5ddacb48862441fdef999b0d7c49c487be55c82d7c5726a5070b219ddc73f204ae6877479f1e1392ec23a50f4e59ebc5e17d93a6dfc2a6e1c907695b9ba24a8043f2f56e347c77ae92b0242d422c949b5de379a4cd1ba6b89f68192733ceef354eb3f0db393f1c2cae5e78f927b9c2c"], 0xe4) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r1, 0xc08c5335, &(0x7f0000000100)={0x9, 0x1, 0x95, 'queue1\x00'}) r2 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) open_by_handle_at(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="08000001000000"], 0x0) 19:10:43 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup2(r0, 0xffffffffffffffff) 19:10:43 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:43 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:43 executing program 5: prlimit64(0x0, 0xe, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) [ 2655.083551][ T26] audit: type=1800 audit(1572894643.712:16456): pid=17813 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16915 res=0 [ 2655.149888][ T26] audit: type=1804 audit(1572894643.742:16457): pid=17813 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1944/file0" dev="sda1" ino=16915 res=1 19:10:43 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) r1 = fcntl$dupfd(r0, 0x80c, 0xffffffffffffffff) write$vhci(r1, &(0x7f0000000540)=ANY=[@ANYBLOB="03d62fba3a7695c419e84eecd91fdae4eb1894930100008000000000661881627771e4dc6fc5f2b4b71846260cc2ff133be480a6396192b8561f36410701e662196deede5b41c2e76966e9ea775f922cae98f45c491b60d0654346aa74f1d020d00eeb0b43867e9d78e2e26a23df39d8753d68d4f5ddacb48862441fdef999b0d7c49c487be55c82d7c5726a5070b219ddc73f204ae6877479f1e1392ec23a50f4e59ebc5e17d93a6dfc2a6e1c907695b9ba24a8043f2f56e347c77ae92b0242d422c949b5de379a4cd1ba6b89f68192733ceef354eb3f0db393f1c2cae5e78f927b9c2c"], 0xe4) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r1, 0xc08c5335, &(0x7f0000000100)={0x9, 0x1, 0x95, 'queue1\x00'}) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 19:10:43 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup2(r0, 0xffffffffffffffff) [ 2655.186684][ T26] audit: type=1804 audit(1572894643.792:16458): pid=17825 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1944/file0" dev="sda1" ino=16915 res=1 19:10:44 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:44 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) r1 = fcntl$dupfd(r0, 0x80c, 0xffffffffffffffff) write$vhci(r1, &(0x7f0000000540)=ANY=[@ANYBLOB="03d62fba3a7695c419e84eecd91fdae4eb1894930100008000000000661881627771e4dc6fc5f2b4b71846260cc2ff133be480a6396192b8561f36410701e662196deede5b41c2e76966e9ea775f922cae98f45c491b60d0654346aa74f1d020d00eeb0b43867e9d78e2e26a23df39d8753d68d4f5ddacb48862441fdef999b0d7c49c487be55c82d7c5726a5070b219ddc73f204ae6877479f1e1392ec23a50f4e59ebc5e17d93a6dfc2a6e1c907695b9ba24a8043f2f56e347c77ae92b0242d422c949b5de379a4cd1ba6b89f68192733ceef354eb3f0db393f1c2cae5e78f927b9c2c"], 0xe4) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r1, 0xc08c5335, &(0x7f0000000100)={0x9, 0x1, 0x95, 'queue1\x00'}) 19:10:44 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup2(r0, 0xffffffffffffffff) 19:10:44 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) r1 = fcntl$dupfd(r0, 0x80c, 0xffffffffffffffff) write$vhci(r1, &(0x7f0000000540)=ANY=[@ANYBLOB="03d62fba3a7695c419e84eecd91fdae4eb1894930100008000000000661881627771e4dc6fc5f2b4b71846260cc2ff133be480a6396192b8561f36410701e662196deede5b41c2e76966e9ea775f922cae98f45c491b60d0654346aa74f1d020d00eeb0b43867e9d78e2e26a23df39d8753d68d4f5ddacb48862441fdef999b0d7c49c487be55c82d7c5726a5070b219ddc73f204ae6877479f1e1392ec23a50f4e59ebc5e17d93a6dfc2a6e1c907695b9ba24a8043f2f56e347c77ae92b0242d422c949b5de379a4cd1ba6b89f68192733ceef354eb3f0db393f1c2cae5e78f927b9c2c"], 0xe4) [ 2655.779124][T17841] fuse: Bad value for 'fd' 19:10:46 executing program 5: prlimit64(0x0, 0xe, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:10:46 executing program 0: r0 = syz_open_dev$usbfs(0x0, 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup2(r1, r0) 19:10:46 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:10:46 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) fcntl$dupfd(r0, 0x80c, 0xffffffffffffffff) 19:10:46 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:46 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2658.209629][ T26] audit: type=1800 audit(1572894646.832:16459): pid=17957 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17187 res=0 [ 2658.289360][ T26] audit: type=1804 audit(1572894646.872:16460): pid=17957 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1945/file0" dev="sda1" ino=17187 res=1 19:10:47 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 2658.379581][ T26] audit: type=1804 audit(1572894646.942:16461): pid=17966 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1945/file0" dev="sda1" ino=17187 res=1 19:10:47 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:47 executing program 0: r0 = syz_open_dev$usbfs(0x0, 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup2(r1, r0) 19:10:47 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:10:47 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:47 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:10:47 executing program 5: prlimit64(0x0, 0xe, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:10:47 executing program 0: r0 = syz_open_dev$usbfs(0x0, 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup2(r1, r0) 19:10:47 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:10:47 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2659.283573][ T26] audit: type=1800 audit(1572894647.912:16462): pid=18005 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17208 res=0 19:10:48 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup2(r1, r0) 19:10:48 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) [ 2659.337681][ T26] audit: type=1804 audit(1572894647.942:16463): pid=18005 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1946/file0" dev="sda1" ino=17208 res=1 19:10:48 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2659.516141][ T26] audit: type=1804 audit(1572894648.002:16464): pid=18006 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1946/file0" dev="sda1" ino=17208 res=1 19:10:48 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:10:48 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup2(r1, r0) 19:10:48 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:10:48 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:48 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:10:48 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup2(r1, r0) 19:10:48 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:10:48 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x0, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:10:49 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2660.456901][ T26] audit: type=1800 audit(1572894649.082:16465): pid=18046 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17211 res=0 19:10:49 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup2(r1, r0) [ 2660.522758][ T26] audit: type=1804 audit(1572894649.112:16466): pid=18046 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1947/file0" dev="sda1" ino=17211 res=1 [ 2660.665081][ T26] audit: type=1804 audit(1572894649.182:16467): pid=18048 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1947/file0" dev="sda1" ino=17211 res=1 19:10:49 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup2(r1, r0) 19:10:49 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:49 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup2(r1, r0) 19:10:49 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:10:50 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x0, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:10:50 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:50 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup2(0xffffffffffffffff, r0) [ 2661.532769][ T26] audit: type=1800 audit(1572894650.162:16468): pid=18073 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17089 res=0 19:10:50 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:51 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:10:51 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:51 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup2(0xffffffffffffffff, r0) 19:10:51 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:51 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:10:51 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x0, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) [ 2663.476735][ T26] kauditd_printk_skb: 2 callbacks suppressed [ 2663.476776][ T26] audit: type=1800 audit(1572894652.102:16471): pid=18096 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17260 res=0 [ 2663.520553][T18106] fuse: Bad value for 'fd' 19:10:52 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:10:52 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup2(0xffffffffffffffff, r0) [ 2663.570861][ T26] audit: type=1804 audit(1572894652.142:16472): pid=18105 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1949/file0" dev="sda1" ino=17260 res=1 19:10:52 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2663.630382][ T26] audit: type=1804 audit(1572894652.222:16473): pid=18105 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1949/file0" dev="sda1" ino=17260 res=1 19:10:52 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:52 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:10:52 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup2(r1, r0) [ 2664.044750][T18126] fuse: Bad value for 'fd' 19:10:55 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:10:55 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:10:55 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:55 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:10:55 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup2(r1, r0) 19:10:55 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2666.547151][T18138] fuse: Bad value for 'fd' 19:10:55 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) [ 2666.575187][ T26] audit: type=1800 audit(1572894655.202:16474): pid=18148 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17410 res=0 19:10:55 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:55 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:10:55 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2666.715272][ T26] audit: type=1804 audit(1572894655.262:16475): pid=18154 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1950/file0" dev="sda1" ino=17410 res=1 19:10:55 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup2(r1, r0) 19:10:55 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) [ 2666.861414][T18166] fuse: Bad value for 'fd' [ 2666.905591][ T26] audit: type=1804 audit(1572894655.332:16476): pid=18154 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1950/file0" dev="sda1" ino=17410 res=1 19:10:55 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:55 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:10:55 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, 0x0) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup2(r1, r0) [ 2667.220882][T18181] fuse: Bad value for 'fd' 19:10:56 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:10:56 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x3c) ptrace$cont(0x18, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ptrace$cont(0x9, 0x0, 0x0, 0x0) 19:10:56 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:10:56 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:56 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x3c) ptrace$cont(0x18, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ptrace$cont(0x9, 0x0, 0x0, 0x0) 19:10:56 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, 0x0) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup2(r1, r0) [ 2667.590046][T18202] fuse: Bad value for 'fd' [ 2667.607923][ T26] audit: type=1800 audit(1572894656.232:16477): pid=18201 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16741 res=0 [ 2667.668317][ T26] audit: type=1804 audit(1572894656.232:16478): pid=18205 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1951/file0" dev="sda1" ino=16741 res=1 [ 2667.735727][ T26] audit: type=1804 audit(1572894656.302:16479): pid=18205 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1951/file0" dev="sda1" ino=16741 res=1 19:10:56 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x3c) ptrace$cont(0x18, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ptrace$cont(0x9, 0x0, 0x0, 0x0) 19:10:56 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, 0x0) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup2(r1, r0) 19:10:56 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:56 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:56 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) [ 2667.949550][T18217] fuse: Bad value for 'fd' 19:10:56 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup2(r1, r0) 19:10:57 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:10:57 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:57 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:10:57 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup2(r1, r0) 19:10:57 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 2668.466204][T18342] fuse: Bad value for 'fd' 19:10:57 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup2(r1, r0) 19:10:57 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) [ 2668.542387][ T26] audit: type=1800 audit(1572894657.172:16480): pid=18349 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16948 res=0 19:10:57 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2668.593591][ T26] audit: type=1804 audit(1572894657.172:16481): pid=18349 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1952/file0" dev="sda1" ino=16948 res=1 [ 2668.760672][ T26] audit: type=1804 audit(1572894657.262:16482): pid=18350 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1952/file0" dev="sda1" ino=16948 res=1 [ 2668.829762][T18360] fuse: Bad value for 'fd' 19:10:57 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:57 executing program 4: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:10:57 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r1, r0) 19:10:57 executing program 3: symlink(0x0, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2669.112575][T18373] fuse: Bad value for 'fd' 19:10:58 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:10:58 executing program 4: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:10:58 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:58 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r1, r0) 19:10:58 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:10:58 executing program 4: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) [ 2669.417017][T18383] ptrace attach of "/root/syz-executor.4"[18382] was attempted by "/root/syz-executor.4"[18383] 19:10:58 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup2(r1, r0) [ 2669.522707][ T26] audit: type=1800 audit(1572894658.152:16483): pid=18393 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16872 res=0 [ 2669.600401][ T26] audit: type=1804 audit(1572894658.152:16484): pid=18393 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1953/file0" dev="sda1" ino=16872 res=1 19:10:58 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2669.665452][ T26] audit: type=1804 audit(1572894658.222:16485): pid=18398 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1953/file0" dev="sda1" ino=16872 res=1 [ 2669.679283][T18401] ptrace attach of "/root/syz-executor.4"[18400] was attempted by "/root/syz-executor.4"[18401] 19:10:58 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:58 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) dup2(r1, r0) 19:10:58 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:10:58 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:59 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:10:59 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:59 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) dup2(r1, r0) 19:10:59 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:10:59 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:59 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(0xffffffffffffffff, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:10:59 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:59 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) dup2(r1, r0) 19:10:59 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(0xffffffffffffffff, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 2670.553758][ T26] audit: type=1800 audit(1572894659.182:16486): pid=18458 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16709 res=0 [ 2670.647211][ T26] audit: type=1804 audit(1572894659.212:16487): pid=18458 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1954/file0" dev="sda1" ino=16709 res=1 19:10:59 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:59 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) [ 2670.799486][ T26] audit: type=1804 audit(1572894659.312:16488): pid=18551 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1954/file0" dev="sda1" ino=16709 res=1 19:10:59 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:59 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:10:59 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup2(0xffffffffffffffff, r0) 19:10:59 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(0xffffffffffffffff, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:10:59 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:10:59 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:10:59 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:00 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) [ 2671.515254][ T26] audit: type=1800 audit(1572894660.142:16489): pid=18712 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16899 res=0 19:11:00 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:11:00 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:00 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcba", 0xeb}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:11:00 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup2(0xffffffffffffffff, r0) 19:11:00 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) [ 2671.982123][T18813] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 2672.023881][T18813] CPU: 1 PID: 18813 Comm: syz-executor.1 Not tainted 5.4.0-rc6+ #0 [ 2672.031875][T18813] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2672.041938][T18813] Call Trace: [ 2672.045259][T18813] dump_stack+0xf5/0x159 [ 2672.049528][T18813] dump_header+0xaa/0x449 [ 2672.053866][T18813] oom_kill_process.cold+0x10/0x15 [ 2672.059130][T18813] out_of_memory+0x231/0xa00 [ 2672.063838][T18813] mem_cgroup_out_of_memory+0x128/0x150 [ 2672.069479][T18813] try_charge+0xb3a/0xbc0 [ 2672.073832][T18813] ? __rcu_read_unlock+0x66/0x3c0 [ 2672.078889][T18813] __memcg_kmem_charge_memcg+0x4a/0xe0 [ 2672.084365][T18813] ? get_mem_cgroup_from_mm+0xb6/0x1c0 [ 2672.089915][T18813] __memcg_kmem_charge+0xde/0x240 [ 2672.094950][T18813] ? __mod_memcg_state+0x9a/0x120 [ 2672.100027][T18813] copy_process+0x11d2/0x3b50 [ 2672.104846][T18813] _do_fork+0xfe/0x6e0 [ 2672.108972][T18813] ? __read_once_size+0x5a/0xe0 [ 2672.113867][T18813] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 2672.119673][T18813] ? _copy_to_user+0x84/0xb0 [ 2672.124253][T18813] __x64_sys_clone+0x12b/0x160 [ 2672.129009][T18813] do_syscall_64+0xcc/0x370 [ 2672.133593][T18813] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2672.139486][T18813] RIP: 0033:0x45a219 [ 2672.143491][T18813] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2672.163147][T18813] RSP: 002b:00007f583883ac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 2672.171593][T18813] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000045a219 [ 2672.179581][T18813] RDX: 9999999999999999 RSI: 0000000000000000 RDI: 0000000000000102 [ 2672.187547][T18813] RBP: 000000000075bf20 R08: ffffffffffffffff R09: 0000000000000000 [ 2672.195509][T18813] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f583883b6d4 [ 2672.203552][T18813] R13: 00000000004c0923 R14: 00000000004d3228 R15: 00000000ffffffff [ 2672.214171][T18813] memory: usage 307200kB, limit 307200kB, failcnt 82 [ 2672.221448][T18813] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2672.228729][T18813] Memory cgroup stats for /syz1: [ 2672.228982][T18813] anon 290181120 [ 2672.228982][T18813] file 2105344 [ 2672.228982][T18813] kernel_stack 1953792 [ 2672.228982][T18813] slab 3366912 [ 2672.228982][T18813] sock 0 [ 2672.228982][T18813] shmem 2224128 [ 2672.228982][T18813] file_mapped 0 [ 2672.228982][T18813] file_dirty 0 [ 2672.228982][T18813] file_writeback 0 [ 2672.228982][T18813] anon_thp 276824064 [ 2672.228982][T18813] inactive_anon 2039808 [ 2672.228982][T18813] active_anon 290205696 [ 2672.228982][T18813] inactive_file 77824 [ 2672.228982][T18813] active_file 118784 [ 2672.228982][T18813] unevictable 135168 [ 2672.228982][T18813] slab_reclaimable 540672 [ 2672.228982][T18813] slab_unreclaimable 2826240 [ 2672.228982][T18813] pgfault 217173 [ 2672.228982][T18813] pgmajfault 0 [ 2672.228982][T18813] workingset_refault 0 [ 2672.228982][T18813] workingset_activate 0 [ 2672.228982][T18813] workingset_nodereclaim 0 [ 2672.228982][T18813] pgrefill 690 [ 2672.228982][T18813] pgscan 623 [ 2672.228982][T18813] pgsteal 586 19:11:01 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:01 executing program 2: r0 = socket(0x0, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:11:01 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup2(0xffffffffffffffff, r0) [ 2672.324222][T18813] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=7946,uid=0 [ 2672.339713][T18813] Memory cgroup out of memory: Killed process 7946 (syz-executor.1) total-vm:72980kB, anon-rss:12464kB, file-rss:35804kB, shmem-rss:0kB, UID:0 pgtables:159744kB oom_score_adj:1000 19:11:01 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) [ 2672.387473][T18809] syz-executor.1 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=0, oom_score_adj=1000 [ 2672.400872][T18809] CPU: 1 PID: 18809 Comm: syz-executor.1 Not tainted 5.4.0-rc6+ #0 [ 2672.412488][T18809] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2672.422568][T18809] Call Trace: [ 2672.425930][T18809] dump_stack+0xf5/0x159 [ 2672.430189][T18809] dump_header+0xaa/0x449 [ 2672.434550][T18809] oom_kill_process.cold+0x10/0x15 [ 2672.439682][T18809] out_of_memory+0x231/0xa00 [ 2672.444311][T18809] mem_cgroup_out_of_memory+0x128/0x150 [ 2672.449890][T18809] try_charge+0x8c1/0xbc0 [ 2672.454245][T18809] ? __rcu_read_unlock+0x66/0x3c0 [ 2672.459331][T18809] __memcg_kmem_charge_memcg+0x4a/0xe0 [ 2672.464990][T18809] ? get_mem_cgroup_from_mm+0xb6/0x1c0 [ 2672.470466][T18809] __memcg_kmem_charge+0xde/0x240 [ 2672.475550][T18809] __alloc_pages_nodemask+0x26c/0x310 [ 2672.480988][T18809] alloc_pages_current+0xd1/0x170 [ 2672.486023][T18809] pte_alloc_one+0x30/0xa0 [ 2672.490544][T18809] __pte_alloc+0x2d/0x220 [ 2672.494907][T18809] __handle_mm_fault+0x29a2/0x2c70 [ 2672.500070][T18809] handle_mm_fault+0x21b/0x530 [ 2672.504867][T18809] __do_page_fault+0x3fb/0x9e0 [ 2672.509688][T18809] do_page_fault+0x54/0x233 [ 2672.514204][T18809] ? do_syscall_64+0x270/0x370 [ 2672.519015][T18809] page_fault+0x34/0x40 [ 2672.523172][T18809] RIP: 0033:0x4006c4 [ 2672.527156][T18809] Code: 01 e9 c9 00 00 00 48 8b 44 24 10 48 0b 44 24 28 be 08 00 00 00 48 8b 14 24 75 17 48 8b 7c 24 20 e8 01 5a 00 00 48 8b 4c 24 08 <48> 89 01 e9 9d 00 00 00 48 8b 44 24 08 48 8b 38 e8 e7 59 00 00 8a [ 2672.546754][T18809] RSP: 002b:00007ffd3fda9730 EFLAGS: 00010206 [ 2672.552835][T18809] RAX: 0000000000000001 RBX: 000000000075c9a0 RCX: 0000000020000340 [ 2672.560809][T18809] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000001 [ 2672.568890][T18809] RBP: 00000000007600f0 R08: 0000000000000000 R09: 0000000000000000 [ 2672.576867][T18809] R10: 00007ffd3fda9840 R11: 0000000000000246 R12: 000000000075bf20 [ 2672.584836][T18809] R13: 000000000028c554 R14: 00000000007600f8 R15: 000000000075bf2c [ 2672.601736][T18809] memory: usage 294572kB, limit 307200kB, failcnt 82 [ 2672.608822][T18809] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2672.617492][T18809] Memory cgroup stats for /syz1: [ 2672.617673][T18809] anon 277569536 [ 2672.617673][T18809] file 2105344 [ 2672.617673][T18809] kernel_stack 1916928 [ 2672.617673][T18809] slab 3366912 19:11:01 executing program 2: r0 = socket(0x0, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 2672.617673][T18809] sock 0 [ 2672.617673][T18809] shmem 2224128 [ 2672.617673][T18809] file_mapped 0 [ 2672.617673][T18809] file_dirty 0 [ 2672.617673][T18809] file_writeback 0 [ 2672.617673][T18809] anon_thp 264241152 [ 2672.617673][T18809] inactive_anon 2039808 [ 2672.617673][T18809] active_anon 277594112 [ 2672.617673][T18809] inactive_file 77824 [ 2672.617673][T18809] active_file 118784 [ 2672.617673][T18809] unevictable 135168 [ 2672.617673][T18809] slab_reclaimable 540672 [ 2672.617673][T18809] slab_unreclaimable 2826240 [ 2672.617673][T18809] pgfault 217173 [ 2672.617673][T18809] pgmajfault 0 [ 2672.617673][T18809] workingset_refault 0 [ 2672.617673][T18809] workingset_activate 0 [ 2672.617673][T18809] workingset_nodereclaim 0 [ 2672.617673][T18809] pgrefill 690 [ 2672.617673][T18809] pgscan 623 [ 2672.617673][T18809] pgsteal 586 19:11:01 executing program 0: syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup2(r0, 0xffffffffffffffff) 19:11:01 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) [ 2672.775829][T18809] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=7799,uid=0 [ 2672.800121][T18809] Memory cgroup out of memory: Killed process 7799 (syz-executor.1) total-vm:72980kB, anon-rss:12464kB, file-rss:35800kB, shmem-rss:0kB, UID:0 pgtables:159744kB oom_score_adj:1000 19:11:01 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:01 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:01 executing program 2: r0 = socket(0x0, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:11:01 executing program 0: syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup2(r0, 0xffffffffffffffff) 19:11:03 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:11:03 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:03 executing program 1: clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:03 executing program 0: syz_open_dev$usbfs(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup2(r0, 0xffffffffffffffff) 19:11:03 executing program 2: r0 = socket(0x40000000002, 0x0, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:11:03 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:03 executing program 1: clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2675.044080][ T26] kauditd_printk_skb: 8 callbacks suppressed [ 2675.044099][ T26] audit: type=1800 audit(1572894663.672:16498): pid=18975 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17250 res=0 [ 2675.105375][ T26] audit: type=1804 audit(1572894663.712:16499): pid=18984 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1958/file0" dev="sda1" ino=17250 res=1 19:11:03 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r1, 0x800448d2, &(0x7f0000000580)={0x1, &(0x7f0000000280)=[{}]}) 19:11:03 executing program 1: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2675.173745][ T26] audit: type=1804 audit(1572894663.762:16500): pid=18984 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1958/file0" dev="sda1" ino=17250 res=1 19:11:03 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:03 executing program 2: r0 = socket(0x40000000002, 0x0, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:11:04 executing program 0: mkdir(&(0x7f0000000140)='./file0\x00', 0x13) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='rpc_pipefs\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, r0, 0x10) mount(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f00000001c0)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0x0, &(0x7f0000000000)) ioprio_set$uid(0x0, 0x0, 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x1000f4) semctl$GETVAL(0x0, 0xfac69a90c9373844, 0xc, &(0x7f0000000200)=""/157) r2 = open(&(0x7f00000000c0)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8000fffffffe) r3 = socket(0x1, 0x5, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f00000001c0), &(0x7f0000000200)=0x5) setreuid(0x0, 0x0) getegid() socket$alg(0x26, 0x5, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'michael_mic-generic\x00'}, 0x58) accept4$alg(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = socket$alg(0x26, 0x5, 0x0) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r3, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000300)={&(0x7f00000003c0)={0x140, r6, 0x800, 0x70bd29, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x2c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0xfff}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8}, @IPVS_DEST_ATTR_TUN_PORT={0x8, 0xe, 0x4e20}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xfffffff7}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x940}]}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x81}, @IPVS_DAEMON_ATTR_STATE={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80000000}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xc0fa}, @IPVS_CMD_ATTR_DAEMON={0x90, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @initdev={0xfe, 0x88, [], 0x0, 0x0}}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @remote}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'teql0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x3}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @empty}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_STATE={0x8}]}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, [@IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e22}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfffffffb}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_TUN_PORT={0x8, 0xe, 0x4e20}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}]}]}, 0x140}, 0x1, 0x0, 0x0, 0x4}, 0x20048800) bind$alg(r5, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'michael_mic-generic\x00'}, 0x58) [ 2675.665430][ T26] audit: type=1804 audit(1572894664.282:16501): pid=19010 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir729292021/syzkaller.BRkLqp/2385/bus" dev="sda1" ino=17157 res=1 19:11:06 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:11:06 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:06 executing program 2: r0 = socket(0x40000000002, 0x0, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:11:06 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:06 executing program 0: mkdir(&(0x7f0000000140)='./file0\x00', 0x13) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='rpc_pipefs\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, r0, 0x10) mount(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f00000001c0)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0x0, &(0x7f0000000000)) ioprio_set$uid(0x0, 0x0, 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x1000f4) semctl$GETVAL(0x0, 0xfac69a90c9373844, 0xc, &(0x7f0000000200)=""/157) r2 = open(&(0x7f00000000c0)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8000fffffffe) r3 = socket(0x1, 0x5, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f00000001c0), &(0x7f0000000200)=0x5) setreuid(0x0, 0x0) getegid() socket$alg(0x26, 0x5, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'michael_mic-generic\x00'}, 0x58) accept4$alg(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = socket$alg(0x26, 0x5, 0x0) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r3, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000300)={&(0x7f00000003c0)={0x140, r6, 0x800, 0x70bd29, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x2c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0xfff}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8}, @IPVS_DEST_ATTR_TUN_PORT={0x8, 0xe, 0x4e20}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xfffffff7}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x940}]}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x81}, @IPVS_DAEMON_ATTR_STATE={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80000000}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xc0fa}, @IPVS_CMD_ATTR_DAEMON={0x90, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @initdev={0xfe, 0x88, [], 0x0, 0x0}}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @remote}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'teql0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x3}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @empty}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_STATE={0x8}]}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, [@IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e22}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfffffffb}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_TUN_PORT={0x8, 0xe, 0x4e20}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}]}]}, 0x140}, 0x1, 0x0, 0x0, 0x4}, 0x20048800) bind$alg(r5, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'michael_mic-generic\x00'}, 0x58) 19:11:06 executing program 1: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2678.133015][ T26] audit: type=1800 audit(1572894666.762:16502): pid=19026 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17288 res=0 19:11:06 executing program 0: mkdir(&(0x7f0000000140)='./file0\x00', 0x13) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='rpc_pipefs\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, r0, 0x10) mount(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f00000001c0)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0x0, &(0x7f0000000000)) ioprio_set$uid(0x0, 0x0, 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x1000f4) semctl$GETVAL(0x0, 0xfac69a90c9373844, 0xc, &(0x7f0000000200)=""/157) r2 = open(&(0x7f00000000c0)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8000fffffffe) r3 = socket(0x1, 0x5, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f00000001c0), &(0x7f0000000200)=0x5) setreuid(0x0, 0x0) getegid() socket$alg(0x26, 0x5, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'michael_mic-generic\x00'}, 0x58) accept4$alg(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = socket$alg(0x26, 0x5, 0x0) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r3, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000300)={&(0x7f00000003c0)={0x140, r6, 0x800, 0x70bd29, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x2c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0xfff}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8}, @IPVS_DEST_ATTR_TUN_PORT={0x8, 0xe, 0x4e20}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xfffffff7}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x940}]}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x81}, @IPVS_DAEMON_ATTR_STATE={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80000000}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xc0fa}, @IPVS_CMD_ATTR_DAEMON={0x90, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @initdev={0xfe, 0x88, [], 0x0, 0x0}}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @remote}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'teql0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x3}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @empty}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_STATE={0x8}]}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, [@IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e22}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfffffffb}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_TUN_PORT={0x8, 0xe, 0x4e20}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}]}]}, 0x140}, 0x1, 0x0, 0x0, 0x4}, 0x20048800) bind$alg(r5, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'michael_mic-generic\x00'}, 0x58) [ 2678.202552][ T26] audit: type=1804 audit(1572894666.792:16503): pid=19026 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1959/file0" dev="sda1" ino=17288 res=1 19:11:06 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:06 executing program 2: r0 = socket(0x40000000002, 0x3, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 2678.286300][ T26] audit: type=1804 audit(1572894666.862:16504): pid=19037 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1959/file0" dev="sda1" ino=17288 res=1 19:11:07 executing program 0: mkdir(&(0x7f0000000140)='./file0\x00', 0x13) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='rpc_pipefs\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, r0, 0x10) mount(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f00000001c0)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0x0, &(0x7f0000000000)) ioprio_set$uid(0x0, 0x0, 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x1000f4) semctl$GETVAL(0x0, 0xfac69a90c9373844, 0xc, &(0x7f0000000200)=""/157) r2 = open(&(0x7f00000000c0)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8000fffffffe) r3 = socket(0x1, 0x5, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f00000001c0), &(0x7f0000000200)=0x5) setreuid(0x0, 0x0) getegid() socket$alg(0x26, 0x5, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'michael_mic-generic\x00'}, 0x58) accept4$alg(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = socket$alg(0x26, 0x5, 0x0) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r3, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000300)={&(0x7f00000003c0)={0x140, r6, 0x800, 0x70bd29, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x2c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0xfff}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8}, @IPVS_DEST_ATTR_TUN_PORT={0x8, 0xe, 0x4e20}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xfffffff7}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x940}]}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x81}, @IPVS_DAEMON_ATTR_STATE={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80000000}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xc0fa}, @IPVS_CMD_ATTR_DAEMON={0x90, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @initdev={0xfe, 0x88, [], 0x0, 0x0}}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @remote}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'teql0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x3}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @empty}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_STATE={0x8}]}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, [@IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e22}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfffffffb}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_TUN_PORT={0x8, 0xe, 0x4e20}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}]}]}, 0x140}, 0x1, 0x0, 0x0, 0x4}, 0x20048800) bind$alg(r5, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'michael_mic-generic\x00'}, 0x58) 19:11:07 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:07 executing program 2: r0 = socket(0x40000000002, 0x3, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:11:09 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:09 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:11:09 executing program 1: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:09 executing program 2: r0 = socket(0x40000000002, 0x3, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:11:09 executing program 0: mkdir(&(0x7f0000000140)='./file0\x00', 0x13) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='rpc_pipefs\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, r0, 0x10) mount(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f00000001c0)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0x0, &(0x7f0000000000)) ioprio_set$uid(0x0, 0x0, 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x1000f4) semctl$GETVAL(0x0, 0xfac69a90c9373844, 0xc, &(0x7f0000000200)=""/157) r2 = open(&(0x7f00000000c0)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8000fffffffe) r3 = socket(0x1, 0x5, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f00000001c0), &(0x7f0000000200)=0x5) setreuid(0x0, 0x0) getegid() socket$alg(0x26, 0x5, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'michael_mic-generic\x00'}, 0x58) accept4$alg(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = socket$alg(0x26, 0x5, 0x0) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r3, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000300)={&(0x7f00000003c0)={0x140, r6, 0x800, 0x70bd29, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x2c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0xfff}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8}, @IPVS_DEST_ATTR_TUN_PORT={0x8, 0xe, 0x4e20}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xfffffff7}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x940}]}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x81}, @IPVS_DAEMON_ATTR_STATE={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80000000}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xc0fa}, @IPVS_CMD_ATTR_DAEMON={0x90, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @initdev={0xfe, 0x88, [], 0x0, 0x0}}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @remote}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'teql0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x3}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @empty}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_STATE={0x8}]}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, [@IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e22}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfffffffb}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_TUN_PORT={0x8, 0xe, 0x4e20}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}]}]}, 0x140}, 0x1, 0x0, 0x0, 0x4}, 0x20048800) bind$alg(r5, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'michael_mic-generic\x00'}, 0x58) 19:11:09 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) [ 2681.259706][ T26] audit: type=1800 audit(1572894669.882:16505): pid=19080 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17411 res=0 19:11:10 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2681.334116][ T26] audit: type=1804 audit(1572894669.912:16506): pid=19080 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1960/file0" dev="sda1" ino=17411 res=1 19:11:10 executing program 0: mkdir(&(0x7f0000000140)='./file0\x00', 0x13) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='rpc_pipefs\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, r0, 0x10) mount(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f00000001c0)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0x0, &(0x7f0000000000)) ioprio_set$uid(0x0, 0x0, 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x1000f4) semctl$GETVAL(0x0, 0xfac69a90c9373844, 0xc, &(0x7f0000000200)=""/157) r2 = open(&(0x7f00000000c0)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8000fffffffe) r3 = socket(0x1, 0x5, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f00000001c0), &(0x7f0000000200)=0x5) setreuid(0x0, 0x0) getegid() socket$alg(0x26, 0x5, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'michael_mic-generic\x00'}, 0x58) accept4$alg(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = socket$alg(0x26, 0x5, 0x0) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r3, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000300)={&(0x7f00000003c0)={0x140, r6, 0x800, 0x70bd29, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x2c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0xfff}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8}, @IPVS_DEST_ATTR_TUN_PORT={0x8, 0xe, 0x4e20}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xfffffff7}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x940}]}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x81}, @IPVS_DAEMON_ATTR_STATE={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80000000}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xc0fa}, @IPVS_CMD_ATTR_DAEMON={0x90, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @initdev={0xfe, 0x88, [], 0x0, 0x0}}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @remote}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'teql0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x3}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @empty}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_STATE={0x8}]}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, [@IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e22}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfffffffb}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_TUN_PORT={0x8, 0xe, 0x4e20}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}]}]}, 0x140}, 0x1, 0x0, 0x0, 0x4}, 0x20048800) bind$alg(r5, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'michael_mic-generic\x00'}, 0x58) 19:11:10 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 2681.421593][ T26] audit: type=1804 audit(1572894669.992:16507): pid=19092 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1960/file0" dev="sda1" ino=17411 res=1 [ 2681.525025][ T26] audit: type=1804 audit(1572894670.012:16508): pid=19089 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir729292021/syzkaller.BRkLqp/2389/bus" dev="sda1" ino=17310 res=1 19:11:10 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:10 executing program 0: 19:11:10 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:10 executing program 0: 19:11:12 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:11:12 executing program 1: clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigsuspend(0x0, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:12 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:12 executing program 0: 19:11:12 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:12 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:11:13 executing program 1: clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigsuspend(0x0, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2684.377003][ T26] audit: type=1800 audit(1572894673.002:16509): pid=19130 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17306 res=0 19:11:13 executing program 0: [ 2684.472982][ T26] audit: type=1804 audit(1572894673.032:16510): pid=19130 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1961/file0" dev="sda1" ino=17306 res=1 [ 2684.528235][ T26] audit: type=1804 audit(1572894673.102:16511): pid=19197 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1961/file0" dev="sda1" ino=17306 res=1 19:11:13 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:13 executing program 1: clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigsuspend(0x0, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:13 executing program 0: 19:11:13 executing program 1: clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigsuspend(&(0x7f0000000340), 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:16 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:11:16 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:16 executing program 0: 19:11:16 executing program 1: clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigsuspend(&(0x7f0000000340), 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:16 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(0x0, 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:16 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:11:16 executing program 1: clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigsuspend(&(0x7f0000000340), 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:16 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(0x0, 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:16 executing program 0: 19:11:16 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:16 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(0x0, 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:16 executing program 0: 19:11:19 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:11:19 executing program 1: clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:19 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:19 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:19 executing program 0: 19:11:19 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:11:19 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:19 executing program 1: clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:19 executing program 1: clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) stat(0x0, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:19 executing program 0: 19:11:19 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:19 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:22 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:11:22 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(0x0, 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:22 executing program 1: clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) stat(0x0, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:22 executing program 0: 19:11:22 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:22 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:11:22 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(0x0, 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) [ 2693.711660][ T26] audit: type=1800 audit(1572894682.342:16512): pid=19347 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17068 res=0 19:11:22 executing program 1: clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) stat(0x0, 0x0) ioprio_set$uid(0x0, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:22 executing program 0: 19:11:22 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2693.851088][ T26] audit: type=1800 audit(1572894682.482:16513): pid=19354 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16795 res=0 19:11:22 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(0x0, 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:22 executing program 1: clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) stat(0x0, 0x0) ioprio_set$uid(0x0, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2694.022237][ T26] audit: type=1800 audit(1572894682.652:16514): pid=19365 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17300 res=0 19:11:25 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:11:25 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000400)={[], 0x0, 0x604}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 19:11:25 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:25 executing program 1: clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) stat(0x0, 0x0) ioprio_set$uid(0x0, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, 0x0) 19:11:25 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:25 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 2696.834973][ T26] audit: type=1800 audit(1572894685.462:16515): pid=19386 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16754 res=0 19:11:25 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) [ 2696.929441][ T26] audit: type=1804 audit(1572894685.492:16516): pid=19386 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1971/file0" dev="sda1" ino=16754 res=1 19:11:25 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:25 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:25 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) [ 2697.089159][ T26] audit: type=1804 audit(1572894685.512:16517): pid=19386 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1971/file0" dev="sda1" ino=16754 res=1 19:11:25 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, 0x0, 0x0) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:25 executing program 1: clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) stat(0x0, 0x0) ioprio_set$uid(0x0, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, 0x0) 19:11:25 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0xffffffffffffff31, &(0x7f0000000080)={&(0x7f0000000300)=ANY=[@ANYBLOB="480000002400070510000b000000000000000000", @ANYRES32, @ANYBLOB="00000000ffffffff00000000240008001c00010000000000000000000000000000000000000000000000000004000200"], 0x48}}, 0x0) [ 2697.196118][ T26] audit: type=1800 audit(1572894685.642:16518): pid=19397 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16694 res=0 [ 2697.278326][ T26] audit: type=1804 audit(1572894685.642:16519): pid=19397 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1972/file0" dev="sda1" ino=16694 res=1 19:11:26 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f000095bffc)={0x0, 0x3}, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) dup2(r1, r0) 19:11:26 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, 0x0, 0x0) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) [ 2697.460566][ T26] audit: type=1804 audit(1572894685.652:16520): pid=19397 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1972/file0" dev="sda1" ino=16694 res=1 19:11:26 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, 0x0, 0x0) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:26 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2697.518584][ T26] audit: type=1800 audit(1572894685.712:16521): pid=19400 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16694 res=0 19:11:26 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:11:26 executing program 1: setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$RTC_PLL_GET(0xffffffffffffffff, 0x801c7011, 0x0) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) ioctl$TIOCMIWAIT(r0, 0x545c, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x9}, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffb) add_key(&(0x7f00000002c0)='big_key\x00', 0x0, &(0x7f0000000100)="865bd20a4f9f85", 0xffffffffffffffe8, r1) add_key(&(0x7f00000000c0)='cifs.spnego\x00', &(0x7f0000000240)={'syz', 0x3}, &(0x7f0000000280), 0x0, r1) wait4(0x0, 0x0, 0x80000000, 0x0) ioctl$TIOCGRS485(0xffffffffffffffff, 0x542e, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\a'], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000054c0)=ANY=[@ANYBLOB="7400000024000705100000000000410000000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000080001007366710048000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef6700"/96], 0x74}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r5, @ANYBLOB="00080080000000000300000008000100753332005800020014800500000000000000000000000000000000000000000000000020898dde66057433b6efa43a41d22be225e0001b00000000000000000000000000000000000000000084e1a912c5998bcbf050000000000000000000000000000000798a3c067277da1a290b9653a33c575c36fad473382c8f5532ef3f0e1d2c451a7decbf3431a69f9b2e0800000000000000962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745abdfc21a9f61f2035979c109e9fea5b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d30000000000000000"], 0x84}}, 0x0) r6 = socket(0x10, 0x3, 0x0) sendmmsg$alg(r6, &(0x7f0000000140), 0x4924b68, 0x0) r7 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000340)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r7, 0x4c81, 0x0) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000200)={&(0x7f0000000100)='./bus\x00', 0x0, 0x8}, 0x10) io_submit(0x0, 0x0, &(0x7f0000000540)) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='hugetlbfs\x00', 0x0, 0x0) 19:11:26 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f000095bffc)={0x0, 0x3}, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) dup2(r1, r0) 19:11:26 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600), 0x0) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) [ 2698.147391][T19447] netlink: 84 bytes leftover after parsing attributes in process `syz-executor.1'. 19:11:29 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:11:29 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600), 0x0) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:29 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f000095bffc)={0x0, 0x3}, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) dup2(r1, r0) 19:11:29 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:29 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:11:29 executing program 1: setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$RTC_PLL_GET(0xffffffffffffffff, 0x801c7011, 0x0) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) ioctl$TIOCMIWAIT(r0, 0x545c, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x9}, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffb) add_key(&(0x7f00000002c0)='big_key\x00', 0x0, &(0x7f0000000100)="865bd20a4f9f85", 0xffffffffffffffe8, r1) add_key(&(0x7f00000000c0)='cifs.spnego\x00', &(0x7f0000000240)={'syz', 0x3}, &(0x7f0000000280), 0x0, r1) wait4(0x0, 0x0, 0x80000000, 0x0) ioctl$TIOCGRS485(0xffffffffffffffff, 0x542e, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\a'], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000054c0)=ANY=[@ANYBLOB="7400000024000705100000000000410000000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000080001007366710048000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef6700"/96], 0x74}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r5, @ANYBLOB="00080080000000000300000008000100753332005800020014800500000000000000000000000000000000000000000000000020898dde66057433b6efa43a41d22be225e0001b00000000000000000000000000000000000000000084e1a912c5998bcbf050000000000000000000000000000000798a3c067277da1a290b9653a33c575c36fad473382c8f5532ef3f0e1d2c451a7decbf3431a69f9b2e0800000000000000962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745abdfc21a9f61f2035979c109e9fea5b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d30000000000000000"], 0x84}}, 0x0) r6 = socket(0x10, 0x3, 0x0) sendmmsg$alg(r6, &(0x7f0000000140), 0x4924b68, 0x0) r7 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000340)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r7, 0x4c81, 0x0) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000200)={&(0x7f0000000100)='./bus\x00', 0x0, 0x8}, 0x10) io_submit(0x0, 0x0, &(0x7f0000000540)) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='hugetlbfs\x00', 0x0, 0x0) 19:11:29 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600), 0x0) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) [ 2700.493953][ T26] kauditd_printk_skb: 14 callbacks suppressed [ 2700.493974][ T26] audit: type=1800 audit(1572894689.122:16536): pid=19460 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16848 res=0 19:11:29 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:11:29 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2700.666716][ T26] audit: type=1804 audit(1572894689.152:16537): pid=19460 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1978/file0" dev="sda1" ino=16848 res=1 19:11:29 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6", 0x100) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:29 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:11:29 executing program 0: setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$RTC_PLL_GET(0xffffffffffffffff, 0x801c7011, 0x0) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) ioctl$TIOCMIWAIT(r0, 0x545c, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x9}, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffb) add_key(&(0x7f00000002c0)='big_key\x00', 0x0, &(0x7f0000000100)="865bd20a4f9f85", 0xffffffffffffffe8, r1) add_key(&(0x7f00000000c0)='cifs.spnego\x00', &(0x7f0000000240)={'syz', 0x3}, &(0x7f0000000280), 0x0, r1) wait4(0x0, 0x0, 0x80000000, 0x0) ioctl$TIOCGRS485(0xffffffffffffffff, 0x542e, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\a'], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000054c0)=ANY=[@ANYBLOB="7400000024000705100000000000410000000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000080001007366710048000229c6090032d0ed64f3c3545aaf6e000085a4e4ebb5ef6700"/96], 0x74}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="840000002c00010700"/20, @ANYRES32=r5, @ANYBLOB="00080080000000000300000008000100753332005800020014800500000000000000000000000000000000000000000000000020898dde66057433b6efa43a41d22be225e0001b00000000000000000000000000000000000000000084e1a912c5998bcbf050000000000000000000000000000000798a3c067277da1a290b9653a33c575c36fad473382c8f5532ef3f0e1d2c451a7decbf3431a69f9b2e0800000000000000962fe0484676958265e2988326a89db3139d91fe4aee6ae7e745abdfc21a9f61f2035979c109e9fea5b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d30000000000000000"], 0x84}}, 0x0) r6 = socket(0x10, 0x3, 0x0) sendmmsg$alg(r6, &(0x7f0000000140), 0x4924b68, 0x0) r7 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000340)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r7, 0x4c81, 0x0) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000200)={&(0x7f0000000100)='./bus\x00', 0x0, 0x8}, 0x10) io_submit(0x0, 0x0, &(0x7f0000000540)) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='hugetlbfs\x00', 0x0, 0x0) 19:11:29 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6", 0x100) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) [ 2700.897178][ T26] audit: type=1804 audit(1572894689.152:16538): pid=19460 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1978/file0" dev="sda1" ino=16848 res=1 19:11:29 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6", 0x100) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) [ 2701.048749][ T26] audit: type=1800 audit(1572894689.322:16539): pid=19476 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16759 res=0 19:11:29 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7", 0x180) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:29 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x0, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:11:29 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2701.200685][ T26] audit: type=1804 audit(1572894689.332:16540): pid=19476 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1979/file0" dev="sda1" ino=16759 res=1 19:11:29 executing program 1: tkill(0x0, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f000095bffc)={0x0, 0x0, 0xfffffffffffffffc}, 0x4) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) 19:11:29 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7", 0x180) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) [ 2701.366500][ T26] audit: type=1804 audit(1572894689.342:16541): pid=19476 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1979/file0" dev="sda1" ino=16759 res=1 [ 2701.447953][ T26] audit: type=1800 audit(1572894689.412:16542): pid=19481 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16746 res=0 19:11:30 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x0, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 2701.485791][ T26] audit: type=1804 audit(1572894689.422:16543): pid=19481 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1980/file0" dev="sda1" ino=16746 res=1 [ 2701.517747][ T26] audit: type=1804 audit(1572894689.422:16544): pid=19481 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1980/file0" dev="sda1" ino=16746 res=1 19:11:30 executing program 0: [ 2701.567471][ T26] audit: type=1800 audit(1572894689.612:16545): pid=19488 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16788 res=0 19:11:30 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7", 0x180) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:32 executing program 1: 19:11:32 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1", 0x76}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:11:32 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x0, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:11:32 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, 0x0, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:32 executing program 0: 19:11:32 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351d", 0x1c0) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:32 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351d", 0x1c0) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:32 executing program 1: 19:11:32 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, 0x0, 0x0) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:11:32 executing program 0: 19:11:32 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351d", 0x1c0) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:33 executing program 1: 19:11:33 executing program 0: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0815b5055e0bcfe87b3071") r1 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="0815b5055e0bcfe87b3071") r2 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r2, 0x1000008912, &(0x7f00000001c0)="0815b5055e0bcfe87b3071") ioctl$sock_SIOCADDDLCI(r2, 0x8980, &(0x7f0000000040)={'ip6gre0\x00', 0x8001}) tee(r1, r2, 0x7, 0x12) r3 = socket$inet6(0xa, 0x801, 0x0) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) syz_emit_ethernet(0x8a, &(0x7f0000000600)={@local, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x54, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd]}, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, {[@exp_smc={0xfe, 0x6}, @exp_fastopen={0xfe, 0x4}, @window={0x3, 0x3, 0x28}, @md5sig={0x13, 0x12, "d31c8190da8dfe461d135b075be2c1c4"}, @md5sig={0x13, 0x12, "5b3b4bc0ca96fcedefad47a621547516"}, @exp_fastopen={0xfe, 0xc, 0xf989, "908fabfe9a69b583"}]}}}}}}}}, 0x0) 19:11:35 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1", 0x76}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:11:35 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, 0x0, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:35 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e6", 0x1e0) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:35 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, 0x0, 0x0) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:11:35 executing program 1: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0815b5055e0bcfe87b3071") r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'lo\x00@\x00', 0x1801}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$sock_linger(r2, 0x1, 0x35, &(0x7f00000000c0)={0x1}, 0x8) 19:11:35 executing program 0: r0 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r0, &(0x7f0000001a40)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0xc100) sendmsg(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000140)="b1", 0x1}], 0x1}, 0x8000) recvfrom$inet6(r0, 0x0, 0xfffffee4, 0x0, 0x0, 0x171d83f7f4539308) setsockopt$inet6_int(r0, 0x29, 0x7, &(0x7f0000000000), 0x0) r1 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="0815b5055e0bcfe87b3071") sendto$inet6(r0, &(0x7f00000003c0)='T', 0x1, 0x0, 0x0, 0x0) 19:11:35 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e6", 0x1e0) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) [ 2707.214718][ T26] kauditd_printk_skb: 23 callbacks suppressed [ 2707.214780][ T26] audit: type=1800 audit(1572894695.842:16569): pid=19783 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16698 res=0 19:11:36 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, 0x0, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:36 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, 0x0, 0x0) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 2707.322462][ T26] audit: type=1804 audit(1572894695.882:16570): pid=19783 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1989/file0" dev="sda1" ino=16698 res=1 19:11:36 executing program 1: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0815b5055e0bcfe87b3071") r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'lo\x00@\x00', 0x1801}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$sock_linger(r2, 0x1, 0x35, &(0x7f00000000c0)={0x1}, 0x8) [ 2707.415770][ T26] audit: type=1804 audit(1572894695.882:16571): pid=19783 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1989/file0" dev="sda1" ino=16698 res=1 19:11:36 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e6", 0x1e0) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) [ 2707.487060][ T26] audit: type=1800 audit(1572894696.042:16572): pid=19791 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16644 res=0 [ 2707.599044][ T26] audit: type=1804 audit(1572894696.042:16573): pid=19791 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1990/file0" dev="sda1" ino=16644 res=1 19:11:36 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1", 0x1f0) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) [ 2707.687353][ T26] audit: type=1804 audit(1572894696.072:16574): pid=19791 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1990/file0" dev="sda1" ino=16644 res=1 [ 2707.781659][ T26] audit: type=1800 audit(1572894696.272:16575): pid=19803 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16806 res=0 [ 2707.833881][ T26] audit: type=1804 audit(1572894696.272:16576): pid=19803 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1991/file0" dev="sda1" ino=16806 res=1 [ 2707.904797][ T26] audit: type=1804 audit(1572894696.272:16577): pid=19803 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1991/file0" dev="sda1" ino=16806 res=1 [ 2707.930056][ T26] audit: type=1800 audit(1572894696.442:16578): pid=19807 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16678 res=0 19:11:38 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1", 0x76}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:11:38 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:38 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000), 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:11:38 executing program 1: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0815b5055e0bcfe87b3071") r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'lo\x00@\x00', 0x1801}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x0, @empty}, 0x1c) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000080)={'lo\x00\x00\x00\x00\r\xc2\x00\t\x00\x00\x00\x80\x00'}) setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000000c0)={0x1}, 0x8) 19:11:38 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1", 0x1f0) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:38 executing program 0: r0 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r0, &(0x7f0000001a40)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmsg(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000140)="b1", 0x1}], 0x1}, 0x8000) recvfrom$inet6(r0, 0x0, 0xfffffee4, 0x0, 0x0, 0x171d83f7f4539308) setsockopt$inet6_int(r0, 0x29, 0x7, &(0x7f0000000000), 0x0) r1 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="0815b5055e0bcfe87b3071") sendto$inet6(r0, &(0x7f00000003c0)='T', 0x1, 0x0, 0x0, 0x0) 19:11:39 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1", 0x1f0) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:39 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000), 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:11:39 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a", 0x1f8) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:39 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_MCAST_ROUTER={0x8, 0x16, 0x7}]}}}]}, 0x3c}}, 0x0) 19:11:39 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:39 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a", 0x1f8) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) [ 2710.691059][T19846] netlink: 'syz-executor.1': attribute type 22 has an invalid length. 19:11:42 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe1", 0xb1}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:11:42 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000), 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:11:42 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:42 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a", 0x1f8) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:42 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_MCAST_ROUTER={0x8, 0x16, 0x7}]}}}]}, 0x3c}}, 0x0) 19:11:42 executing program 0: openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$packet(0x11, 0x0, 0x300) dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0xc028660f, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) open(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, r0, 0x0) write$P9_RWALK(r0, &(0x7f00000003c0)=ANY=[@ANYRES64], 0x8) mmap(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0) openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0) open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x10, 0xffffffffffffffff, 0x0) write$P9_RWALK(0xffffffffffffffff, 0x0, 0x0) r1 = getegid() setresgid(0x0, r1, 0x0) r2 = open(0x0, 0x0, 0x0) mmap(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x0, 0x28812, 0xffffffffffffffff, 0x0) dup2(r2, 0xffffffffffffffff) ioctl$NS_GET_OWNER_UID(r2, 0xb704, 0x0) setresgid(0x0, 0x0, 0x0) open(0x0, 0x0, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) open(0x0, 0x0, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x10, 0xffffffffffffffff, 0x0) setresgid(0x0, 0x0, 0x0) fchown(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000002540)) getpid() fcntl$setsig(0xffffffffffffffff, 0xa, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) fstat(0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x0, 0x10, r3, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, 0xffffffffffffffff, 0x0) accept4$packet(0xffffffffffffffff, &(0x7f0000004fc0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, 0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x0, 0x28812, r4, 0x0) r5 = perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r4, r5) [ 2713.425511][T19860] netlink: 'syz-executor.1': attribute type 22 has an invalid length. 19:11:42 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed183", 0x1fc) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) [ 2713.475733][ T26] kauditd_printk_skb: 14 callbacks suppressed [ 2713.475750][ T26] audit: type=1800 audit(1572894702.102:16593): pid=19871 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17121 res=0 19:11:42 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 2713.551854][ T26] audit: type=1804 audit(1572894702.102:16594): pid=19871 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1997/file0" dev="sda1" ino=17121 res=1 19:11:42 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:42 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed183", 0x1fc) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:42 executing program 1: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) creat(&(0x7f00000005c0)='./file1\x00', 0x0) open(0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000100)='./file1\x00', 0x0) [ 2713.772827][ T26] audit: type=1804 audit(1572894702.142:16595): pid=19871 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1997/file0" dev="sda1" ino=17121 res=1 19:11:42 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 2713.845010][ T26] audit: type=1804 audit(1572894702.142:16596): pid=19864 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir729292021/syzkaller.BRkLqp/2414/bus" dev="sda1" ino=17124 res=1 [ 2713.873556][ T26] audit: type=1804 audit(1572894702.142:16597): pid=19864 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir729292021/syzkaller.BRkLqp/2414/bus" dev="sda1" ino=17124 res=1 [ 2713.906929][ T26] audit: type=1804 audit(1572894702.152:16598): pid=19864 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir729292021/syzkaller.BRkLqp/2414/bus" dev="sda1" ino=17124 res=1 [ 2713.961867][ T26] audit: type=1800 audit(1572894702.272:16599): pid=19879 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17101 res=0 [ 2713.982865][ T26] audit: type=1804 audit(1572894702.272:16600): pid=19879 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1998/file0" dev="sda1" ino=17101 res=1 [ 2714.043493][ T26] audit: type=1804 audit(1572894702.282:16601): pid=19879 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/1998/file0" dev="sda1" ino=17101 res=1 [ 2714.069007][ T26] audit: type=1804 audit(1572894702.312:16602): pid=19875 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir729292021/syzkaller.BRkLqp/2414/bus" dev="sda1" ino=17124 res=1 19:11:45 executing program 0: syz_mount_image$ntfs(&(0x7f0000000140)='ntfs\x00', &(0x7f00000001c0)='./file0\x00', 0x29040000, 0x0, 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB='errors=recover,smackfstransmute=']) 19:11:45 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe1", 0xb1}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:11:45 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed183", 0x1fc) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:45 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:45 executing program 1: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) creat(&(0x7f00000005c0)='./file1\x00', 0x0) open(0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000100)='./file1\x00', 0x0) 19:11:45 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:11:45 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d6", 0x1fe) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:45 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x77, 0x1) ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000080)={0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0}) 19:11:45 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x0, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:11:45 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d6", 0x1fe) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:45 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:45 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d6", 0x1fe) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:45 executing program 1: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) creat(&(0x7f00000005c0)='./file1\x00', 0x0) open(0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000100)='./file1\x00', 0x0) 19:11:48 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe1", 0xb1}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:11:48 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x0, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:11:48 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x77, 0x1) ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000080)={0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0}) 19:11:48 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d634", 0x1ff) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:48 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:48 executing program 1: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) creat(&(0x7f00000005c0)='./file1\x00', 0x0) open(0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000100)='./file1\x00', 0x0) 19:11:48 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d634", 0x1ff) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) [ 2719.747058][ T26] kauditd_printk_skb: 18 callbacks suppressed [ 2719.747080][ T26] audit: type=1800 audit(1572894708.372:16621): pid=19961 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16916 res=0 19:11:48 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x0, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 2719.854954][ T26] audit: type=1804 audit(1572894708.412:16622): pid=19961 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/2004/file0" dev="sda1" ino=16916 res=1 19:11:48 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:48 executing program 0: setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) creat(&(0x7f00000005c0)='./file1\x00', 0xc0) r1 = open(&(0x7f0000002bc0)='./file0\x00', 0x40c2, 0x0) r2 = dup(0xffffffffffffffff) setsockopt$inet_tcp_int(r2, 0x6, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000100)='./file1\x00', 0x0) write(r1, &(0x7f0000000600)='4', 0x4100) [ 2719.985724][ T26] audit: type=1804 audit(1572894708.422:16623): pid=19961 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/2004/file0" dev="sda1" ino=16916 res=1 [ 2720.084736][ T26] audit: type=1800 audit(1572894708.702:16624): pid=19974 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16756 res=0 19:11:48 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d634", 0x1ff) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) [ 2720.177488][ T26] audit: type=1804 audit(1572894708.712:16625): pid=19975 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/2005/file0" dev="sda1" ino=16756 res=1 19:11:48 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, 0x0, 0x0) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 2720.257430][ T26] audit: type=1804 audit(1572894708.712:16626): pid=19979 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/2005/file0" dev="sda1" ino=16756 res=1 [ 2720.363462][ T26] audit: type=1800 audit(1572894708.782:16627): pid=19982 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.0" name="file0" dev="sda1" ino=16680 res=0 [ 2720.470847][ T26] audit: type=1800 audit(1572894709.022:16628): pid=19990 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16791 res=0 [ 2720.558499][ T26] audit: type=1804 audit(1572894709.022:16629): pid=19990 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/2006/file0" dev="sda1" ino=16791 res=1 [ 2720.584061][ T26] audit: type=1804 audit(1572894709.032:16630): pid=19990 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/2006/file0" dev="sda1" ino=16791 res=1 19:11:51 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c9", 0xce}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:11:51 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:51 executing program 1: r0 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x77, 0x1) ioctl$USBDEVFS_CONTROL(r0, 0xc0105500, 0x0) 19:11:51 executing program 0: setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) creat(&(0x7f00000005c0)='./file1\x00', 0xc0) r1 = open(&(0x7f0000002bc0)='./file0\x00', 0x40c2, 0x0) r2 = dup(0xffffffffffffffff) setsockopt$inet_tcp_int(r2, 0x6, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000100)='./file1\x00', 0x0) write(r1, &(0x7f0000000600)='4', 0x4100) 19:11:51 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) getpid() sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, r0, 0x0, 0xffffffff) 19:11:51 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, 0x0, 0x0) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:11:51 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, 0x0, 0x0) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:11:51 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x77, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) connect$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000080)={0x0, 0x3, 0x1, 0x0, 0x0, 0x0, 0x0}) 19:11:51 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x0) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:51 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, r6}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x243, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="400000002400070500000000000080001d6b5cd1", @ANYRES32=r6, @ANYBLOB="00000000ffffffff0000000014000100706669666f5f686561645f64726f70000800020000000000"], 0x40}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0xffffffffffffff31, &(0x7f0000000080)={&(0x7f0000000300)=ANY=[@ANYBLOB="480000002400070510000b000000000000000000", @ANYRES32=r6, @ANYBLOB="00000000ffffffff00000000240008001c00010000000000000000000000000000000000000000000000000004000200"], 0x48}}, 0x0) 19:11:51 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c9", 0xce}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:11:51 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:11:52 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x0) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:52 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x0) 19:11:52 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) getpid() sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, r0, 0x0, 0xffffffff) 19:11:52 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:52 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000000c0)='ip_vti0\x00', 0x10) connect$inet(r0, &(0x7f0000000100), 0x10) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000580)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000000000fa0000003000000003030000ff3f00000000000000000000000000000000000000000d01ac1414bb000000000000000000000000030005000000000002000000e000000100000000000000004cebfb3815a5b1b1fed6ea04987a2e0f56664f63d0e0adc2d15a096ce8f923624bd3de00fbcbc9ebe52efae43ab93f7d84b3910def6f6ba852540229b9b1446202b8388ebd5d8e9d7f50febcba3ef32a6bc029e051f1c351a11fc0dc1533f60510aa4444976ba8cc60ed6ee06913c75ed6cc7a23cf47da861b509344b19cf451e57549fc17ad2420977fb714891e1dd1c77e90eb0000000000"], 0x80}}, 0x0) sendmmsg(r0, &(0x7f0000007fc0), 0x4c9af847232957, 0x0) 19:11:52 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$netlink(0x10, 0x3, 0x0) writev(r3, &(0x7f0000000080)=[{&(0x7f0000000100)="39000000130009006900000000000000ab008048060000004600010707000014190001001000000800005068000000000000ef38bf461e59d7", 0x39}], 0x1) 19:11:52 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:52 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="d3d2b92c38f19c0400cd802c"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) prctl$PR_SET_THP_DISABLE(0x29, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de23d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c", @ANYRESDEC], 0x0, 0x122}, 0x20) tkill(r2, 0x39) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 19:11:52 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:52 executing program 0: [ 2724.322393][T20067] ptrace attach of "/root/syz-executor.0"[20066] was attempted by "/root/syz-executor.0"[20067] 19:11:55 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c9", 0xce}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:11:55 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000000c0)='ip_vti0\x00', 0x10) connect$inet(r0, &(0x7f0000000100), 0x10) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000580)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000000000fa0000003000000003030000ff3f00000000000000000000000000000000000000000d01ac1414bb000000000000000000000000030005000000000002000000e000000100000000000000004cebfb3815a5b1b1fed6ea04987a2e0f56664f63d0e0adc2d15a096ce8f923624bd3de00fbcbc9ebe52efae43ab93f7d84b3910def6f6ba852540229b9b1446202b8388ebd5d8e9d7f50febcba3ef32a6bc029e051f1c351a11fc0dc1533f60510aa4444976ba8cc60ed6ee06913c75ed6cc7a23cf47da861b509344b19cf451e57549fc17ad2420977fb714891e1dd1c77e90eb0000000000"], 0x80}}, 0x0) sendmmsg(r0, &(0x7f0000007fc0), 0x4c9af847232957, 0x0) 19:11:55 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:11:55 executing program 0: 19:11:55 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<'}}]}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:55 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) getpid() sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, r0, 0x0, 0xffffffff) [ 2726.455713][ T26] kauditd_printk_skb: 7 callbacks suppressed [ 2726.455734][ T26] audit: type=1800 audit(1572894715.082:16638): pid=20084 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17314 res=0 19:11:55 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2726.560016][ T26] audit: type=1804 audit(1572894715.112:16639): pid=20084 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/2009/file0" dev="sda1" ino=17314 res=1 19:11:55 executing program 0: [ 2726.673939][ T26] audit: type=1804 audit(1572894715.162:16640): pid=20091 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/2009/file0" dev="sda1" ino=17314 res=1 19:11:55 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:11:55 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:55 executing program 0: 19:11:55 executing program 1: 19:11:55 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:55 executing program 0: 19:11:55 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:11:56 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:56 executing program 1: r0 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x4000000000802, 0x0) write$uinput_user_dev(r1, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_DEV_SETUP(r1, 0x5501, 0x0) dup3(r0, r1, 0x0) 19:11:56 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1f}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:56 executing program 0: [ 2727.554700][ T26] audit: type=1800 audit(1572894716.182:16641): pid=20124 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17347 res=0 [ 2727.605243][ T26] audit: type=1804 audit(1572894716.222:16642): pid=20124 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/2010/file0" dev="sda1" ino=17347 res=1 [ 2727.688122][T20126] input: syz1 as /devices/virtual/input/input42 [ 2727.738615][ T26] audit: type=1804 audit(1572894716.272:16643): pid=20127 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/2010/file0" dev="sda1" ino=17347 res=1 19:11:56 executing program 0: 19:11:58 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:11:58 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:58 executing program 1: r0 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x4000000000802, 0x0) write$uinput_user_dev(r1, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_DEV_SETUP(r1, 0x5501, 0x0) dup3(r0, r1, 0x0) 19:11:58 executing program 0: 19:11:58 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:11:58 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:11:58 executing program 0: [ 2730.049987][ T26] audit: type=1800 audit(1572894718.672:16644): pid=20154 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17391 res=0 [ 2730.063087][T20151] input: syz1 as /devices/virtual/input/input43 [ 2730.119845][ T26] audit: type=1804 audit(1572894718.702:16645): pid=20154 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/2011/file0" dev="sda1" ino=17391 res=1 19:11:58 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) [ 2730.176693][ T26] audit: type=1804 audit(1572894718.762:16646): pid=20159 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/2011/file0" dev="sda1" ino=17391 res=1 19:11:58 executing program 0: 19:11:59 executing program 1: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigtimedwait(&(0x7f00000000c0), 0x0, 0x0, 0x8) r0 = getpid() socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fcntl$dupfd(r1, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) rt_sigtimedwait(&(0x7f0000000000), 0x0, 0x0, 0x8) ptrace(0x10, r0) ptrace$cont(0x4205, r0, 0x40000000002, 0x20007ff6) 19:11:59 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:11:59 executing program 0: io_setup(0x8, &(0x7f0000000600)=0x0) pipe2$9p(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) io_submit(r0, 0x1, &(0x7f0000000180)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) io_cancel(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x0) 19:12:01 executing program 0: io_setup(0x8, &(0x7f0000000600)=0x0) pipe2$9p(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) io_submit(r0, 0x1, &(0x7f0000000180)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) io_cancel(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x0) 19:12:01 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x0, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:12:01 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc", 0xdd}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:12:01 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:12:01 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:12:01 executing program 1: io_setup(0x8, &(0x7f0000000600)=0x0) pipe2$9p(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) io_submit(r0, 0x1, &(0x7f0000000180)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) [ 2733.121392][ T26] audit: type=1800 audit(1572894721.752:16647): pid=20197 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17412 res=0 [ 2733.145680][ T26] audit: type=1804 audit(1572894721.782:16648): pid=20197 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/2012/file0" dev="sda1" ino=17412 res=1 19:12:01 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79", 0xe4}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) [ 2733.230221][ T26] audit: type=1804 audit(1572894721.852:16649): pid=20275 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/2012/file0" dev="sda1" ino=17412 res=1 19:12:01 executing program 0: io_setup(0x8, &(0x7f0000000600)=0x0) pipe2$9p(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) io_submit(r0, 0x1, &(0x7f0000000180)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) io_cancel(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x0) 19:12:02 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x0, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:12:02 executing program 1: io_setup(0x8, &(0x7f0000000600)=0x0) pipe2$9p(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) io_submit(r0, 0x1, &(0x7f0000000180)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) 19:12:02 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79", 0xe4}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:12:02 executing program 0: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xa}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYRESDEC=0x0, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5eb02c5932eec510100013f7483349b"], 0x0, 0x3b}, 0x20) socketpair$unix(0x1, 0x40000000000001, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fcntl$dupfd(r1, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) tkill(r0, 0x3b) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000040)=@nat={'nat\x00', 0x19, 0x3, 0x0, [0x20000440, 0x0, 0x0, 0x20000ece, 0x20000efe], 0x0, &(0x7f0000000000), 0x0}, 0xd5a) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:12:02 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x0, 0x0, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 19:12:02 executing program 1: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) r1 = socket$packet(0x11, 0x0, 0x300) setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f00000000c0)=@req={0x1, 0x0, 0x2}, 0x10) connect$inet6(0xffffffffffffffff, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffa7}}], 0x80004ec, 0x0, 0x0) 19:12:02 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000380)='cgroup.procs\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = getpid() write$cgroup_pid(r1, &(0x7f0000000140)=r4, 0x12) [ 2733.779630][T20328] ptrace attach of "/root/syz-executor.0"[20327] was attempted by "/root/syz-executor.0"[20328] 19:12:02 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:12:02 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) [ 2734.035048][T20340] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.1'. 19:12:02 executing program 3: symlink(0x0, 0x0) creat(0x0, 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) ioprio_set$uid(0x0, 0x0, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x0, 0x0, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, 0x0) [ 2734.085279][T20340] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.1'. [ 2734.098398][ T26] audit: type=1800 audit(1572894722.732:16650): pid=20443 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16708 res=0 19:12:02 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000380)='cgroup.procs\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = getpid() write$cgroup_pid(r1, &(0x7f0000000140)=r4, 0x12) [ 2734.146202][T20340] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.1'. [ 2734.196086][ T26] audit: type=1804 audit(1572894722.752:16651): pid=20443 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/2013/file0" dev="sda1" ino=16708 res=1 [ 2734.273370][T20340] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.1'. [ 2734.296099][ T26] audit: type=1804 audit(1572894722.802:16652): pid=20446 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/2013/file0" dev="sda1" ino=16708 res=1 19:12:03 executing program 1: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) r1 = socket$packet(0x11, 0x0, 0x300) setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f00000000c0)=@req={0x1, 0x0, 0x2}, 0x10) connect$inet6(0xffffffffffffffff, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffa7}}], 0x80004ec, 0x0, 0x0) 19:12:03 executing program 0: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) r1 = socket$packet(0x11, 0x0, 0x300) setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f00000000c0)=@req={0x1, 0x0, 0x2}, 0x10) connect$inet6(0xffffffffffffffff, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffa7}}], 0x80004ec, 0x0, 0x0) 19:12:03 executing program 3: [ 2734.571893][T20567] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.0'. [ 2734.604609][T20567] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.0'. [ 2734.648836][T20569] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.1'. [ 2734.668380][T20567] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.0'. [ 2734.682879][T20569] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.1'. [ 2734.693309][T20569] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.1'. 19:12:05 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79", 0xe4}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:12:05 executing program 3: 19:12:05 executing program 1: 19:12:05 executing program 0: 19:12:05 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:12:05 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 2736.772132][ T26] audit: type=1800 audit(1572894725.402:16653): pid=20578 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16822 res=0 [ 2736.815128][ T26] audit: type=1804 audit(1572894725.432:16654): pid=20578 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/2014/file0" dev="sda1" ino=16822 res=1 [ 2736.858557][ T26] audit: type=1804 audit(1572894725.482:16655): pid=20586 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/2014/file0" dev="sda1" ino=16822 res=1 19:12:05 executing program 1: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee67, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 19:12:05 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r2, 0x0, 0x0, 0x2000002) 19:12:05 executing program 0: 19:12:05 executing program 0: 19:12:05 executing program 3: 19:12:05 executing program 1: 19:12:08 executing program 3: 19:12:08 executing program 0: 19:12:08 executing program 1: 19:12:08 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:12:08 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d64", 0xe8}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:12:08 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x5}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:12:08 executing program 0: 19:12:08 executing program 3: [ 2739.897339][ T26] audit: type=1800 audit(1572894728.522:16656): pid=20715 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16696 res=0 [ 2739.963910][ T26] audit: type=1804 audit(1572894728.552:16657): pid=20715 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/2015/file0" dev="sda1" ino=16696 res=1 19:12:08 executing program 1: [ 2739.998590][ T26] audit: type=1804 audit(1572894728.622:16658): pid=20722 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/2015/file0" dev="sda1" ino=16696 res=1 19:12:08 executing program 0: 19:12:08 executing program 3: 19:12:09 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r3, &(0x7f0000000000)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(r3, 0x0, 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(r4, &(0x7f0000016600)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) getresgid(&(0x7f0000000180), 0x0, &(0x7f0000000240)) write$binfmt_script(r2, &(0x7f0000000200)=ANY=[@ANYBLOB="a5"], 0x1) close(r2) fallocate(r1, 0x0, 0x40000, 0x4) fallocate(r0, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0xd000000, r1, 0x0, 0x8}) getpeername(r0, 0x0, &(0x7f0000000340)) 19:12:09 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) setsockopt$inet_tcp_int(r1, 0x6, 0x17, &(0x7f0000000080), 0x4) 19:12:09 executing program 0: r0 = inotify_init() ioctl$INOTIFY_IOC_SETNEXTWD(r0, 0x541b, 0x0) [ 2740.912488][ T26] audit: type=1800 audit(1572894729.542:16659): pid=20734 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.1" name=7374617409C0D2FEBCF9DF2DEAC8C177FF171248E91193513049F831550D6F7DE66CF637BDBF1311920C8A26EDA4DCC3783F9DB5116B34D31B0512A5608AAFF01E7952340CD6FD dev="sda1" ino=16665 res=0 19:12:11 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2}, 0x0) sendfile(r0, r1, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xffffffff) 19:12:11 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d64", 0xe8}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:12:11 executing program 2: r0 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000000)=0x80, 0xf9) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000040), 0x4) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs, 0x33) recvmmsg(r0, &(0x7f0000001c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:12:11 executing program 0: r0 = shmget$private(0x0, 0x1000, 0x0, &(0x7f0000ffb000/0x1000)=nil) shmctl$IPC_SET(r0, 0x1, &(0x7f0000000140)) 19:12:11 executing program 3: socket(0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) 19:12:11 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r3, &(0x7f0000000000)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(r3, 0x0, 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(r4, &(0x7f0000016600)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) getresgid(&(0x7f0000000180), 0x0, &(0x7f0000000240)) write$binfmt_script(r2, &(0x7f0000000200)=ANY=[@ANYBLOB="a5"], 0x1) close(r2) fallocate(r1, 0x0, 0x40000, 0x4) fallocate(r0, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0xd000000, r1, 0x0, 0x8}) getpeername(r0, 0x0, &(0x7f0000000340)) [ 2743.043213][ T26] audit: type=1800 audit(1572894731.672:16660): pid=20860 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16838 res=0 19:12:11 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r3, &(0x7f0000000000)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(r3, 0x0, 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(r4, &(0x7f0000016600)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) getresgid(&(0x7f0000000180), 0x0, &(0x7f0000000240)) write$binfmt_script(r2, &(0x7f0000000200)=ANY=[@ANYBLOB="a5"], 0x1) close(r2) fallocate(r1, 0x0, 0x40000, 0x4) fallocate(r0, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0xd000000, r1, 0x0, 0x8}) getpeername(r0, 0x0, &(0x7f0000000340)) [ 2743.127933][ T26] audit: type=1804 audit(1572894731.672:16661): pid=20860 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/2016/file0" dev="sda1" ino=16838 res=1 19:12:11 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d64", 0xe8}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:12:11 executing program 3: socket(0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) [ 2743.218198][ T26] audit: type=1804 audit(1572894731.732:16662): pid=20948 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir090554095/syzkaller.K4h3oo/2016/file0" dev="sda1" ino=16838 res=1 19:12:12 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fc", 0xea}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x91, 0x0, 0xffffffffffffffef}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 19:12:12 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r3, &(0x7f0000000000)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(r3, 0x0, 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(r4, &(0x7f0000016600)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) getresgid(&(0x7f0000000180), 0x0, &(0x7f0000000240)) write$binfmt_script(r2, &(0x7f0000000200)=ANY=[@ANYBLOB="a5"], 0x1) close(r2) fallocate(r1, 0x0, 0x40000, 0x4) fallocate(r0, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0xd000000, r1, 0x0, 0x8}) getpeername(r0, 0x0, &(0x7f0000000340)) 19:12:12 executing program 3: socket(0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) [ 2743.943990][T21084] ================================================================== [ 2743.952136][T21084] BUG: KCSAN: data-race in __wb_calc_thresh / __wb_update_bandwidth [ 2743.960095][T21084] [ 2743.968239][T21084] write to 0xffff8880a9592128 of 8 bytes by task 5272 on cpu 0: [ 2743.975866][T21084] __wb_update_bandwidth+0x277/0x3c0 [ 2743.981236][T21084] wb_update_bandwidth+0x90/0xc0 [ 2743.986162][T21084] wb_writeback+0x21d/0x6a0 [ 2743.990656][T21084] wb_workfn+0x696/0x970 [ 2743.994896][T21084] process_one_work+0x3d4/0x890 [ 2743.999740][T21084] worker_thread+0xa0/0x800 [ 2744.004271][T21084] kthread+0x1d4/0x200 [ 2744.008331][T21084] ret_from_fork+0x1f/0x30 [ 2744.012738][T21084] [ 2744.015062][T21084] read to 0xffff8880a9592128 of 8 bytes by task 21084 on cpu 1: [ 2744.022687][T21084] __wb_calc_thresh+0xdc/0x250 [ 2744.027449][T21084] balance_dirty_pages+0x1187/0x1ba0 [ 2744.032736][T21084] balance_dirty_pages_ratelimited+0x752/0xb40 [ 2744.038890][T21084] fault_dirty_shared_page.isra.0+0x6e/0x100 [ 2744.044861][T21084] __handle_mm_fault+0x212b/0x2c70 [ 2744.049965][T21084] handle_mm_fault+0x21b/0x530 [ 2744.054736][T21084] __do_page_fault+0x3fb/0x9e0 [ 2744.059496][T21084] do_page_fault+0x54/0x233 [ 2744.063997][T21084] page_fault+0x34/0x40 [ 2744.068132][T21084] [ 2744.070450][T21084] Reported by Kernel Concurrency Sanitizer on: [ 2744.076607][T21084] CPU: 1 PID: 21084 Comm: syz-executor.1 Not tainted 5.4.0-rc6+ #0 [ 2744.084482][T21084] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2744.094541][T21084] ================================================================== [ 2744.102596][T21084] Kernel panic - not syncing: panic_on_warn set ... [ 2744.109189][T21084] CPU: 1 PID: 21084 Comm: syz-executor.1 Not tainted 5.4.0-rc6+ #0 [ 2744.117066][T21084] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2744.127109][T21084] Call Trace: [ 2744.130401][T21084] dump_stack+0xf5/0x159 [ 2744.134651][T21084] panic+0x210/0x640 [ 2744.138548][T21084] ? vprintk_func+0x8d/0x140 [ 2744.143150][T21084] kcsan_report.cold+0xc/0xe [ 2744.147743][T21084] kcsan_setup_watchpoint+0x3fe/0x410 [ 2744.153116][T21084] __tsan_read8+0x145/0x1f0 [ 2744.157620][T21084] __wb_calc_thresh+0xdc/0x250 [ 2744.162389][T21084] balance_dirty_pages+0x1187/0x1ba0 [ 2744.167727][T21084] balance_dirty_pages_ratelimited+0x752/0xb40 [ 2744.173892][T21084] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2744.180142][T21084] fault_dirty_shared_page.isra.0+0x6e/0x100 [ 2744.186119][T21084] __handle_mm_fault+0x212b/0x2c70 [ 2744.191232][T21084] ? __perf_event_task_sched_in+0x14d/0x390 [ 2744.197129][T21084] handle_mm_fault+0x21b/0x530 [ 2744.201898][T21084] __do_page_fault+0x3fb/0x9e0 [ 2744.206664][T21084] do_page_fault+0x54/0x233 [ 2744.211252][T21084] ? prepare_exit_to_usermode+0x154/0x1a0 [ 2744.216968][T21084] page_fault+0x34/0x40 [ 2744.221120][T21084] RIP: 0033:0x401b97 [ 2744.225019][T21084] Code: 00 00 00 48 83 ec 08 48 8b 15 9d 06 67 00 48 8b 05 8e 06 67 00 48 39 d0 48 8d 8a 00 00 00 01 72 17 48 39 c8 73 12 48 8d 50 04 <89> 38 48 89 15 70 06 67 00 48 83 c4 08 c3 48 89 c6 bf c0 ad 4c 00 [ 2744.244613][T21084] RSP: 002b:00007ffd3fda9690 EFLAGS: 00010287 [ 2744.250675][T21084] RAX: 0000001b2fb25000 RBX: 000000007e456334 RCX: 0000001b30b20000 [ 2744.258639][T21084] RDX: 0000001b2fb25004 RSI: 0000000000000f6f RDI: ffffffff3c460f6d [ 2744.266604][T21084] RBP: 000000000000003e R08: 000000003c460f6d R09: 000000003c460f71 [ 2744.274569][T21084] R10: 00007ffd3fda9840 R11: 0000000000000246 R12: 000000000075bfa8 [ 2744.282533][T21084] R13: 0000000080000000 R14: 00007f583a83c008 R15: 0000000000001049 [ 2744.291929][T21084] Kernel Offset: disabled [ 2744.296259][T21084] Rebooting in 86400 seconds..