{[{@privport='privport'}]}}) prctl$PR_SET_ENDIAN(0x14, 0xaee7f346ebc48fd4) open_by_handle_at(r0, &(0x7f0000000f40)=ANY=[], 0x0) sendmsg$TIPC_NL_BEARER_GET(0xffffffffffffffff, 0x0, 0x30040002) r1 = open(&(0x7f0000000100)='./file1\x00', 0x143042, 0xe2691e1f337fb66b) sendmsg$TIPC_CMD_GET_NETID(r1, &(0x7f0000000ec0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20001044}, 0x800) dup2(0xffffffffffffffff, r1) renameat2(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', 0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', 0x0) pipe2$9p(0x0, 0x800) openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000500)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ioctl$KVM_GET_SUPPORTED_CPUID(r2, 0xc008ae05, &(0x7f0000000080)=""/62) r3 = socket$netlink(0x10, 0x3, 0x0) writev(r3, &(0x7f00000001c0)=[{&(0x7f00000002c0)}], 0x1) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) write$P9_RSETATTR(r1, &(0x7f0000001200)={0x7, 0x1b, 0x2}, 0x7) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x12, 0x0, 0x0, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0xf, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x74) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, 0x0, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000f00)=0x8, 0x4) r4 = socket(0x8000000010, 0x2, 0x0) chmod(&(0x7f0000000240)='./file0\x00', 0x4) write(r4, &(0x7f0000000000)="fc0000001c000706ab092506b86807020aab087a0500000005000a93210001c0f00200fffffff0010000000000039815fa2c1ec28648000000b9d95662070000bc000c00f0036cdf0d11512fd633d440000400600720d3d5bbc91a3e2e80772c05dafd5a32e273fc83ab82d718f74cec18444ef90d475ef8b29d3ef3d92c83170e5bba2e177312e081bea05d44021e8ca062914a463ae4f5df77bc4cb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd0734ba3dffe5f5aa1dd1890058a10000c880ac801fe4af000041f0d48f6f0000080548deac279cc4848e3825924509260e26429fbe11017d627403050efaddd3254395c500", 0xfc) 16:07:21 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:21 executing program 2: open(&(0x7f00000000c0)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x0, 0x0) syz_mount_image$ext4(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x38b69be, &(0x7f0000000380)={[{@mblk_io_submit='mblk_io_submit'}]}) 16:07:21 executing program 5: mknod(&(0x7f00000005c0)='./bus\x00', 0x8, 0x0) lsetxattr$security_capability(&(0x7f00000000c0)='./bus\x00', &(0x7f0000000100)='security.capability\x00', &(0x7f0000000140)=@v2={0x2000000, [{}, {0xfffffffc}]}, 0x14, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r1) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f00000001c0)='./bus\x00', 0x0, 0x0) [ 238.854060] 9pnet: p9_fd_create_tcp (9513): problem connecting socket to 127.0.0.1 16:07:21 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) [ 239.009049] 9pnet: p9_fd_create_tcp (9552): problem connecting socket to 127.0.0.1 16:07:23 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:07:23 executing program 2: open(&(0x7f00000000c0)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x0, 0x0) syz_mount_image$ext4(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x38b69be, &(0x7f0000000380)={[{@mblk_io_submit='mblk_io_submit'}]}) 16:07:23 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x30002}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$9p_tcp(&(0x7f0000000040)='127.0.0.1\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000200)={'trans=tcp,', {'port'}, 0x2c, {[{@privport='privport'}]}}) prctl$PR_SET_ENDIAN(0x14, 0xaee7f346ebc48fd4) open_by_handle_at(r0, &(0x7f0000000f40)=ANY=[], 0x0) sendmsg$TIPC_NL_BEARER_GET(0xffffffffffffffff, 0x0, 0x30040002) r1 = open(&(0x7f0000000100)='./file1\x00', 0x143042, 0xe2691e1f337fb66b) sendmsg$TIPC_CMD_GET_NETID(r1, &(0x7f0000000ec0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20001044}, 0x800) dup2(0xffffffffffffffff, r1) renameat2(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', 0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', 0x0) pipe2$9p(0x0, 0x800) openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000500)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ioctl$KVM_GET_SUPPORTED_CPUID(r2, 0xc008ae05, &(0x7f0000000080)=""/62) r3 = socket$netlink(0x10, 0x3, 0x0) writev(r3, &(0x7f00000001c0)=[{&(0x7f00000002c0)}], 0x1) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) write$P9_RSETATTR(r1, &(0x7f0000001200)={0x7, 0x1b, 0x2}, 0x7) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x12, 0x0, 0x0, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0xf, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x74) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, 0x0, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000f00)=0x8, 0x4) r4 = socket(0x8000000010, 0x2, 0x0) chmod(&(0x7f0000000240)='./file0\x00', 0x4) write(r4, &(0x7f0000000000)="fc0000001c000706ab092506b86807020aab087a0500000005000a93210001c0f00200fffffff0010000000000039815fa2c1ec28648000000b9d95662070000bc000c00f0036cdf0d11512fd633d440000400600720d3d5bbc91a3e2e80772c05dafd5a32e273fc83ab82d718f74cec18444ef90d475ef8b29d3ef3d92c83170e5bba2e177312e081bea05d44021e8ca062914a463ae4f5df77bc4cb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd0734ba3dffe5f5aa1dd1890058a10000c880ac801fe4af000041f0d48f6f0000080548deac279cc4848e3825924509260e26429fbe11017d627403050efaddd3254395c500", 0xfc) 16:07:23 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:23 executing program 0: r0 = socket$packet(0x11, 0x2, 0x300) poll(&(0x7f0000000080)=[{r0}], 0x1, 0x1ff) close(r0) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000088044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) bind$packet(r0, &(0x7f0000000040)={0x11, 0x3, r2, 0x1, 0x0, 0x6, @random="be18ebc839f3"}, 0x14) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") 16:07:23 executing program 5: mknod(&(0x7f00000005c0)='./bus\x00', 0x8, 0x0) lsetxattr$security_capability(&(0x7f00000000c0)='./bus\x00', &(0x7f0000000100)='security.capability\x00', &(0x7f0000000140)=@v2={0x2000000, [{}, {0xfffffffc}]}, 0x14, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r1) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f00000001c0)='./bus\x00', 0x0, 0x0) 16:07:23 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:24 executing program 5: mknod(&(0x7f00000005c0)='./bus\x00', 0x8, 0x0) lsetxattr$security_capability(&(0x7f00000000c0)='./bus\x00', &(0x7f0000000100)='security.capability\x00', &(0x7f0000000140)=@v2={0x2000000, [{}, {0xfffffffc}]}, 0x14, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r1) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(0x0, 0x0, 0x0) 16:07:24 executing program 2: open(&(0x7f00000000c0)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, 0x0, 0x0, 0x0, 0x0, 0x38b69be, &(0x7f0000000380)={[{@mblk_io_submit='mblk_io_submit'}]}) [ 241.715265] protocol 88fb is buggy, dev hsr_slave_0 [ 241.720437] protocol 88fb is buggy, dev hsr_slave_1 16:07:24 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) [ 241.770659] 9pnet: p9_fd_create_tcp (9680): problem connecting socket to 127.0.0.1 [ 241.795257] protocol 88fb is buggy, dev hsr_slave_0 [ 241.800466] protocol 88fb is buggy, dev hsr_slave_1 16:07:24 executing program 5: mknod(&(0x7f00000005c0)='./bus\x00', 0x8, 0x0) lsetxattr$security_capability(&(0x7f00000000c0)='./bus\x00', &(0x7f0000000100)='security.capability\x00', &(0x7f0000000140)=@v2={0x2000000, [{}, {0xfffffffc}]}, 0x14, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r1) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(0x0, 0x0, 0x0) 16:07:24 executing program 3: mmap(&(0x7f0000bfd000/0x400000)=nil, 0x400000, 0x2000009, 0x400000000008a032, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000bfd000/0x400000)=nil, 0x400000, 0x0, 0x8a031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x45732b8b69028a71, 0xffffffffffffffff, 0x0) 16:07:27 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:27 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:07:27 executing program 2: open(&(0x7f00000000c0)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, 0x0, 0x0, 0x0, 0x0, 0x38b69be, &(0x7f0000000380)={[{@mblk_io_submit='mblk_io_submit'}]}) 16:07:27 executing program 5: mknod(&(0x7f00000005c0)='./bus\x00', 0x8, 0x0) lsetxattr$security_capability(&(0x7f00000000c0)='./bus\x00', &(0x7f0000000100)='security.capability\x00', &(0x7f0000000140)=@v2={0x2000000, [{}, {0xfffffffc}]}, 0x14, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r1) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(0x0, 0x0, 0x0) 16:07:27 executing program 3: r0 = socket(0x10, 0x80002, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xf, 0x3, &(0x7f0000000280)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0xf, 0x27}}, &(0x7f0000000140)='GPL\x00', 0x1, 0xfc76, &(0x7f0000000180)=""/153, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000040), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffe77}, 0x48) 16:07:27 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8478071") r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f0000000040)=[{&(0x7f0000000000)="290000002000190f00003fffffffda060200000000e80001dd0000040d000600ea1100000005000000", 0x29}], 0x1) recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$SEG6_CMD_SET_TUNSRC(0xffffffffffffffff, 0x0, 0x0) [ 244.784539] netlink: 'syz-executor.0': attribute type 6 has an invalid length. 16:07:27 executing program 2: open(&(0x7f00000000c0)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, 0x0, 0x0, 0x0, 0x0, 0x38b69be, &(0x7f0000000380)={[{@mblk_io_submit='mblk_io_submit'}]}) 16:07:27 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:27 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 244.879302] netlink: 'syz-executor.0': attribute type 6 has an invalid length. 16:07:27 executing program 3: 16:07:27 executing program 0: 16:07:27 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:27 executing program 2: open(&(0x7f00000000c0)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)={[{@mblk_io_submit='mblk_io_submit'}]}) 16:07:30 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:07:30 executing program 0: 16:07:30 executing program 3: 16:07:30 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:07:30 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:30 executing program 2: open(&(0x7f00000000c0)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)={[{@mblk_io_submit='mblk_io_submit'}]}) 16:07:30 executing program 3: 16:07:30 executing program 0: 16:07:30 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, 0x0) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:30 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:07:30 executing program 2: open(&(0x7f00000000c0)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)={[{@mblk_io_submit='mblk_io_submit'}]}) 16:07:30 executing program 3: mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) chdir(&(0x7f0000000280)='./file0\x00') r0 = creat(&(0x7f0000000080)='./file1\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x8020003) 16:07:33 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:07:33 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000040)={0x41}, 0x10) r3 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r3, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:33 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, 0x0) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:33 executing program 3: socketpair$unix(0x1, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$TIOCSRS485(0xffffffffffffffff, 0x542f, &(0x7f0000000240)) socketpair$unix(0x1, 0x1, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x1000014, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) set_tid_address(0x0) open(0x0, 0x0, 0x0) r2 = open$dir(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) write(r1, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae6", 0x1ca) perf_event_open(&(0x7f0000000440)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r2, 0x0, 0x7fffffa7) 16:07:33 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:07:33 executing program 2: open(&(0x7f00000000c0)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x38b69be, 0x0) 16:07:33 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, 0x0) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:33 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000040)={0x41}, 0x10) r3 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r3, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) [ 251.228909] EXT4-fs (sda1): re-mounted. Opts: [ 251.247376] audit: type=1800 audit(1578672453.571:51): pid=10020 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor.3" name="file0" dev="loop3" ino=4 res=0 16:07:33 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 251.303642] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 17) [ 251.314863] FAT-fs (loop3): Filesystem has been set read-only [ 251.321332] audit: type=1804 audit(1578672453.581:52): pid=10020 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir750286331/syzkaller.1tpX84/48/file0/file0" dev="loop3" ino=4 res=1 16:07:33 executing program 2: open(&(0x7f00000000c0)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x38b69be, 0x0) 16:07:33 executing program 3: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000040)={0x41}, 0x10) r3 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r3, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:33 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=']) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:33 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:07:33 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000040)={0x41}, 0x10) r3 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r3, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:34 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:07:34 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=']) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) [ 251.657436] EXT4-fs (sda1): re-mounted. Opts: 16:07:36 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:07:36 executing program 3: setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@ipv4={[], [], @empty}, @in=@remote}}, {{@in=@multicast2}, 0x0, @in=@empty}}, 0xe8) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt(r0, 0x8000000ff, 0x7, &(0x7f0000000000), 0x260) 16:07:36 executing program 2: open(&(0x7f00000000c0)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x38b69be, 0x0) 16:07:36 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000040)={0x41}, 0x10) r3 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r3, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:36 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:07:36 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=']) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) [ 254.448463] EXT4-fs (sda1): re-mounted. Opts: 16:07:36 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:07:36 executing program 3: r0 = socket$inet6(0xa, 0x80803, 0x1) sendmmsg$inet6(r0, &(0x7f0000000680)=[{{&(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2={0xfc}}, 0x1c, 0x0}}], 0x1, 0x0) 16:07:36 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:36 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000040)={0x41}, 0x10) r3 = socket$tipc(0x1e, 0x2, 0x0) sendmsg$tipc(r3, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:36 executing program 2: open(&(0x7f00000000c0)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x38b69be, &(0x7f0000000380)) 16:07:37 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000040)={0x41}, 0x10) r3 = socket$tipc(0x1e, 0x2, 0x0) sendmsg$tipc(r3, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) [ 254.803849] EXT4-fs (sda1): re-mounted. Opts: 16:07:39 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(0x0, 0x1000000000016) r2 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r2, r0) 16:07:39 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:07:39 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000040)={0x41}, 0x10) r3 = socket$tipc(0x1e, 0x2, 0x0) sendmsg$tipc(r3, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:39 executing program 3: r0 = memfd_create(&(0x7f0000000880)='#em1#+\x00', 0x0) write(r0, &(0x7f0000000040)="0600", 0x2) sendfile(r0, r0, &(0x7f00000000c0), 0xfeff) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x80000000004, 0x11, r0, 0x0) keyctl$KEYCTL_PKEY_DECRYPT(0x1c, &(0x7f0000001cc0), &(0x7f0000001d00)={'enc=', 'raw', ' hash=', {'sha3-384-ce\x00'}}, 0x0, 0x0) 16:07:39 executing program 2: open(&(0x7f00000000c0)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x38b69be, &(0x7f0000000380)) 16:07:39 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:40 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) [ 257.655661] EXT4-fs (sda1): re-mounted. Opts: 16:07:40 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:07:40 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000040)={0x41}, 0x10) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) [ 257.690907] audit: type=1400 audit(1578672460.011:53): avc: denied { map } for pid=10125 comm="syz-executor.3" path=2F6D656D66643A23656D31232B202864656C6574656429 dev="tmpfs" ino=36259 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:tmpfs_t:s0 tclass=file permissive=1 16:07:40 executing program 2: open(&(0x7f00000000c0)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x38b69be, &(0x7f0000000380)) 16:07:40 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000040)={0x41}, 0x10) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:40 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 257.954116] EXT4-fs (sda1): re-mounted. Opts: 16:07:40 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(0x0, 0x1000000000016) r2 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r2, r0) 16:07:40 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:40 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000040)={0x41}, 0x10) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:40 executing program 3: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000000080)='./file0\x00', 0x1070c5, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = open$dir(&(0x7f0000000380)='./file0\x00', 0x8000000000006000, 0x0) write$9p(r1, &(0x7f0000001400)="3b27a4b46ee92b4a59073c369a5e19f9db153c4fdbc76aa2a4bb9f3e5e1aa197a9e97d1016c01813792e50c2692c175aad715d110a892949ccc6e2e54c2d5c8f0b7932b69797f217168b0c1feb128ae34f0daf487a70b5c117acd43725fe17993634f1695dabd7f998cd55e9d5bd911e86aa7a4ad75a574bb96951d6018b25d942a9544bca1ebb0e8d10c092cdcb85797673972099e4041aaf8d636f66cb1103ef2050ad28fabaed33d6927889d97f4b5ce0de71d3fd832980f4f088d0d824e20549b4bbd906ffa51ce9de54d779eb4de462faac20a3ab0ed9934373ca22cea5454f4c2a740cd461e39956bb5f98df2aebc60cf32623adbffbcc378fa7250b6a3fc863dadcf6d4f8b855c4e70f0796eee6218445dad2811dd6b540ff52efa2f167dd9c1b8b016268d37db430983fefc0645d20614c8df2eb0872c58e09664e672b0b6a9970fec199257e1c606ec3e364c66a0f4d258c74accd43b987c756d602fd8787fed3aa43fd8d84e9656d4a413fa9a423bc54b873583d6d497005e54712fafc71384988d80134fbf84f53fdd74b354848006b8b5b67e7cc5a472475d3ae545ca1fcf7628b873e31ba83a98a7ad5b0cfbe9711b517a9a1388ad0efa2a3b4e22152021d631b731e2e100a9831111db7acce948bb5deeea260463c140ac929e77c58402776caf85d4569a75dde2f64c4491508afb541ed9b2c81fc95c06706235f383e31cf662c95b1e49cfd94871e22720a41535756e419b271276941692bd023dd9c9dbec4f7db1e5c00d8b3be7b8e826a6aadd001edd0dfeb00f8048442b5c48456fd642e629dcb2ff55592665ff491cd832672ce4d999da186db2c3a1f8b6b1f7d3750d7cdb3097954e6e14fb2183ad662c63d4ce8b82dc2487f0fe2ea2827b53a7c6dcced878d2fb29c1d3ff583570e7bc172d1a5c716e0447cb08ce3c468ffdf975da372f3f3eb455aaf5822bc04a51b6cad24a2331369df81c123b009a2381b42e9aeb077f621608d81c12a5f5c6c295d74afd4dd5c051296be0b54c70bf899b347c36bff62f313079983409d7f9cf1242c917985c1b5d0736fe21f8514f63d0369a374c42da40bd5140bc3e602d00c3cb4f8e621863ab47422778d67d72de34753fd72cef80649a1548e4e8dcbcffe4054cc9d8a1f922623a75904cbdaacde768131e587269a4a99d82f7009c1b8ab79aa232a2fd45ad71b603803123f6ba979fa6a87525884b08d721a21400fb1f950b96ead82f408cc4388d3b78fb456616429a520656d5e5a876fd04748498902c86f58d45f4c1b3919eb846a00edf07e7a830bf723e4774f085f15534dd3b5246c0c0970b5ad7bb39b30b156a9430378c5b0aab1261c78d72ac301cd552d5e8dd4b642ec1dc0672745d593bb26d095b5b23576e3cfd6ab580f6e09419d0f0c64250fafaa3759aa1888da48d89c3f7c9454b0b3d0ab40445f5bed4493ef43ab08f31b1345ac4ffd94ad79c9eee53904ed6f572817153190d2e6863f2e39356bb99926419fd314341a536b7e76cae60bf7750a4c29e3f4c7f005530b1d4ee0e25b93b76fcc1108222f0b00de52cf4100e97adfd7b9db1370586ba27e1e183299be00d0df8439c380edf2f79deb441eac59b814b04accdff5e17f02046139f91f0332661676ff506e575f0cb2850bcc9f8666f6d1f69f8f4271cb804a79fccd7016f049d1a494c26a527c437fa0be6d51ec7543d9bd7a2f016194ebe3c99080a6c9b5119863dfe865f8e60cae29f50b67dbfaa0a3c9794d73034485ca1613344c572783db3dfab01b28089c51cda99cefa4c1c881a29e229f04c7e0fd04dc425ae8417852e6e31520c6207e9d4e35285feef2a2cb8a3bceb08a166fa4284a516362621e2c06731a442791f1db063a32cf1f005c914102c7273cb4d7ab1bf567d72f230783d2ea99c43a60e8729132441ee6c5362c33f9b613f84417c3c5549f4e3d9e73c6f83f16c8e57ae22fe5f54515e111fe43ad7c400d214281452bb6141cecad84b23a695f061988d906d03be5d89584634b9e9d9a9b072f8e7cbb47c47719318a2001cafa665dd2c82672d16877ea115bd023fc1975f7c59664bfb06f66a1a5e3f05cb283fb45ea67a2727ee6e10bf35b31fdd03d43ec67b753f6737e0d2f4a5275031595878cefc8f0ca", 0x600) sendfile(r1, r2, 0x0, 0x10000) 16:07:40 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:07:40 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000740)='./file0\x00', 0x0) mkdir(&(0x7f0000000280)='./file1\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f0000000040)={0x0, 0x0, 0x51, 0x0, 0x0, [{}, {}]}) 16:07:40 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:40 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) socket$tipc(0x1e, 0x5, 0x0) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:40 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(0x0, 0x1000000000016) r2 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r2, r0) 16:07:40 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) r3 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:07:40 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:40 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:41 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_submit(0x0, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r1 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r1, 0x1000000000016) r2 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r2, r0) [ 258.662297] audit: type=1804 audit(1578672460.981:54): pid=10190 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir750286331/syzkaller.1tpX84/53/file0/file0" dev="loop3" ino=5 res=1 [ 258.696386] overlayfs: failed to resolve './file1': -2 16:07:41 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) r3 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 258.743768] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 258.744448] audit: type=1800 audit(1578672461.031:55): pid=10190 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor.3" name="file0" dev="loop3" ino=5 res=0 16:07:41 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',grou', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) [ 258.805296] FAT-fs (loop3): Filesystem has been set read-only [ 258.826004] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 17) [ 258.896083] overlayfs: conflicting lowerdir path 16:07:41 executing program 3: mkdir(&(0x7f0000000100)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400002, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f0000000280)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}, {@workdir={'workdir', 0x3d, './file0'}}, {@xino_auto='xino=auto'}]}) 16:07:41 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) socket$tipc(0x1e, 0x5, 0x0) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r1, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:41 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) r3 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:07:41 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_submit(0x0, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r1 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r1, 0x1000000000016) r2 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r2, r0) 16:07:41 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000740)='./file0\x00', 0x0) mkdir(&(0x7f0000000280)='./file1\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f0000000040)={0x0, 0x0, 0x51, 0x0, 0x0, [{}, {}]}) 16:07:41 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',grou', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:41 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:07:41 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_submit(0x0, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r1 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r1, 0x1000000000016) r2 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r2, r0) 16:07:41 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) socket$tipc(0x1e, 0x5, 0x0) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r1, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:41 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',grou', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:41 executing program 3: perf_event_open(&(0x7f0000000040)={0x1000000000004, 0xfffffffffffffe23, 0x3, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x2, 0x7fffffff}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000005100)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) read$FUSE(r0, &(0x7f00000040c0), 0x1000) read$FUSE(r0, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000fc0)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000500)={&(0x7f0000000440)={0x10, 0xf0ffffff}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)=@delneigh={0x28, 0x1c, 0x1, 0x0, 0x0, {0x7, 0x0, 0x0, r2, 0x0, 0xf0ffffff}, [@NDA_LLADDR={0xa, 0x2, @empty=[0xf0ffffff]}]}, 0x28}}, 0x0) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='memory.stat\x00', 0x0, 0x0) r4 = ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82) ioctl$LOOP_CTL_ADD(0xffffffffffffffff, 0x4c80, r4) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/loop-control\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x0, 0x70, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x80}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000140)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0x100000000000e000, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb64c86d6b66732e66617400020441000500077008f8", 0x16}], 0x0, 0x0) getegid() open(&(0x7f0000000080)='./file0/f.le0\xf0', 0x40003ffd, 0x0) write$cgroup_type(0xffffffffffffffff, &(0x7f0000000180)='threaded\x00', 0xffffff43) readlink(&(0x7f0000001580)='./file0/file0\x00', &(0x7f0000000480)=""/4096, 0x1000) mount$fuseblk(&(0x7f00000002c0)='/dev/loop0\x00', &(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='fuseblk\x00', 0x21, &(0x7f0000001680)=ANY=[]) 16:07:41 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:07:41 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) socket$tipc(0x1e, 0x5, 0x0) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r1, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:41 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) [ 259.424929] overlayfs: failed to resolve './file0': -2 16:07:41 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:07:41 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_i', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:42 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x8, 0x4, &(0x7f0000000100)=ANY=[@ANYBLOB="b40500000000000071107500000000001d00000000000000950000000000000066490a80b955dcbf7f8c415e61b150af0b1a2c022e42351cbc4db97c749581aa9fc93da4a05a8ff62a3ca6685473ec41a80ad5ac41626a5dc590f0a9eaff93f55be5cd137dd9f9fba0bc14a22fbf159cea9e27d7053affb68b713cefd433c48a0816"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/190, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffd06, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) 16:07:42 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r1, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:42 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:07:42 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r1, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r2, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r2, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r1, 0x0, 0x10005, 0x0) 16:07:42 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_i', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:42 executing program 3: r0 = socket(0x10, 0x400000000080803, 0x0) fcntl$setstatus(r0, 0x4, 0x2400) write(r0, &(0x7f0000000240)="241400001a0025f00485bc04fef7001d", 0x10) 16:07:42 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r1, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:42 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f00000000c0)='./file0\x00', 0x4e200, 0x0) write(r1, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r2, 0x0, 0x7fffffa7) 16:07:42 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_i', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:42 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r1, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:42 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) [ 260.110783] audit: type=1800 audit(1578672462.431:56): pid=10293 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor.2" name="file0" dev="loop2" ino=7 res=0 16:07:42 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB=',lowerdir=.:file0,workdir=.']) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000140)=""/65, 0x25f) [ 260.183867] audit: type=1804 audit(1578672462.431:57): pid=10293 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir934736970/syzkaller.JwVWG1/65/file0/file0" dev="loop2" ino=7 res=1 16:07:42 executing program 0: socket$tipc(0x1e, 0x5, 0x0) r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r1, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:42 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) [ 260.248013] audit: type=1800 audit(1578672462.431:58): pid=10293 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor.2" name="file0" dev="loop2" ino=7 res=0 [ 260.313391] overlayfs: option "workdir=." is useless in a non-upper mount, ignore 16:07:42 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) [ 260.386658] overlayfs: option "workdir=.ubtree_control" is useless in a non-upper mount, ignore 16:07:43 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r1, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r2, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r2, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r1, 0x0, 0x10005, 0x0) 16:07:43 executing program 0: socket$tipc(0x1e, 0x5, 0x0) r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r1, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:43 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:43 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) sendmsg$TIPC_NL_BEARER_ADD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f00000000c0), 0xc, 0x0}, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r0, 0x401c5820, &(0x7f00000000c0)) [ 260.888165] audit: type=1804 audit(1578672463.211:59): pid=10336 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir934736970/syzkaller.JwVWG1/65/file0/file0" dev="loop2" ino=7 res=1 [ 260.906493] overlayfs: filesystem on './file0' not supported as upperdir 16:07:43 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f00000000c0)='./file0\x00', 0x4e200, 0x0) write(r1, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r2, 0x0, 0x7fffffa7) 16:07:43 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:07:43 executing program 0: socket$tipc(0x1e, 0x5, 0x0) r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r1, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:43 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) [ 260.929082] audit: type=1804 audit(1578672463.241:60): pid=10339 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir934736970/syzkaller.JwVWG1/65/file0/file0" dev="loop2" ino=7 res=1 16:07:43 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000008c0)='./file0\x00', 0x0, 0x0) ftruncate(r1, 0x28007d) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000d83ff8), 0x2008000fffffffe) ioctl$PIO_UNISCRNMAP(r1, 0x4b6a, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r3 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r3, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r3, r3, &(0x7f00000001c0), 0x8080fffffffe) r4 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r4, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r4, r4, &(0x7f00000001c0), 0x8080fffffffe) ioctl$TIOCGDEV(0xffffffffffffffff, 0x80045432, &(0x7f0000000100)) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) fcntl$F_SET_RW_HINT(r2, 0x40c, 0x0) 16:07:43 executing program 0: setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r1, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:43 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:43 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) [ 261.242720] audit: type=1800 audit(1578672463.551:61): pid=10354 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor.2" name="file0" dev="loop2" ino=8 res=0 [ 261.309968] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 261.346492] audit: type=1804 audit(1578672463.561:62): pid=10354 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir934736970/syzkaller.JwVWG1/66/file0/file0" dev="loop2" ino=8 res=1 [ 261.351560] FAT-fs (loop3): Filesystem has been set read-only [ 261.405581] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) [ 261.441472] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 261.457982] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:07:43 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:43 executing program 0: setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r1, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:43 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r1, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r2, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r2, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r1, 0x0, 0x10005, 0x0) 16:07:43 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r0, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3}]) r1 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r1, 0x1000000000016) r2 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r2, 0xffffffffffffffff) 16:07:44 executing program 2: r0 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r0, 0xc2604110, &(0x7f0000000400)={0x0, [[0x800], [0x7ff], [0x20]], [], [{0x0, 0x64}, {0x8, 0x9d19}, {0x803, 0x0, 0x0, 0x1}], [], 0x400}) 16:07:44 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000008c0)='./file0\x00', 0x0, 0x0) ftruncate(r1, 0x28007d) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000d83ff8), 0x2008000fffffffe) ioctl$PIO_UNISCRNMAP(r1, 0x4b6a, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r3 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r3, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r3, r3, &(0x7f00000001c0), 0x8080fffffffe) r4 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r4, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r4, r4, &(0x7f00000001c0), 0x8080fffffffe) ioctl$TIOCGDEV(0xffffffffffffffff, 0x80045432, &(0x7f0000000100)) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) fcntl$F_SET_RW_HINT(r2, 0x40c, 0x0) 16:07:44 executing program 0: setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r1, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:44 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:44 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r0, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3}]) r1 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r1, 0x1000000000016) r2 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r2, 0xffffffffffffffff) 16:07:44 executing program 0: r0 = socket$tipc(0x1e, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:44 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) [ 262.082801] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 262.091352] FAT-fs (loop3): Filesystem has been set read-only 16:07:44 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r0, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3}]) r1 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r1, 0x1000000000016) r2 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r2, 0xffffffffffffffff) [ 262.134824] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:07:44 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:44 executing program 0: r0 = socket$tipc(0x1e, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) [ 262.261752] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 262.289269] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:07:44 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:07:44 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x31, &(0x7f0000000140)=0x2, 0x4) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r0, &(0x7f0000004f40)=[{{&(0x7f0000000180)=@pppol2tpv3in6, 0x80, &(0x7f0000001700)=[{&(0x7f00000002c0)=""/184, 0xb8}, {&(0x7f0000000380)=""/193, 0xc1}, {&(0x7f0000000480)=""/220, 0xdc}, {&(0x7f0000000580)=""/106, 0x6a}, {&(0x7f0000000600)=""/208, 0xd0}, {&(0x7f0000000700)=""/4096, 0x1000}], 0x6, &(0x7f0000001780)=""/4096, 0x1000}}, {{&(0x7f0000002780)=@pptp={0x18, 0x2, {0x0, @local}}, 0x80, &(0x7f0000000200)=[{&(0x7f0000002800)=""/88, 0x58}, {&(0x7f0000002880)=""/209, 0xd1}, {&(0x7f0000002980)=""/220, 0xdc}, {&(0x7f0000000100)=""/48, 0x30}], 0x4, &(0x7f0000002a80)=""/16, 0xe}}, {{&(0x7f0000002ac0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80, &(0x7f0000004dc0)=[{&(0x7f0000002b40)=""/4096, 0x1000}, {&(0x7f0000003b40)=""/170, 0xaa}, {&(0x7f0000003c00)=""/4096, 0x1000}, {&(0x7f0000004c00)=""/27, 0x1b}, {&(0x7f0000004c40)=""/95, 0x5f}, {&(0x7f0000004cc0)=""/243, 0xf3}], 0x10000279, &(0x7f0000004e40)=""/243, 0xf3}}], 0x3, 0x44000102, 0x0) 16:07:44 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:44 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000008c0)='./file0\x00', 0x0, 0x0) ftruncate(r1, 0x28007d) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000d83ff8), 0x2008000fffffffe) ioctl$PIO_UNISCRNMAP(r1, 0x4b6a, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r3 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r3, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r3, r3, &(0x7f00000001c0), 0x8080fffffffe) r4 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r4, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r4, r4, &(0x7f00000001c0), 0x8080fffffffe) ioctl$TIOCGDEV(0xffffffffffffffff, 0x80045432, &(0x7f0000000100)) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) fcntl$F_SET_RW_HINT(r2, 0x40c, 0x0) 16:07:44 executing program 0: r0 = socket$tipc(0x1e, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:44 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:07:44 executing program 0: socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r1, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) [ 262.563670] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 16:07:44 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:45 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:07:45 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:07:45 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) symlink(&(0x7f0000000040)='./file1\x00', &(0x7f0000000000)='.//ile0\x00') syz_genetlink_get_family_id$tipc2(0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x16a) mount$overlay(0x400000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), 0x0) renameat(0xffffffffffffffff, &(0x7f0000000180)='.//ile0\x00', r0, 0x0) ioctl$EXT4_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)=0x40a0) 16:07:45 executing program 0: socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r1, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) [ 262.803674] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) 16:07:45 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:45 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 262.852262] FAT-fs (loop3): Filesystem has been set read-only [ 262.872779] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:07:45 executing program 0: socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r1, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) [ 262.960496] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 262.999258] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) [ 263.043910] overlayfs: conflicting lowerdir path 16:07:45 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:07:45 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000008c0)='./file0\x00', 0x0, 0x0) ftruncate(r1, 0x28007d) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000d83ff8), 0x2008000fffffffe) ioctl$PIO_UNISCRNMAP(r1, 0x4b6a, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r3 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r3, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r3, r3, &(0x7f00000001c0), 0x8080fffffffe) r4 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r4, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r4, r4, &(0x7f00000001c0), 0x8080fffffffe) ioctl$TIOCGDEV(0xffffffffffffffff, 0x80045432, &(0x7f0000000100)) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) fcntl$F_SET_RW_HINT(r2, 0x40c, 0x0) 16:07:45 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:45 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) close(0xffffffffffffffff) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) r2 = socket$inet(0x2, 0x3, 0x7f) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r2, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r2, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x10005, 0x0) 16:07:45 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, 0x0, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) [ 263.163674] overlayfs: conflicting lowerdir path 16:07:45 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) symlink(&(0x7f0000000040)='./file1\x00', &(0x7f0000000000)='.//ile0\x00') syz_genetlink_get_family_id$tipc2(0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x16a) mount$overlay(0x400000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), 0x0) renameat(0xffffffffffffffff, &(0x7f0000000180)='.//ile0\x00', r0, 0x0) ioctl$EXT4_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)=0x40a0) 16:07:45 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:45 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) close(0xffffffffffffffff) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) r2 = socket$inet(0x2, 0x3, 0x7f) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r2, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r2, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x10005, 0x0) 16:07:45 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, 0x0, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:45 executing program 4: mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:07:45 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, 0x0, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:45 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) close(0xffffffffffffffff) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) r2 = socket$inet(0x2, 0x3, 0x7f) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r2, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r2, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x10005, 0x0) 16:07:45 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) [ 263.550270] overlayfs: conflicting lowerdir path 16:07:46 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000008c0)='./file0\x00', 0x0, 0x0) ftruncate(r1, 0x28007d) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000d83ff8), 0x2008000fffffffe) ioctl$PIO_UNISCRNMAP(r1, 0x4b6a, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r3 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r3, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r3, r3, &(0x7f00000001c0), 0x8080fffffffe) r4 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r4, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r4, r4, &(0x7f00000001c0), 0x8080fffffffe) ioctl$TIOCGDEV(0xffffffffffffffff, 0x80045432, &(0x7f0000000100)) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) 16:07:46 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900), 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:46 executing program 4: mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:07:46 executing program 2: mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) chdir(&(0x7f0000000280)='./file0\x00') r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x80086603, &(0x7f0000000400)) 16:07:46 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) write$binfmt_elf32(0xffffffffffffffff, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) r1 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r1, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r1, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x10005, 0x0) 16:07:46 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:46 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=0000000000000000004000', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:46 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) write$binfmt_elf32(0xffffffffffffffff, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) r1 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r1, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r1, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x10005, 0x0) 16:07:46 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', 0x0, 0x800000000e004, 0x0, 0x0, 0x0, 0x0) open(0x0, 0x200000, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f0000000040), 0x4) ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, 0x0) getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x65, 0x0, 0x0) mount$bpf(0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)=ANY=[@ANYBLOB]) write$binfmt_elf64(0xffffffffffffffff, 0x0, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) io_setup(0x2, &(0x7f0000000000)=0x0) io_submit(r0, 0x1, &(0x7f0000000300)=[&(0x7f00000002c0)={0x0, 0x0, 0x0, 0x933313f415ba6da6, 0x4b, 0xffffffffffffffff, 0x0}]) syz_genetlink_get_family_id$devlink(&(0x7f0000000240)='devlink\x00') close(0xffffffffffffffff) syz_open_dev$tty1(0xc, 0x4, 0x1) socket(0x0, 0x2, 0x0) 16:07:46 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900), 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:46 executing program 4: mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:07:46 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900), 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) [ 264.601730] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 264.610908] FAT-fs (loop3): Filesystem has been set read-only [ 264.617820] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) [ 264.637857] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 264.704775] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:07:47 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000008c0)='./file0\x00', 0x0, 0x0) ftruncate(r1, 0x28007d) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000d83ff8), 0x2008000fffffffe) ioctl$PIO_UNISCRNMAP(r1, 0x4b6a, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r3 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r3, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r3, r3, &(0x7f00000001c0), 0x8080fffffffe) r4 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r4, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r4, r4, &(0x7f00000001c0), 0x8080fffffffe) ioctl$TIOCGDEV(0xffffffffffffffff, 0x80045432, &(0x7f0000000100)) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) 16:07:47 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) write$binfmt_elf32(0xffffffffffffffff, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) r1 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r1, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r1, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x10005, 0x0) 16:07:47 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=0000000000000000004000', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:47 executing program 4: mkdir(0x0, 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:07:47 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:47 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000780)='./file0\x00', 0x0) mkdir(&(0x7f0000000200)='./file1\x00', 0x0) pivot_root(0x0, &(0x7f0000000080)='./file1\x00') mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) r1 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r1) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r0, 0x8983, &(0x7f0000000240)={0x1, 'syzkaller1\x00', {}, 0x4}) r2 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r3 = open(&(0x7f0000000180)='./file1/file0\x00', 0x18500, 0x180) bpf$OBJ_PIN_PROG(0x6, &(0x7f00000002c0)={0x0, r3}, 0x10) write$binfmt_aout(r2, &(0x7f0000000a40)=ANY=[@ANYBLOB="221c"], 0x2) sendfile(r2, r2, &(0x7f0000000140), 0xd1) getsockopt$TIPC_IMPORTANCE(0xffffffffffffffff, 0x10f, 0x7f, &(0x7f0000000300), &(0x7f0000000340)=0x4) 16:07:47 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=0000000000000000004000', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:47 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:47 executing program 5: pipe(0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) write$binfmt_elf32(0xffffffffffffffff, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) r1 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r1, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r1, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x10005, 0x0) 16:07:47 executing program 4: mkdir(0x0, 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) [ 265.002926] overlayfs: failed to resolve './file1': -2 16:07:47 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:47 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,use', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) [ 265.089936] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 265.119633] FAT-fs (loop3): Filesystem has been set read-only [ 265.178519] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:07:47 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000008c0)='./file0\x00', 0x0, 0x0) ftruncate(r1, 0x28007d) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000d83ff8), 0x2008000fffffffe) ioctl$PIO_UNISCRNMAP(r1, 0x4b6a, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r3 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r3, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r3, r3, &(0x7f00000001c0), 0x8080fffffffe) r4 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r4, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r4, r4, &(0x7f00000001c0), 0x8080fffffffe) ioctl$TIOCGDEV(0xffffffffffffffff, 0x80045432, &(0x7f0000000100)) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) 16:07:47 executing program 5: pipe(0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) write$binfmt_elf32(0xffffffffffffffff, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) r1 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r1, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r1, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x10005, 0x0) 16:07:47 executing program 4: mkdir(0x0, 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:07:47 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r1, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:47 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000780)='./file0\x00', 0x0) mkdir(&(0x7f0000000200)='./file1\x00', 0x0) pivot_root(0x0, &(0x7f0000000080)='./file1\x00') mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) r1 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r1) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r0, 0x8983, &(0x7f0000000240)={0x1, 'syzkaller1\x00', {}, 0x4}) r2 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r3 = open(&(0x7f0000000180)='./file1/file0\x00', 0x18500, 0x180) bpf$OBJ_PIN_PROG(0x6, &(0x7f00000002c0)={0x0, r3}, 0x10) write$binfmt_aout(r2, &(0x7f0000000a40)=ANY=[@ANYBLOB="221c"], 0x2) sendfile(r2, r2, &(0x7f0000000140), 0xd1) getsockopt$TIPC_IMPORTANCE(0xffffffffffffffff, 0x10f, 0x7f, &(0x7f0000000300), &(0x7f0000000340)=0x4) 16:07:47 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,use', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:47 executing program 5: pipe(0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) write$binfmt_elf32(0xffffffffffffffff, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) r1 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r1, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r1, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x10005, 0x0) 16:07:47 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r1, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:47 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) [ 265.548810] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 265.557464] FAT-fs (loop3): Filesystem has been set read-only [ 265.564000] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) [ 265.579049] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 265.588405] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:07:47 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,use', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:47 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000008c0)='./file0\x00', 0x0, 0x0) ftruncate(r1, 0x28007d) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000d83ff8), 0x2008000fffffffe) ioctl$PIO_UNISCRNMAP(r1, 0x4b6a, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r3 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r3, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r3, r3, &(0x7f00000001c0), 0x8080fffffffe) r4 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r4, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r4, r4, &(0x7f00000001c0), 0x8080fffffffe) ioctl$TIOCGDEV(0xffffffffffffffff, 0x80045432, &(0x7f0000000100)) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) 16:07:47 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r1, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:48 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:07:48 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_i', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:48 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:07:48 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 265.877192] overlayfs: failed to resolve './file0': -2 [ 265.912239] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 265.967008] FAT-fs (loop3): Filesystem has been set read-only [ 266.005753] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:07:48 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000780)='./file0\x00', 0x0) mkdir(&(0x7f0000000200)='./file1\x00', 0x0) pivot_root(0x0, &(0x7f0000000080)='./file1\x00') mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) r1 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r1) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r0, 0x8983, &(0x7f0000000240)={0x1, 'syzkaller1\x00', {}, 0x4}) r2 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r3 = open(&(0x7f0000000180)='./file1/file0\x00', 0x18500, 0x180) bpf$OBJ_PIN_PROG(0x6, &(0x7f00000002c0)={0x0, r3}, 0x10) write$binfmt_aout(r2, &(0x7f0000000a40)=ANY=[@ANYBLOB="221c"], 0x2) sendfile(r2, r2, &(0x7f0000000140), 0xd1) getsockopt$TIPC_IMPORTANCE(0xffffffffffffffff, 0x10f, 0x7f, &(0x7f0000000300), &(0x7f0000000340)=0x4) 16:07:48 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, 0x0, 0x0) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:48 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_i', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:48 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:07:48 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000008c0)='./file0\x00', 0x0, 0x0) ftruncate(r1, 0x28007d) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000d83ff8), 0x2008000fffffffe) ioctl$PIO_UNISCRNMAP(r1, 0x4b6a, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r3 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r3, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r3, r3, &(0x7f00000001c0), 0x8080fffffffe) r4 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r4, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r4, r4, &(0x7f00000001c0), 0x8080fffffffe) ioctl$TIOCGDEV(0xffffffffffffffff, 0x80045432, &(0x7f0000000100)) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) 16:07:48 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:07:48 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) write$binfmt_elf32(0xffffffffffffffff, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) r2 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r1, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r2, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r2, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r1, 0x0, 0x10005, 0x0) 16:07:48 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, 0x0, 0x0) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:48 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_i', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) [ 266.309761] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 266.347274] FAT-fs (loop3): Filesystem has been set read-only 16:07:48 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', 0x0, 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) [ 266.427790] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:07:48 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000008c0)='./file0\x00', 0x0, 0x0) ftruncate(r1, 0x28007d) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000d83ff8), 0x2008000fffffffe) ioctl$PIO_UNISCRNMAP(r1, 0x4b6a, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r3 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r3, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r3, r3, &(0x7f00000001c0), 0x8080fffffffe) r4 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r4, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r4, r4, &(0x7f00000001c0), 0x8080fffffffe) ioctl$TIOCGDEV(0xffffffffffffffff, 0x80045432, &(0x7f0000000100)) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) 16:07:48 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, 0x0, 0x0) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) [ 266.574011] overlayfs: failed to resolve './file0': -2 [ 266.771900] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 266.782970] FAT-fs (loop3): Filesystem has been set read-only [ 266.790169] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:07:49 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x400300, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in, @in6=@mcast2}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}}}]}, 0xa0}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:07:49 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:49 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', 0x0, 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:07:49 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100), 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:49 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000008c0)='./file0\x00', 0x0, 0x0) ftruncate(r1, 0x28007d) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000d83ff8), 0x2008000fffffffe) ioctl$PIO_UNISCRNMAP(r1, 0x4b6a, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r3 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r3, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r3, r3, &(0x7f00000001c0), 0x8080fffffffe) r4 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r4, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r4, r4, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) 16:07:49 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100), 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) [ 267.048001] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 267.062190] FAT-fs (loop3): Filesystem has been set read-only [ 267.089293] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) [ 267.146734] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 267.193402] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:07:49 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) write$binfmt_elf32(0xffffffffffffffff, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) r2 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r1, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r2, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r2, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r1, 0x0, 0x10005, 0x0) 16:07:49 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', 0x0, 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:07:49 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x400300, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in, @in6=@mcast2}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}}}]}, 0xa0}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:07:49 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:49 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100), 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:49 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000008c0)='./file0\x00', 0x0, 0x0) ftruncate(r1, 0x28007d) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000d83ff8), 0x2008000fffffffe) ioctl$PIO_UNISCRNMAP(r1, 0x4b6a, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r3 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r3, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r3, r3, &(0x7f00000001c0), 0x8080fffffffe) r4 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r4, &(0x7f0000000100)=ANY=[], 0x49f) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) 16:07:49 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:49 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:49 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x0, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:07:49 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x400300, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in, @in6=@mcast2}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}}}]}, 0xa0}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) [ 267.463533] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 267.500997] FAT-fs (loop3): Filesystem has been set read-only 16:07:49 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:49 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) [ 267.522148] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) [ 267.537743] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 267.547964] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:07:50 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) write$binfmt_elf32(0xffffffffffffffff, &(0x7f0000000dc0)=ANY=[@ANYRESOCT, @ANYBLOB="3554cb206a73a84edd"], 0x20) r2 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r1, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r2, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r2, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r1, 0x0, 0x10005, 0x0) 16:07:50 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:50 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x0, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:07:50 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000008c0)='./file0\x00', 0x0, 0x0) ftruncate(r1, 0x28007d) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000d83ff8), 0x2008000fffffffe) ioctl$PIO_UNISCRNMAP(r1, 0x4b6a, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r3 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r3, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r3, r3, &(0x7f00000001c0), 0x8080fffffffe) open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) 16:07:50 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:50 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x400300, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in, @in6=@mcast2}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}}}]}, 0xa0}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:07:50 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:50 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) [ 268.284914] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 268.315492] FAT-fs (loop3): Filesystem has been set read-only 16:07:50 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x400300, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in, @in6=@mcast2}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}}}]}, 0xa0}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:07:50 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x0, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) [ 268.347796] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) [ 268.374657] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) 16:07:50 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:50 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) [ 268.411705] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:07:51 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, 0x0, 0x0) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:07:51 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000008c0)='./file0\x00', 0x0, 0x0) ftruncate(r1, 0x28007d) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000d83ff8), 0x2008000fffffffe) ioctl$PIO_UNISCRNMAP(r1, 0x4b6a, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r3 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r3, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r3, r3, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) 16:07:51 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x400300, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in, @in6=@mcast2}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}}}]}, 0xa0}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:07:51 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:51 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:51 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(0x0, 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:07:51 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x400300, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in, @in6=@mcast2}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}}}]}, 0xa0}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:07:51 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:51 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, 0x0, 0x0) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) [ 269.200376] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) 16:07:51 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(0x0, 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) [ 269.280214] FAT-fs (loop3): Filesystem has been set read-only 16:07:51 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:51 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, 0x0, 0x0) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) [ 269.330320] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:07:52 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, 0x0, 0x0) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:07:52 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x400300, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in, @in6=@mcast2}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}}}]}, 0xa0}}, 0x0) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:07:52 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000008c0)='./file0\x00', 0x0, 0x0) ftruncate(r1, 0x28007d) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000d83ff8), 0x2008000fffffffe) ioctl$PIO_UNISCRNMAP(r1, 0x4b6a, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r3 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r3, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r3, r3, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) 16:07:52 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, 0x0, 0x0) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:52 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:52 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(0x0, 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:07:52 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:52 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x0, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) [ 270.101917] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 270.118021] FAT-fs (loop3): Filesystem has been set read-only 16:07:52 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x400300, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in, @in6=@mcast2}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}}}]}, 0xa0}}, 0x0) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:07:52 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0x0) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) [ 270.152770] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) [ 270.174491] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) 16:07:52 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB, @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) [ 270.203553] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:07:52 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000008c0)='./file0\x00', 0x0, 0x0) ftruncate(r1, 0x28007d) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000d83ff8), 0x2008000fffffffe) ioctl$PIO_UNISCRNMAP(r1, 0x4b6a, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r3 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r3, &(0x7f0000000100)=ANY=[], 0x49f) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) [ 270.479967] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 270.488868] FAT-fs (loop3): Filesystem has been set read-only [ 270.495852] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:07:53 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, 0x0, 0x0) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:07:53 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x0, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:53 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x400300, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in, @in6=@mcast2}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}}}]}, 0xa0}}, 0x0) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:07:53 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB, @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:53 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0x0) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:07:53 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000008c0)='./file0\x00', 0x0, 0x0) ftruncate(r1, 0x28007d) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000d83ff8), 0x2008000fffffffe) ioctl$PIO_UNISCRNMAP(r1, 0x4b6a, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r3 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r3, &(0x7f0000000100)=ANY=[], 0x49f) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) 16:07:53 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB, @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:53 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:07:53 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x0, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:53 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0x0) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:07:53 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:53 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000008c0)='./file0\x00', 0x0, 0x0) ftruncate(r1, 0x28007d) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000d83ff8), 0x2008000fffffffe) ioctl$PIO_UNISCRNMAP(r1, 0x4b6a, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r3 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r3, &(0x7f0000000100)=ANY=[], 0x49f) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) [ 271.070649] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 271.098082] FAT-fs (loop3): Filesystem has been set read-only [ 271.106553] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) [ 271.362892] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 271.371408] FAT-fs (loop3): Filesystem has been set read-only [ 271.377883] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:07:54 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:07:54 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:54 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:07:54 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:54 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:07:54 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000008c0)='./file0\x00', 0x0, 0x0) ftruncate(r1, 0x28007d) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000d83ff8), 0x2008000fffffffe) ioctl$PIO_UNISCRNMAP(r1, 0x4b6a, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r3 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) sendfile(r3, r3, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) 16:07:54 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:07:54 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:54 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) sendmsg$tipc(r2, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) [ 271.834229] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 271.871130] FAT-fs (loop3): Filesystem has been set read-only 16:07:54 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[], 0x0) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 271.883441] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:07:54 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:07:54 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000008c0)='./file0\x00', 0x0, 0x0) ftruncate(r1, 0x28007d) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000d83ff8), 0x2008000fffffffe) ioctl$PIO_UNISCRNMAP(r1, 0x4b6a, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r3 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) sendfile(r3, r3, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) 16:07:54 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:54 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:54 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x400300, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in, @in6=@mcast2}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}}}]}, 0xa0}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:07:54 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) 16:07:54 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:07:54 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x400300, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in, @in6=@mcast2}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}}}]}, 0xa0}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:07:54 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(0x0, &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) [ 272.309578] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) 16:07:54 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000), 0x10, 0x0}, 0x0) [ 272.368660] FAT-fs (loop3): Filesystem has been set read-only [ 272.390536] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:07:54 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000008c0)='./file0\x00', 0x0, 0x0) ftruncate(r1, 0x28007d) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000d83ff8), 0x2008000fffffffe) ioctl$PIO_UNISCRNMAP(r1, 0x4b6a, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r3 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) sendfile(r3, r3, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) [ 272.638189] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 272.655717] FAT-fs (loop3): Filesystem has been set read-only [ 272.662101] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:07:55 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[], 0x0) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:07:55 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x400300, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in, @in6=@mcast2}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}}}]}, 0xa0}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:07:55 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(0x0, &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:55 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x0, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:07:55 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000008c0)='./file0\x00', 0x0, 0x0) ftruncate(r1, 0x28007d) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000d83ff8), 0x2008000fffffffe) ioctl$PIO_UNISCRNMAP(r1, 0x4b6a, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) 16:07:55 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, 0x0, 0x0) 16:07:55 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(0x0, &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:55 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, 0x0, 0x0) 16:07:55 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) dup3(r0, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x400300, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in, @in6=@mcast2}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}}}]}, 0xa0}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) [ 272.970387] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 272.982833] FAT-fs (loop3): Filesystem has been set read-only 16:07:55 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x0, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) [ 273.027082] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:07:55 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, 0x0, 0x0) 16:07:55 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000008c0)='./file0\x00', 0x0, 0x0) ftruncate(r1, 0x28007d) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000d83ff8), 0x2008000fffffffe) ioctl$PIO_UNISCRNMAP(r1, 0x4b6a, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) [ 273.313592] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 273.322116] FAT-fs (loop3): Filesystem has been set read-only [ 273.329664] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:07:56 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[], 0x0) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:07:56 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) dup3(r0, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x400300, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in, @in6=@mcast2}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}}}]}, 0xa0}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:07:56 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', 0x0) setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:56 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x0, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:07:56 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000008c0)='./file0\x00', 0x0, 0x0) ftruncate(r1, 0x28007d) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000d83ff8), 0x2008000fffffffe) ioctl$PIO_UNISCRNMAP(r1, 0x4b6a, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) 16:07:56 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) 16:07:56 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="000000000000000000000000000000000010000000000000ed793afe0000000002008201260001000000640000000001270005000000000000006400000000030d0085043100c90000006400000000043200052020002d010000d306000055aa", 0x60, 0x1a0}]) 16:07:56 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', 0x0) setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:56 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) dup3(r0, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x400300, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in, @in6=@mcast2}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}}}]}, 0xa0}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:07:56 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, 0x0) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) [ 273.879917] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) 16:07:56 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000008c0)='./file0\x00', 0x0, 0x0) ftruncate(r1, 0x28007d) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000d83ff8), 0x2008000fffffffe) ioctl$PIO_UNISCRNMAP(r1, 0x4b6a, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f00000001c0), 0x8080fffffffe) [ 273.921384] FAT-fs (loop3): Filesystem has been set read-only [ 273.932074] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:07:56 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) dup3(0xffffffffffffffff, r0, 0x0) sendmsg$key(r0, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x400300, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in, @in6=@mcast2}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}}}]}, 0xa0}}, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) [ 274.182170] loop0: p1 p2 < p5 p6 p7 p8 p9 p10 p11 p12 p13 p14 p15 p16 p17 p18 p19 p20 p21 p22 p23 p24 p25 p26 p27 p28 p29 p30 p31 p32 p33 p34 p35 p36 p37 p38 p39 p40 p41 p42 p43 p44 p45 p46 p47 p48 p49 p50 p51 p52 p53 p54 p55 p56 p57 p58 p59 p60 p61 p62 p63 p64 p65 p66 p67 p68 p69 p70 p71 p72 p73 p74 p75 p76 p77 p78 p79 p80 p81 p82 p83 p84 p85 p86 p87 p88 p89 p90 p91 p92 p93 p94 p95 p96 p97 p98 p99 p100 p101 p102 p103 p104 p105 p106 p107 p108 p109 p110 p111 p112 p113 p114 p115 p116 p117 p118 p119 p120 p121 p122 p123 p124 p125 p126 p127 p128 p129 p130 p131 p132 p133 p134 p135 p136 p137 p138 p139 p140 p141 p142 p143 p144 p145 p146 p147 p148 p149 p150 p151 p152 p153 p154 p155 p156 p157 p158 p159 p160 p161 p162 p163 p164 p165 p166 p167 p168 p169 p170 p171 p172 p173 p174 p175 p176 p177 p178 p179 p180 p181 p182 p183 p184 p185 p186 p187 p188 p189 p190 p191 p192 p193 p194 p195 p196 p197 p198 p199 p200 p201 p202 p203 p204 p205 p206 p207 p208 p209 p210 p211 p212 p213 p214 p215 p216 p217 p218 p21 [ 274.308684] loop0: partition table partially beyond EOD, truncated [ 274.337375] loop0: p1 start 1 is beyond EOD, truncated [ 274.343515] loop0: p2 size 2 extends beyond EOD, truncated [ 274.387902] loop0: p3 start 201 is beyond EOD, truncated [ 274.406780] loop0: p4 start 301 is beyond EOD, truncated [ 274.419505] loop0: p5 start 1 is beyond EOD, truncated [ 274.432515] loop0: p6 start 1 is beyond EOD, truncated [ 274.439631] loop0: p7 start 1 is beyond EOD, truncated [ 274.445457] loop0: p8 start 1 is beyond EOD, truncated [ 274.451174] loop0: p9 start 1 is beyond EOD, truncated [ 274.457100] loop0: p10 start 1 is beyond EOD, truncated [ 274.462967] loop0: p11 start 1 is beyond EOD, truncated [ 274.470185] loop0: p12 start 1 is beyond EOD, truncated [ 274.476378] loop0: p13 start 1 is beyond EOD, truncated [ 274.482038] loop0: p14 start 1 is beyond EOD, truncated [ 274.487998] loop0: p15 start 1 is beyond EOD, truncated [ 274.494362] loop0: p16 start 1 is beyond EOD, truncated [ 274.500471] loop0: p17 start 1 is beyond EOD, truncated [ 274.506621] loop0: p18 start 1 is beyond EOD, truncated [ 274.512317] loop0: p19 start 1 is beyond EOD, truncated [ 274.518160] loop0: p20 start 1 is beyond EOD, truncated [ 274.523855] loop0: p21 start 1 is beyond EOD, truncated [ 274.530104] loop0: p22 start 1 is beyond EOD, truncated [ 274.536059] loop0: p23 start 1 is beyond EOD, truncated [ 274.541808] loop0: p24 start 1 is beyond EOD, truncated [ 274.548032] loop0: p25 start 1 is beyond EOD, truncated [ 274.553913] loop0: p26 start 1 is beyond EOD, truncated [ 274.559965] loop0: p27 start 1 is beyond EOD, truncated [ 274.566198] loop0: p28 start 1 is beyond EOD, truncated [ 274.571990] loop0: p29 start 1 is beyond EOD, truncated [ 274.577882] loop0: p30 start 1 is beyond EOD, truncated [ 274.583513] loop0: p31 start 1 is beyond EOD, truncated [ 274.589348] loop0: p32 start 1 is beyond EOD, truncated [ 274.594954] loop0: p33 start 1 is beyond EOD, truncated [ 274.603146] loop0: p34 start 1 is beyond EOD, truncated [ 274.609326] loop0: p35 start 1 is beyond EOD, truncated [ 274.614894] loop0: p36 start 1 is beyond EOD, truncated [ 274.620757] loop0: p37 start 1 is beyond EOD, truncated [ 274.626384] loop0: p38 start 1 is beyond EOD, truncated [ 274.631885] loop0: p39 start 1 is beyond EOD, truncated 16:07:57 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x0, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:07:57 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, 0x0) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:07:57 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) dup3(0xffffffffffffffff, r0, 0x0) sendmsg$key(r0, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x400300, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in, @in6=@mcast2}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}}}]}, 0xa0}}, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:07:57 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', 0x0) setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) [ 274.637705] loop0: p40 start 1 is beyond EOD, truncated [ 274.643298] loop0: p41 start 1 is beyond EOD, truncated [ 274.649406] loop0: p42 start 1 is beyond EOD, truncated [ 274.655035] loop0: p43 start 1 is beyond EOD, truncated [ 274.660967] loop0: p44 start 1 is beyond EOD, truncated [ 274.668091] loop0: p45 start 1 is beyond EOD, truncated [ 274.673850] loop0: p46 start 1 is beyond EOD, truncated 16:07:57 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) dup3(0xffffffffffffffff, r0, 0x0) sendmsg$key(r0, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x400300, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in, @in6=@mcast2}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}}}]}, 0xa0}}, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) [ 274.710997] loop0: p47 start 1 is beyond EOD, truncated [ 274.724037] loop0: p48 start 1 is beyond EOD, truncated [ 274.729566] loop0: p49 start 1 is beyond EOD, truncated [ 274.734954] loop0: p50 start 1 is beyond EOD, truncated [ 274.793195] loop0: p51 start 1 is beyond EOD, truncated [ 274.805502] loop0: p52 start 1 is beyond EOD, truncated [ 274.821468] loop0: p53 start 1 is beyond EOD, truncated 16:07:57 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) [ 274.845641] loop0: p54 start 1 is beyond EOD, truncated [ 274.872060] loop0: p55 start 1 is beyond EOD, truncated [ 274.888905] loop0: p56 start 1 is beyond EOD, truncated [ 274.897672] loop0: p57 start 1 is beyond EOD, truncated [ 274.907844] loop0: p58 start 1 is beyond EOD, truncated [ 274.935762] loop0: p59 start 1 is beyond EOD, truncated [ 274.960355] loop0: p60 start 1 is beyond EOD, truncated [ 275.019300] loop0: p61 start 1 is beyond EOD, truncated [ 275.050515] loop0: p62 start 1 is beyond EOD, truncated [ 275.062840] loop0: p63 start 1 is beyond EOD, truncated [ 275.072355] loop0: p64 start 1 is beyond EOD, truncated [ 275.081230] loop0: p65 start 1 is beyond EOD, truncated [ 275.087033] loop0: p66 start 1 is beyond EOD, truncated [ 275.092588] loop0: p67 start 1 is beyond EOD, truncated [ 275.098266] loop0: p68 start 1 is beyond EOD, truncated [ 275.103784] loop0: p69 start 1 is beyond EOD, truncated [ 275.109404] loop0: p70 start 1 is beyond EOD, truncated [ 275.114957] loop0: p71 start 1 is beyond EOD, truncated [ 275.114977] loop0: p72 start 1 is beyond EOD, truncated [ 275.114987] loop0: p73 start 1 is beyond EOD, truncated [ 275.114997] loop0: p74 start 1 is beyond EOD, truncated [ 275.115006] loop0: p75 start 1 is beyond EOD, truncated [ 275.115015] loop0: p76 start 1 is beyond EOD, truncated [ 275.115025] loop0: p77 start 1 is beyond EOD, truncated [ 275.115033] loop0: p78 start 1 is beyond EOD, truncated [ 275.115042] loop0: p79 start 1 is beyond EOD, truncated [ 275.115057] loop0: p80 start 1 is beyond EOD, truncated [ 275.115070] loop0: p81 start 1 is beyond EOD, truncated [ 275.115081] loop0: p82 start 1 is beyond EOD, truncated [ 275.115091] loop0: p83 start 1 is beyond EOD, truncated [ 275.115100] loop0: p84 start 1 is beyond EOD, truncated [ 275.115117] loop0: p85 start 1 is beyond EOD, truncated [ 275.115126] loop0: p86 start 1 is beyond EOD, truncated [ 275.115139] loop0: p87 start 1 is beyond EOD, truncated [ 275.207818] loop0: p88 start 1 is beyond EOD, truncated [ 275.207837] loop0: p89 start 1 is beyond EOD, truncated [ 275.218759] loop0: p90 start 1 is beyond EOD, truncated [ 275.224170] loop0: p91 start 1 is beyond EOD, truncated [ 275.229696] loop0: p92 start 1 is beyond EOD, truncated [ 275.235073] loop0: p93 start 1 is beyond EOD, truncated [ 275.235086] loop0: p94 start 1 is beyond EOD, truncated [ 275.235097] loop0: p95 start 1 is beyond EOD, truncated [ 275.235108] loop0: p96 start 1 is beyond EOD, truncated [ 275.235119] loop0: p97 start 1 is beyond EOD, truncated [ 275.235130] loop0: p98 start 1 is beyond EOD, truncated [ 275.235230] loop0: p99 start 1 is beyond EOD, truncated [ 275.235247] loop0: p100 start 1 is beyond EOD, truncated [ 275.235255] loop0: p101 start 1 is beyond EOD, truncated [ 275.235264] loop0: p102 start 1 is beyond EOD, truncated [ 275.235273] loop0: p103 start 1 is beyond EOD, truncated [ 275.235283] loop0: p104 start 1 is beyond EOD, truncated [ 275.235294] loop0: p105 start 1 is beyond EOD, truncated [ 275.235304] loop0: p106 start 1 is beyond EOD, truncated [ 275.235315] loop0: p107 start 1 is beyond EOD, truncated [ 275.235325] loop0: p108 start 1 is beyond EOD, truncated [ 275.235336] loop0: p109 start 1 is beyond EOD, truncated [ 275.235346] loop0: p110 start 1 is beyond EOD, truncated [ 275.235357] loop0: p111 start 1 is beyond EOD, truncated [ 275.235367] loop0: p112 start 1 is beyond EOD, truncated [ 275.235377] loop0: p113 start 1 is beyond EOD, truncated [ 275.235387] loop0: p114 start 1 is beyond EOD, truncated [ 275.235398] loop0: p115 start 1 is beyond EOD, truncated [ 275.235407] loop0: p116 start 1 is beyond EOD, truncated [ 275.246533] loop0: p117 start 1 is beyond EOD, truncated [ 275.257403] loop0: p118 start 1 is beyond EOD, truncated [ 275.257416] loop0: p119 start 1 is beyond EOD, truncated [ 275.257427] loop0: p120 start 1 is beyond EOD, truncated [ 275.257438] loop0: p121 start 1 is beyond EOD, truncated [ 275.257448] loop0: p122 start 1 is beyond EOD, truncated [ 275.257459] loop0: p123 start 1 is beyond EOD, truncated [ 275.257469] loop0: p124 start 1 is beyond EOD, truncated [ 275.257478] loop0: p125 start 1 is beyond EOD, truncated [ 275.257488] loop0: p126 start 1 is beyond EOD, truncated [ 275.257498] loop0: p127 start 1 is beyond EOD, truncated [ 275.257509] loop0: p128 start 1 is beyond EOD, truncated [ 275.257520] loop0: p129 start 1 is beyond EOD, truncated [ 275.257530] loop0: p130 start 1 is beyond EOD, truncated [ 275.257540] loop0: p131 start 1 is beyond EOD, truncated [ 275.257550] loop0: p132 start 1 is beyond EOD, truncated [ 275.257561] loop0: p133 start 1 is beyond EOD, truncated [ 275.257571] loop0: p134 start 1 is beyond EOD, truncated [ 275.257581] loop0: p135 start 1 is beyond EOD, truncated [ 275.257591] loop0: p136 start 1 is beyond EOD, truncated [ 275.257602] loop0: p137 start 1 is beyond EOD, truncated [ 275.257612] loop0: p138 start 1 is beyond EOD, truncated [ 275.257623] loop0: p139 start 1 is beyond EOD, truncated [ 275.257633] loop0: p140 start 1 is beyond EOD, truncated [ 275.257642] loop0: p141 start 1 is beyond EOD, truncated [ 275.279709] loop0: p142 start 1 is beyond EOD, truncated [ 275.296430] loop0: p143 start 1 is beyond EOD, truncated [ 275.517364] loop0: p144 start 1 is beyond EOD, truncated [ 275.523047] loop0: p145 start 1 is beyond EOD, truncated [ 275.530066] loop0: p146 start 1 is beyond EOD, truncated [ 275.535901] loop0: p147 start 1 is beyond EOD, truncated [ 275.541483] loop0: p148 start 1 is beyond EOD, truncated [ 275.547030] loop0: p149 start 1 is beyond EOD, truncated [ 275.552604] loop0: p150 start 1 is beyond EOD, truncated [ 275.558191] loop0: p151 start 1 is beyond EOD, truncated [ 275.563658] loop0: p152 start 1 is beyond EOD, truncated [ 275.569186] loop0: p153 start 1 is beyond EOD, truncated [ 275.574655] loop0: p154 start 1 is beyond EOD, truncated [ 275.581009] loop0: p155 start 1 is beyond EOD, truncated [ 275.588498] loop0: p156 start 1 is beyond EOD, truncated [ 275.593994] loop0: p157 start 1 is beyond EOD, truncated [ 275.599549] loop0: p158 start 1 is beyond EOD, truncated [ 275.605007] loop0: p159 start 1 is beyond EOD, truncated [ 275.610667] loop0: p160 start 1 is beyond EOD, truncated [ 275.616217] loop0: p161 start 1 is beyond EOD, truncated [ 275.621681] loop0: p162 start 1 is beyond EOD, truncated [ 275.627361] loop0: p163 start 1 is beyond EOD, truncated [ 275.632822] loop0: p164 start 1 is beyond EOD, truncated [ 275.638438] loop0: p165 start 1 is beyond EOD, truncated [ 275.643903] loop0: p166 start 1 is beyond EOD, truncated [ 275.649445] loop0: p167 start 1 is beyond EOD, truncated [ 275.654913] loop0: p168 start 1 is beyond EOD, truncated [ 275.660463] loop0: p169 start 1 is beyond EOD, truncated [ 275.665987] loop0: p170 start 1 is beyond EOD, truncated [ 275.671446] loop0: p171 start 1 is beyond EOD, truncated [ 275.677396] loop0: p172 start 1 is beyond EOD, truncated [ 275.682889] loop0: p173 start 1 is beyond EOD, truncated [ 275.688427] loop0: p174 start 1 is beyond EOD, truncated [ 275.693902] loop0: p175 start 1 is beyond EOD, truncated [ 275.699442] loop0: p176 start 1 is beyond EOD, truncated [ 275.704914] loop0: p177 start 1 is beyond EOD, truncated [ 275.710470] loop0: p178 start 1 is beyond EOD, truncated [ 275.716112] loop0: p179 start 1 is beyond EOD, truncated [ 275.721580] loop0: p180 start 1 is beyond EOD, truncated [ 275.727226] loop0: p181 start 1 is beyond EOD, truncated [ 275.732702] loop0: p182 start 1 is beyond EOD, truncated [ 275.738320] loop0: p183 start 1 is beyond EOD, truncated [ 275.743796] loop0: p184 start 1 is beyond EOD, truncated [ 275.749330] loop0: p185 start 1 is beyond EOD, truncated [ 275.755004] loop0: p186 start 1 is beyond EOD, truncated [ 275.760784] loop0: p187 start 1 is beyond EOD, truncated [ 275.766321] loop0: p188 start 1 is beyond EOD, truncated [ 275.772112] loop0: p189 start 1 is beyond EOD, truncated [ 275.777650] loop0: p190 start 1 is beyond EOD, truncated [ 275.783146] loop0: p191 start 1 is beyond EOD, truncated [ 275.788688] loop0: p192 start 1 is beyond EOD, truncated [ 275.794175] loop0: p193 start 1 is beyond EOD, truncated [ 275.799738] loop0: p194 start 1 is beyond EOD, truncated [ 275.805255] loop0: p195 start 1 is beyond EOD, truncated [ 275.810781] loop0: p196 start 1 is beyond EOD, truncated [ 275.816457] loop0: p197 start 1 is beyond EOD, truncated [ 275.821937] loop0: p198 start 1 is beyond EOD, truncated [ 275.827468] loop0: p199 start 1 is beyond EOD, truncated [ 275.832944] loop0: p200 start 1 is beyond EOD, truncated [ 275.838618] loop0: p201 start 1 is beyond EOD, truncated [ 275.844101] loop0: p202 start 1 is beyond EOD, truncated [ 275.849672] loop0: p203 start 1 is beyond EOD, truncated [ 275.855411] loop0: p204 start 1 is beyond EOD, truncated [ 275.860873] loop0: p205 start 1 is beyond EOD, truncated [ 275.866417] loop0: p206 start 1 is beyond EOD, truncated [ 275.871875] loop0: p207 start 1 is beyond EOD, truncated [ 275.877395] loop0: p208 start 1 is beyond EOD, truncated [ 275.882875] loop0: p209 start 1 is beyond EOD, truncated [ 275.888416] loop0: p210 start 1 is beyond EOD, truncated [ 275.893977] loop0: p211 start 1 is beyond EOD, truncated [ 275.899532] loop0: p212 start 1 is beyond EOD, truncated [ 275.904993] loop0: p213 start 1 is beyond EOD, truncated [ 275.910537] loop0: p214 start 1 is beyond EOD, truncated [ 275.916077] loop0: p215 start 1 is beyond EOD, truncated [ 275.921647] loop0: p216 start 1 is beyond EOD, truncated [ 275.927169] loop0: p217 start 1 is beyond EOD, truncated [ 275.932636] loop0: p218 start 1 is beyond EOD, truncated [ 275.938211] loop0: p219 start 1 is beyond EOD, truncated [ 275.943722] loop0: p220 start 1 is beyond EOD, truncated [ 275.949275] loop0: p221 start 1 is beyond EOD, truncated [ 275.954742] loop0: p222 start 1 is beyond EOD, truncated [ 275.960996] loop0: p223 start 1 is beyond EOD, truncated [ 275.966581] loop0: p224 start 1 is beyond EOD, truncated [ 275.972055] loop0: p225 start 1 is beyond EOD, truncated [ 275.977633] loop0: p226 start 1 is beyond EOD, truncated [ 275.983253] loop0: p227 start 1 is beyond EOD, truncated [ 275.988819] loop0: p228 start 1 is beyond EOD, truncated [ 275.994420] loop0: p229 start 1 is beyond EOD, truncated [ 276.000046] loop0: p230 start 1 is beyond EOD, truncated [ 276.005622] loop0: p231 start 1 is beyond EOD, truncated [ 276.011157] loop0: p232 start 1 is beyond EOD, truncated [ 276.017170] loop0: p233 start 1 is beyond EOD, truncated [ 276.022635] loop0: p234 start 1 is beyond EOD, truncated [ 276.028212] loop0: p235 start 1 is beyond EOD, truncated [ 276.033678] loop0: p236 start 1 is beyond EOD, truncated [ 276.039353] loop0: p237 start 1 is beyond EOD, truncated [ 276.044831] loop0: p238 start 1 is beyond EOD, truncated [ 276.050363] loop0: p239 start 1 is beyond EOD, truncated [ 276.055914] loop0: p240 start 1 is beyond EOD, truncated [ 276.061374] loop0: p241 start 1 is beyond EOD, truncated [ 276.066935] loop0: p242 start 1 is beyond EOD, truncated [ 276.072399] loop0: p243 start 1 is beyond EOD, truncated [ 276.077965] loop0: p244 start 1 is beyond EOD, truncated [ 276.083443] loop0: p245 start 1 is beyond EOD, truncated [ 276.088980] loop0: p246 start 1 is beyond EOD, truncated [ 276.094448] loop0: p247 start 1 is beyond EOD, truncated [ 276.099992] loop0: p248 start 1 is beyond EOD, truncated [ 276.105517] loop0: p249 start 1 is beyond EOD, truncated [ 276.110983] loop0: p250 start 1 is beyond EOD, truncated [ 276.116690] loop0: p251 start 1 is beyond EOD, truncated [ 276.122195] loop0: p252 start 1 is beyond EOD, truncated [ 276.127787] loop0: p253 start 1 is beyond EOD, truncated [ 276.133266] loop0: p254 start 1 is beyond EOD, truncated [ 276.138820] loop0: p255 start 1 is beyond EOD, truncated 16:07:58 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="000000000000000000000000000000000010000000000000ed793afe0000000002008201260001000000640000000001270005000000000000006400000000030d0085043100c90000006400000000043200052020002d010000d306000055aa", 0x60, 0x1a0}]) 16:07:58 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, 0x0) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:07:58 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x0, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:07:58 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000008c0)='./file0\x00', 0x0, 0x0) ftruncate(r1, 0x28007d) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000d83ff8), 0x2008000fffffffe) ioctl$PIO_UNISCRNMAP(r1, 0x4b6a, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f00000001c0), 0x8080fffffffe) 16:07:58 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(0xffffffffffffffff, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x400300, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in, @in6=@mcast2}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}}}]}, 0xa0}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:07:58 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:58 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x0, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 276.261446] print_req_error: I/O error, dev loop0, sector 0 [ 276.267516] __loop_clr_fd: partition scan of loop0 failed (rc=-16) [ 276.274517] print_req_error: I/O error, dev loop0, sector 0 [ 276.280855] Buffer I/O error on dev loop0p2, logical block 0, async page read [ 276.290063] print_req_error: I/O error, dev loop0, sector 0 [ 276.296265] Buffer I/O error on dev loop0p2, logical block 0, async page read [ 276.315907] print_req_error: I/O error, dev loop0, sector 0 [ 276.321722] Buffer I/O error on dev loop0p2, logical block 0, async page read [ 276.337091] print_req_error: I/O error, dev loop0, sector 0 [ 276.342908] Buffer I/O error on dev loop0p2, logical block 0, async page read [ 276.350953] print_req_error: I/O error, dev loop0, sector 0 [ 276.356831] Buffer I/O error on dev loop0p2, logical block 0, async page read 16:07:58 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, r0, 0x0) 16:07:58 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(0xffffffffffffffff, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x400300, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in, @in6=@mcast2}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}}}]}, 0xa0}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) [ 276.364677] print_req_error: I/O error, dev loop0, sector 0 [ 276.370599] Buffer I/O error on dev loop0p2, logical block 0, async page read [ 276.379356] print_req_error: I/O error, dev loop0, sector 0 [ 276.385225] Buffer I/O error on dev loop0p2, logical block 0, async page read [ 276.396127] print_req_error: I/O error, dev loop0, sector 0 [ 276.401944] Buffer I/O error on dev loop0p2, logical block 0, async page read [ 276.409718] print_req_error: I/O error, dev loop0, sector 0 16:07:58 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) [ 276.415555] Buffer I/O error on dev loop0p2, logical block 0, async page read [ 276.423284] Buffer I/O error on dev loop0p2, logical block 0, async page read 16:07:59 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x0) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:07:59 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(0xffffffffffffffff, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x400300, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in, @in6=@mcast2}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}}}]}, 0xa0}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) [ 276.754687] loop0: p1 p2 < p5 p6 p7 p8 p9 p10 p11 p12 p13 p14 p15 p16 p17 p18 p19 p20 p21 p22 p23 p24 p25 p26 p27 p28 p29 p30 p31 p32 p33 p34 p35 p36 p37 p38 p39 p40 p41 p42 p43 p44 p45 p46 p47 p48 p49 p50 p51 p52 p53 p54 p55 p56 p57 p58 p59 p60 p61 p62 p63 p64 p65 p66 p67 p68 p69 p70 p71 p72 p73 p74 p75 p76 p77 p78 p79 p80 p81 p82 p83 p84 p85 p86 p87 p88 p89 p90 p91 p92 p93 p94 p95 p96 p97 p98 p99 p100 p101 p102 p103 p104 p105 p106 p107 p108 p109 p110 p111 p112 p113 p114 p115 p116 p117 p118 p119 p120 p121 p122 p123 p124 p125 p126 p127 p128 p129 p130 p131 p132 p133 p134 p135 p136 p137 p138 p139 p140 p141 p142 p143 p144 p145 p146 p147 p148 p149 p150 p151 p152 p153 p154 p155 p156 p157 p158 p159 p160 p161 p162 p163 p164 p165 p166 p167 p168 p169 p170 p171 p172 p173 p174 p175 p176 p177 p178 p179 p180 p181 p182 p183 p184 p185 p186 p187 p188 p189 p190 p191 p192 p193 p194 p195 p196 p197 p198 p199 p200 p201 p202 p203 p204 p205 p206 p207 p208 p209 p210 p211 p212 p213 p214 p215 p216 p217 p218 p21 [ 276.853382] loop0: partition table partially beyond EOD, truncated [ 276.862923] loop0: p1 start 1 is beyond EOD, truncated [ 276.872409] loop0: p2 size 2 extends beyond EOD, truncated [ 276.936653] loop0: p3 start 201 is beyond EOD, truncated [ 276.942384] loop0: p4 start 301 is beyond EOD, truncated [ 276.975516] loop0: p5 start 1 is beyond EOD, truncated [ 276.981180] loop0: p6 start 1 is beyond EOD, truncated [ 276.995434] loop0: p7 start 1 is beyond EOD, truncated [ 277.000914] loop0: p8 start 1 is beyond EOD, truncated [ 277.020704] loop0: p9 start 1 is beyond EOD, truncated [ 277.027134] loop0: p10 start 1 is beyond EOD, truncated [ 277.032737] loop0: p11 start 1 is beyond EOD, truncated [ 277.039035] loop0: p12 start 1 is beyond EOD, truncated [ 277.045006] loop0: p13 start 1 is beyond EOD, truncated [ 277.052097] loop0: p14 start 1 is beyond EOD, truncated [ 277.058166] loop0: p15 start 1 is beyond EOD, truncated [ 277.063946] loop0: p16 start 1 is beyond EOD, truncated [ 277.069832] loop0: p17 start 1 is beyond EOD, truncated [ 277.078068] loop0: p18 start 1 is beyond EOD, truncated [ 277.083552] loop0: p19 start 1 is beyond EOD, truncated [ 277.092876] loop0: p20 start 1 is beyond EOD, truncated [ 277.100788] loop0: p21 start 1 is beyond EOD, truncated [ 277.115561] loop0: p22 start 1 is beyond EOD, truncated [ 277.122712] loop0: p23 start 1 is beyond EOD, truncated [ 277.130057] loop0: p24 start 1 is beyond EOD, truncated [ 277.137506] loop0: p25 start 1 is beyond EOD, truncated [ 277.143366] loop0: p26 start 1 is beyond EOD, truncated [ 277.149708] loop0: p27 start 1 is beyond EOD, truncated [ 277.157541] loop0: p28 start 1 is beyond EOD, truncated [ 277.164045] loop0: p29 start 1 is beyond EOD, truncated [ 277.170167] loop0: p30 start 1 is beyond EOD, truncated [ 277.176377] loop0: p31 start 1 is beyond EOD, truncated [ 277.182083] loop0: p32 start 1 is beyond EOD, truncated [ 277.196216] loop0: p33 start 1 is beyond EOD, truncated [ 277.203788] loop0: p34 start 1 is beyond EOD, truncated [ 277.210466] loop0: p35 start 1 is beyond EOD, truncated [ 277.216870] loop0: p36 start 1 is beyond EOD, truncated [ 277.222795] loop0: p37 start 1 is beyond EOD, truncated [ 277.229001] loop0: p38 start 1 is beyond EOD, truncated [ 277.236486] loop0: p39 start 1 is beyond EOD, truncated [ 277.242355] loop0: p40 start 1 is beyond EOD, truncated [ 277.257685] loop0: p41 start 1 is beyond EOD, truncated [ 277.264140] loop0: p42 start 1 is beyond EOD, truncated [ 277.270242] loop0: p43 start 1 is beyond EOD, truncated [ 277.277931] loop0: p44 start 1 is beyond EOD, truncated [ 277.283506] loop0: p45 start 1 is beyond EOD, truncated [ 277.289490] loop0: p46 start 1 is beyond EOD, truncated [ 277.295012] loop0: p47 start 1 is beyond EOD, truncated [ 277.302494] loop0: p48 start 1 is beyond EOD, truncated [ 277.308255] loop0: p49 start 1 is beyond EOD, truncated [ 277.313677] loop0: p50 start 1 is beyond EOD, truncated [ 277.319277] loop0: p51 start 1 is beyond EOD, truncated [ 277.324671] loop0: p52 start 1 is beyond EOD, truncated [ 277.330149] loop0: p53 start 1 is beyond EOD, truncated [ 277.335660] loop0: p54 start 1 is beyond EOD, truncated [ 277.341153] loop0: p55 start 1 is beyond EOD, truncated [ 277.346617] loop0: p56 start 1 is beyond EOD, truncated [ 277.351997] loop0: p57 start 1 is beyond EOD, truncated [ 277.357464] loop0: p58 start 1 is beyond EOD, truncated [ 277.362842] loop0: p59 start 1 is beyond EOD, truncated [ 277.368406] loop0: p60 start 1 is beyond EOD, truncated [ 277.373780] loop0: p61 start 1 is beyond EOD, truncated [ 277.379225] loop0: p62 start 1 is beyond EOD, truncated [ 277.384599] loop0: p63 start 1 is beyond EOD, truncated [ 277.390055] loop0: p64 start 1 is beyond EOD, truncated [ 277.395530] loop0: p65 start 1 is beyond EOD, truncated [ 277.400906] loop0: p66 start 1 is beyond EOD, truncated [ 277.406365] loop0: p67 start 1 is beyond EOD, truncated [ 277.411757] loop0: p68 start 1 is beyond EOD, truncated [ 277.417328] loop0: p69 start 1 is beyond EOD, truncated [ 277.422714] loop0: p70 start 1 is beyond EOD, truncated [ 277.428233] loop0: p71 start 1 is beyond EOD, truncated [ 277.433633] loop0: p72 start 1 is beyond EOD, truncated [ 277.439155] loop0: p73 start 1 is beyond EOD, truncated [ 277.444533] loop0: p74 start 1 is beyond EOD, truncated [ 277.449955] loop0: p75 start 1 is beyond EOD, truncated [ 277.455406] loop0: p76 start 1 is beyond EOD, truncated [ 277.460780] loop0: p77 start 1 is beyond EOD, truncated [ 277.466217] loop0: p78 start 1 is beyond EOD, truncated [ 277.471640] loop0: p79 start 1 is beyond EOD, truncated [ 277.477255] loop0: p80 start 1 is beyond EOD, truncated [ 277.482647] loop0: p81 start 1 is beyond EOD, truncated [ 277.488210] loop0: p82 start 1 is beyond EOD, truncated [ 277.493600] loop0: p83 start 1 is beyond EOD, truncated [ 277.499081] loop0: p84 start 1 is beyond EOD, truncated [ 277.504461] loop0: p85 start 1 is beyond EOD, truncated [ 277.509907] loop0: p86 start 1 is beyond EOD, truncated [ 277.515357] loop0: p87 start 1 is beyond EOD, truncated [ 277.520816] loop0: p88 start 1 is beyond EOD, truncated [ 277.526268] loop0: p89 start 1 is beyond EOD, truncated [ 277.531639] loop0: p90 start 1 is beyond EOD, truncated [ 277.537317] loop0: p91 start 1 is beyond EOD, truncated [ 277.542697] loop0: p92 start 1 is beyond EOD, truncated [ 277.548158] loop0: p93 start 1 is beyond EOD, truncated [ 277.553561] loop0: p94 start 1 is beyond EOD, truncated [ 277.559066] loop0: p95 start 1 is beyond EOD, truncated [ 277.564451] loop0: p96 start 1 is beyond EOD, truncated [ 277.569901] loop0: p97 start 1 is beyond EOD, truncated [ 277.575449] loop0: p98 start 1 is beyond EOD, truncated [ 277.580828] loop0: p99 start 1 is beyond EOD, truncated [ 277.586438] loop0: p100 start 1 is beyond EOD, truncated [ 277.591915] loop0: p101 start 1 is beyond EOD, truncated [ 277.597526] loop0: p102 start 1 is beyond EOD, truncated [ 277.602992] loop0: p103 start 1 is beyond EOD, truncated [ 277.608553] loop0: p104 start 1 is beyond EOD, truncated [ 277.614013] loop0: p105 start 1 is beyond EOD, truncated [ 277.619538] loop0: p106 start 1 is beyond EOD, truncated [ 277.624996] loop0: p107 start 1 is beyond EOD, truncated [ 277.630527] loop0: p108 start 1 is beyond EOD, truncated [ 277.636196] loop0: p109 start 1 is beyond EOD, truncated [ 277.641660] loop0: p110 start 1 is beyond EOD, truncated [ 277.647188] loop0: p111 start 1 is beyond EOD, truncated [ 277.652653] loop0: p112 start 1 is beyond EOD, truncated [ 277.658199] loop0: p113 start 1 is beyond EOD, truncated [ 277.663668] loop0: p114 start 1 is beyond EOD, truncated [ 277.669195] loop0: p115 start 1 is beyond EOD, truncated [ 277.674656] loop0: p116 start 1 is beyond EOD, truncated [ 277.680183] loop0: p117 start 1 is beyond EOD, truncated [ 277.685720] loop0: p118 start 1 is beyond EOD, truncated [ 277.691181] loop0: p119 start 1 is beyond EOD, truncated [ 277.696735] loop0: p120 start 1 is beyond EOD, truncated [ 277.702221] loop0: p121 start 1 is beyond EOD, truncated [ 277.707749] loop0: p122 start 1 is beyond EOD, truncated [ 277.713221] loop0: p123 start 1 is beyond EOD, truncated [ 277.718781] loop0: p124 start 1 is beyond EOD, truncated [ 277.724248] loop0: p125 start 1 is beyond EOD, truncated [ 277.729805] loop0: p126 start 1 is beyond EOD, truncated [ 277.735341] loop0: p127 start 1 is beyond EOD, truncated [ 277.740830] loop0: p128 start 1 is beyond EOD, truncated [ 277.746350] loop0: p129 start 1 is beyond EOD, truncated [ 277.751817] loop0: p130 start 1 is beyond EOD, truncated [ 277.757370] loop0: p131 start 1 is beyond EOD, truncated [ 277.762839] loop0: p132 start 1 is beyond EOD, truncated [ 277.768370] loop0: p133 start 1 is beyond EOD, truncated [ 277.773844] loop0: p134 start 1 is beyond EOD, truncated [ 277.779362] loop0: p135 start 1 is beyond EOD, truncated [ 277.784843] loop0: p136 start 1 is beyond EOD, truncated [ 277.790392] loop0: p137 start 1 is beyond EOD, truncated [ 277.795936] loop0: p138 start 1 is beyond EOD, truncated [ 277.801466] loop0: p139 start 1 is beyond EOD, truncated [ 277.807007] loop0: p140 start 1 is beyond EOD, truncated [ 277.812610] loop0: p141 start 1 is beyond EOD, truncated [ 277.818321] loop0: p142 start 1 is beyond EOD, truncated [ 277.823895] loop0: p143 start 1 is beyond EOD, truncated [ 277.829533] loop0: p144 start 1 is beyond EOD, truncated [ 277.835002] loop0: p145 start 1 is beyond EOD, truncated [ 277.840671] loop0: p146 start 1 is beyond EOD, truncated [ 277.846249] loop0: p147 start 1 is beyond EOD, truncated [ 277.851725] loop0: p148 start 1 is beyond EOD, truncated [ 277.857256] loop0: p149 start 1 is beyond EOD, truncated [ 277.862727] loop0: p150 start 1 is beyond EOD, truncated [ 277.868238] loop0: p151 start 1 is beyond EOD, truncated [ 277.873714] loop0: p152 start 1 is beyond EOD, truncated [ 277.879913] loop0: p153 start 1 is beyond EOD, truncated [ 277.885495] loop0: p154 start 1 is beyond EOD, truncated [ 277.890966] loop0: p155 start 1 is beyond EOD, truncated [ 277.896600] loop0: p156 start 1 is beyond EOD, truncated [ 277.902293] loop0: p157 start 1 is beyond EOD, truncated [ 277.907938] loop0: p158 start 1 is beyond EOD, truncated [ 277.913414] loop0: p159 start 1 is beyond EOD, truncated [ 277.919030] loop0: p160 start 1 is beyond EOD, truncated [ 277.924495] loop0: p161 start 1 is beyond EOD, truncated [ 277.930045] loop0: p162 start 1 is beyond EOD, truncated [ 277.935724] loop0: p163 start 1 is beyond EOD, truncated [ 277.941202] loop0: p164 start 1 is beyond EOD, truncated [ 277.946797] loop0: p165 start 1 is beyond EOD, truncated [ 277.952272] loop0: p166 start 1 is beyond EOD, truncated [ 277.957827] loop0: p167 start 1 is beyond EOD, truncated [ 277.963423] loop0: p168 start 1 is beyond EOD, truncated [ 277.968990] loop0: p169 start 1 is beyond EOD, truncated [ 277.974459] loop0: p170 start 1 is beyond EOD, truncated [ 277.980011] loop0: p171 start 1 is beyond EOD, truncated [ 277.985623] loop0: p172 start 1 is beyond EOD, truncated [ 277.991139] loop0: p173 start 1 is beyond EOD, truncated [ 277.996684] loop0: p174 start 1 is beyond EOD, truncated [ 278.002160] loop0: p175 start 1 is beyond EOD, truncated [ 278.007874] loop0: p176 start 1 is beyond EOD, truncated [ 278.013344] loop0: p177 start 1 is beyond EOD, truncated [ 278.018879] loop0: p178 start 1 is beyond EOD, truncated [ 278.024483] loop0: p179 start 1 is beyond EOD, truncated [ 278.030031] loop0: p180 start 1 is beyond EOD, truncated [ 278.035580] loop0: p181 start 1 is beyond EOD, truncated [ 278.041055] loop0: p182 start 1 is beyond EOD, truncated [ 278.046624] loop0: p183 start 1 is beyond EOD, truncated [ 278.052096] loop0: p184 start 1 is beyond EOD, truncated [ 278.057745] loop0: p185 start 1 is beyond EOD, truncated [ 278.063244] loop0: p186 start 1 is beyond EOD, truncated [ 278.068793] loop0: p187 start 1 is beyond EOD, truncated [ 278.074263] loop0: p188 start 1 is beyond EOD, truncated [ 278.080089] loop0: p189 start 1 is beyond EOD, truncated [ 278.085679] loop0: p190 start 1 is beyond EOD, truncated [ 278.091145] loop0: p191 start 1 is beyond EOD, truncated [ 278.096716] loop0: p192 start 1 is beyond EOD, truncated [ 278.102196] loop0: p193 start 1 is beyond EOD, truncated [ 278.107716] loop0: p194 start 1 is beyond EOD, truncated [ 278.113217] loop0: p195 start 1 is beyond EOD, truncated [ 278.118895] loop0: p196 start 1 is beyond EOD, truncated [ 278.124378] loop0: p197 start 1 is beyond EOD, truncated [ 278.129939] loop0: p198 start 1 is beyond EOD, truncated [ 278.135475] loop0: p199 start 1 is beyond EOD, truncated [ 278.140940] loop0: p200 start 1 is beyond EOD, truncated [ 278.146543] loop0: p201 start 1 is beyond EOD, truncated [ 278.152012] loop0: p202 start 1 is beyond EOD, truncated [ 278.157588] loop0: p203 start 1 is beyond EOD, truncated [ 278.163070] loop0: p204 start 1 is beyond EOD, truncated [ 278.168614] loop0: p205 start 1 is beyond EOD, truncated [ 278.174093] loop0: p206 start 1 is beyond EOD, truncated [ 278.179639] loop0: p207 start 1 is beyond EOD, truncated [ 278.185279] loop0: p208 start 1 is beyond EOD, truncated [ 278.190748] loop0: p209 start 1 is beyond EOD, truncated [ 278.196458] loop0: p210 start 1 is beyond EOD, truncated [ 278.201954] loop0: p211 start 1 is beyond EOD, truncated [ 278.207607] loop0: p212 start 1 is beyond EOD, truncated [ 278.213227] loop0: p213 start 1 is beyond EOD, truncated [ 278.218811] loop0: p214 start 1 is beyond EOD, truncated [ 278.224284] loop0: p215 start 1 is beyond EOD, truncated [ 278.229814] loop0: p216 start 1 is beyond EOD, truncated [ 278.235356] loop0: p217 start 1 is beyond EOD, truncated [ 278.240920] loop0: p218 start 1 is beyond EOD, truncated [ 278.246452] loop0: p219 start 1 is beyond EOD, truncated [ 278.251932] loop0: p220 start 1 is beyond EOD, truncated [ 278.257604] loop0: p221 start 1 is beyond EOD, truncated [ 278.263095] loop0: p222 start 1 is beyond EOD, truncated [ 278.268641] loop0: p223 start 1 is beyond EOD, truncated [ 278.274246] loop0: p224 start 1 is beyond EOD, truncated [ 278.279789] loop0: p225 start 1 is beyond EOD, truncated [ 278.285328] loop0: p226 start 1 is beyond EOD, truncated [ 278.290781] loop0: p227 start 1 is beyond EOD, truncated [ 278.296303] loop0: p228 start 1 is beyond EOD, truncated [ 278.301777] loop0: p229 start 1 is beyond EOD, truncated [ 278.307306] loop0: p230 start 1 is beyond EOD, truncated [ 278.312777] loop0: p231 start 1 is beyond EOD, truncated [ 278.318324] loop0: p232 start 1 is beyond EOD, truncated [ 278.323783] loop0: p233 start 1 is beyond EOD, truncated [ 278.329287] loop0: p234 start 1 is beyond EOD, truncated [ 278.334760] loop0: p235 start 1 is beyond EOD, truncated [ 278.340326] loop0: p236 start 1 is beyond EOD, truncated [ 278.345854] loop0: p237 start 1 is beyond EOD, truncated [ 278.351313] loop0: p238 start 1 is beyond EOD, truncated [ 278.356862] loop0: p239 start 1 is beyond EOD, truncated [ 278.362323] loop0: p240 start 1 is beyond EOD, truncated [ 278.367866] loop0: p241 start 1 is beyond EOD, truncated [ 278.373504] loop0: p242 start 1 is beyond EOD, truncated [ 278.379102] loop0: p243 start 1 is beyond EOD, truncated [ 278.384574] loop0: p244 start 1 is beyond EOD, truncated [ 278.390149] loop0: p245 start 1 is beyond EOD, truncated [ 278.395756] loop0: p246 start 1 is beyond EOD, truncated [ 278.401200] loop0: p247 start 1 is beyond EOD, truncated [ 278.406849] loop0: p248 start 1 is beyond EOD, truncated [ 278.412317] loop0: p249 start 1 is beyond EOD, truncated [ 278.417864] loop0: p250 start 1 is beyond EOD, truncated [ 278.423328] loop0: p251 start 1 is beyond EOD, truncated [ 278.428944] loop0: p252 start 1 is beyond EOD, truncated [ 278.434426] loop0: p253 start 1 is beyond EOD, truncated [ 278.440027] loop0: p254 start 1 is beyond EOD, truncated [ 278.445556] loop0: p255 start 1 is beyond EOD, truncated 16:08:00 executing program 0: mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='overlay\x00', 0x0, &(0x7f0000000180)={[{@redirect_dir={'redirect_dir', 0x3d, './file0'}}]}) 16:08:00 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) dup3(r1, r0, 0x0) 16:08:00 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:00 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, 0xffffffffffffffff, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x400300, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in, @in6=@mcast2}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}}}]}, 0xa0}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:00 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x0) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:08:00 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000008c0)='./file0\x00', 0x0, 0x0) ftruncate(r1, 0x28007d) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000d83ff8), 0x2008000fffffffe) ioctl$PIO_UNISCRNMAP(r1, 0x4b6a, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f00000001c0), 0x8080fffffffe) 16:08:00 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, 0xffffffffffffffff, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x400300, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in, @in6=@mcast2}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}}}]}, 0xa0}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) [ 278.623324] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 278.645653] FAT-fs (loop3): Filesystem has been set read-only 16:08:01 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) [ 278.676924] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) [ 278.688585] overlayfs: bad mount option "redirect_dir=./file0" 16:08:01 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x0) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:08:01 executing program 0: creat(&(0x7f0000000040)='./bus\x00', 0x0) mkdir(&(0x7f0000000500)='./file1\x00', 0x0) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='bpf\x00', 0x0, 0x0) mount$overlay(0x400009, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) 16:08:01 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000008c0)='./file0\x00', 0x0, 0x0) ftruncate(r1, 0x28007d) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000d83ff8), 0x2008000fffffffe) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r3 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r3, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r3, r3, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) 16:08:01 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, 0xffffffffffffffff, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x400300, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in, @in6=@mcast2}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}}}]}, 0xa0}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) [ 278.880332] overlayfs: workdir and upperdir must reside under the same mount 16:08:01 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 278.926645] overlayfs: workdir and upperdir must reside under the same mount [ 279.124003] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 279.136905] FAT-fs (loop3): Filesystem has been set read-only [ 279.143248] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) [ 279.155117] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 279.164908] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:08:01 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) dup3(r1, r0, 0x0) 16:08:01 executing program 0: creat(&(0x7f0000000040)='./bus\x00', 0x0) mkdir(&(0x7f0000000500)='./file1\x00', 0x0) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='bpf\x00', 0x0, 0x0) mount$overlay(0x400009, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) 16:08:01 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x0) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:01 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x400300, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in, @in6=@mcast2}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}}}]}, 0xa0}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:01 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:08:01 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000008c0)='./file0\x00', 0x0, 0x0) ftruncate(r1, 0x28007d) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r3 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r3, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r3, r3, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) 16:08:01 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 279.455972] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 279.466726] overlayfs: workdir and upperdir must reside under the same mount 16:08:01 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x400300, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in, @in6=@mcast2}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}}}]}, 0xa0}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:01 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x0) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) [ 279.504271] FAT-fs (loop3): Filesystem has been set read-only 16:08:01 executing program 0: mkdir(&(0x7f0000000100)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) chdir(&(0x7f0000000280)='./file0\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r0, 0x401c5820, 0x0) 16:08:01 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, 0x0, 0x0) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 279.568658] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:08:01 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000008c0)='./file0\x00', 0x0, 0x0) ftruncate(r1, 0x28007d) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r3 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r3, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r3, r3, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) [ 279.868154] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 279.886660] FAT-fs (loop3): Filesystem has been set read-only [ 279.893216] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) [ 279.906622] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 279.915721] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:08:02 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) dup3(r1, r0, 0x0) 16:08:02 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x400300, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in, @in6=@mcast2}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}}}]}, 0xa0}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:02 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, 0x0, 0x0) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:08:02 executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$f2fs(&(0x7f00000015c0)='f2fs\x00', &(0x7f0000000340)='./file0\x00', 0xe00000000000000, 0x1, &(0x7f0000000200)=[{&(0x7f00000000c0)="1020f5f20100070009000000030000000c0000000900000001000000020000000000000000300000000000000e00000018000000020000000200000002000000020000000e000000000400000004000000080000000c00000010000000140000030000000100000002", 0x69, 0x1400}], 0x1, 0x0) unshare(0x0) socket(0x0, 0x0, 0x0) pwrite64(0xffffffffffffffff, 0x0, 0x0, 0x0) 16:08:02 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x0) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:02 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) open(&(0x7f00000008c0)='./file0\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:08:02 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, 0x0, 0x0) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 280.402589] f2fs_msg: 2 callbacks suppressed [ 280.402604] F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 280.436613] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock 16:08:02 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:02 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0x0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) [ 280.498758] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 280.521557] F2FS-fs (loop0): Fix alignment : internally, start(5120) end(13312) block(7168) [ 280.573396] FAT-fs (loop3): Filesystem has been set read-only [ 280.593030] F2FS-fs (loop0): invalid crc value 16:08:02 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 280.617150] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) [ 280.629721] F2FS-fs (loop0): invalid crc value [ 280.650341] F2FS-fs (loop0): Failed to get valid F2FS checkpoint 16:08:03 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0x0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) [ 280.662895] F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 280.664980] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 280.673169] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock 16:08:03 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) [ 280.721281] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) [ 280.725418] F2FS-fs (loop0): invalid crc value 16:08:03 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) dup3(0xffffffffffffffff, r0, 0x0) [ 280.779998] F2FS-fs (loop0): invalid crc value 16:08:03 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:08:03 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:08:03 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ptrace(0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = creat(&(0x7f0000000180)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000402) fallocate(r0, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f00000000c0)={0x4, r1, 0x83}) wait4(0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000100)='./file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, 0x0) 16:08:03 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:03 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0x0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:03 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 281.115902] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 281.131816] overlayfs: missing 'lowerdir' [ 281.143775] FAT-fs (loop3): Filesystem has been set read-only [ 281.151867] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:08:03 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, 0x0}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:03 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, 0x0) io_submit(0x0, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r1 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r1, 0x1000000000016) r2 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r2, r0) [ 281.168300] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 281.178149] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:08:03 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x0, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:08:03 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) r0 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r0, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r0, r0, &(0x7f00000001c0), 0x8080fffffffe) 16:08:03 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x0, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 281.395849] kauditd_printk_skb: 1 callbacks suppressed [ 281.395864] audit: type=1800 audit(1578672483.711:64): pid=11743 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=17036 res=0 16:08:04 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, 0x0) io_submit(0x0, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r1 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r1, 0x1000000000016) r2 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r2, r0) 16:08:04 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, 0x0}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:04 executing program 0: r0 = memfd_create(&(0x7f0000000100)='\xed\x13m1\xc1\xf8\xa6\x01\x00l\x1c\xd0O\x83$\xba\xe5\xf4\x97\xac#*\xff', 0x0) write(r0, &(0x7f0000000040)="06", 0x1) sendfile(r0, r0, &(0x7f0000001000), 0xffff) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x2d013, r0, 0x0) 16:08:04 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x0, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:08:04 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) dup3(0xffffffffffffffff, r0, 0x0) 16:08:04 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, 0x0) io_submit(0x0, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r1 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r1, 0x1000000000016) r2 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r2, r0) 16:08:04 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, 0x0, 0x0) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:08:04 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, 0x0}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:04 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, 0x0, 0x0) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:08:04 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)) io_submit(0x0, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r1 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r1, 0x1000000000016) r2 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r2, r0) 16:08:04 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) r0 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r0, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r0, r0, &(0x7f00000001c0), 0x8080fffffffe) 16:08:04 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={0x0}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:04 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, 0x0, 0x0) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:08:04 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)) io_submit(0x0, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r1 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r1, 0x1000000000016) r2 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r2, r0) 16:08:05 executing program 0: r0 = socket(0x20000000010, 0x400000000080803, 0x0) write(r0, &(0x7f0000007940)="240000001a0025f00485bc04fef7001d0a0b49ffed00000080002800080003003f020000", 0x24) 16:08:05 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140), 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:08:05 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) dup3(0xffffffffffffffff, r0, 0x0) 16:08:05 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={0x0}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:05 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)) io_submit(0x0, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r1 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r1, 0x1000000000016) r2 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r2, r0) 16:08:05 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140), 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:08:05 executing program 0: io_setup(0x1, &(0x7f00000001c0)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x101a06, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000004c0)={'\x00', 0x20000005442}) io_submit(r0, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040)="590332669fedb004f60f", 0xffb4}]) 16:08:05 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) [ 282.986451] skbuff: bad partial csum: csum=1200/4086 headroom=64 headlen=3712 16:08:05 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140), 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:08:05 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={0x0}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:05 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:05 executing program 0: clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000040)='asymmetric\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\trust\xe3cusgrVex:De', 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x8, &(0x7f0000000140)=[{&(0x7f0000000180)="eb3c906d6b66732e666174000204010002000270fff8a2eb21fba144e7da0f629fb4078533e2e7227178c092779b2827e784b54bf1be0247287ac543f6b0b287abbef6daf25cb209000000000000004d74337aa118763fb517e7f1b5c5c60670ccb6d139cd319404f61fee927be4bea0f14afa9ca9acd7f273e0f39f8c61327a9021deda36b415a83163067259de9479c7a6c4bdfa2746aa1b06234c10392753d16098309ee309158676449c26e51022e8c6efbdcc3c3792c4e3c09cebf7724bee4385c047c722c1ddc2a6d1ad84df3ff84e3fe5bfb676a191340a4a8a874fb38e1bc81baf5d52e90d6aba894be323392ced2a245c256b7af3ed76b338f44a1475a1", 0x81af8f65b352f434}], 0x2000, 0x0) 16:08:05 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) r0 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r0, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r0, r0, &(0x7f00000001c0), 0x8080fffffffe) 16:08:05 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:08:06 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, 0xffffffffffffffff, 0x0) 16:08:06 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:06 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0x0, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x400300, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in, @in6=@mcast2}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}}}]}, 0xa0}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:06 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:08:06 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:08:06 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0x0, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x400300, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in, @in6=@mcast2}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}}}]}, 0xa0}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:06 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) fchdir(r0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0xffffffffffffff92}], 0x0, 0x0) umount2(&(0x7f0000000540)='./file0\x00', 0x0) 16:08:06 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x0, &(0x7f00000005c0)) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:06 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, 0x0, 0x0) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:08:06 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0x0, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x400300, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in, @in6=@mcast2}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}}}]}, 0xa0}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:06 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) fchdir(0xffffffffffffffff) r0 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r0, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r0, r0, &(0x7f00000001c0), 0x8080fffffffe) 16:08:06 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, 0x0, 0x0) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:08:06 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, 0x0, 0x0) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:08:06 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x0, &(0x7f00000005c0)) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:06 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x400300, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in, @in6=@mcast2}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}}]}, 0x78}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:06 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, 0xffffffffffffffff, 0x0) 16:08:06 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:07 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:08:07 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x400300, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in, @in6=@mcast2}}]}, 0x50}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:07 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x0, &(0x7f00000005c0)) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:07 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:07 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:08:07 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) fchdir(0xffffffffffffffff) r0 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r0, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r0, r0, &(0x7f00000001c0), 0x8080fffffffe) 16:08:07 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:07 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:08:07 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[0x0]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:07 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:07 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=@known='system.sockprotoname\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000540)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(r1, 0xffffffffffffffff, 0x0) 16:08:07 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x0, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:08:07 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:07 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:07 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[0x0]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:07 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x0, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:08:08 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x0, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:08:08 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) fchdir(0xffffffffffffffff) r0 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r0, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r0, r0, &(0x7f00000001c0), 0x8080fffffffe) 16:08:08 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[0x0]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:08 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:08 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) getdents(0xffffffffffffffff, &(0x7f0000001440)=""/177, 0xb1) 16:08:08 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, 0x0, 0x0) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:08:08 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) getdents(0xffffffffffffffff, &(0x7f0000001440)=""/177, 0xb1) 16:08:08 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, 0x0, 0x0) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:08:08 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:08 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:08 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:08 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, 0x0, 0x0) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:08:09 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x0, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:09 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:09 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) getdents(0xffffffffffffffff, &(0x7f0000001440)=""/177, 0xb1) 16:08:09 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100), 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:08:09 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x0, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:09 executing program 3: r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:08:09 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:09 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100), 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:08:09 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:09 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:09 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x0, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:09 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:09 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100), 0x4) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 16:08:09 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, 0x0, 0x0) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) [ 287.618370] overlayfs: failed to resolve './bus': -2 16:08:10 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:10 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:10 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) write$binfmt_elf32(r0, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r2 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r1, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r2, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r2, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x10005, 0x0) 16:08:10 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:10 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, 0x0, 0x0) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:10 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:10 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) write$binfmt_elf32(r0, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r2 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r1, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r2, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r2, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x10005, 0x0) 16:08:10 executing program 3: r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:08:10 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:10 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) write$binfmt_elf32(r0, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r2 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r1, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r2, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r2, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x10005, 0x0) 16:08:10 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:10 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') open(&(0x7f0000000040)='.\x00', 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, &(0x7f0000001440)=""/177, 0xb1) 16:08:10 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:10 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, 0x0, 0x0) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:10 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x10005, 0x0) 16:08:11 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:11 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x10005, 0x0) 16:08:11 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:11 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:11 executing program 3: r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:08:11 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') open(&(0x7f0000000040)='.\x00', 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, &(0x7f0000001440)=""/177, 0xb1) 16:08:11 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x10005, 0x0) 16:08:11 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:11 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:11 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(0xffffffffffffffff, &(0x7f00000008c0)=""/105, 0x69) 16:08:11 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x0, 0x0) 16:08:11 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') open(&(0x7f0000000040)='.\x00', 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, &(0x7f0000001440)=""/177, 0xb1) 16:08:11 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:11 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(0xffffffffffffffff, &(0x7f00000008c0)=""/105, 0x69) 16:08:11 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:11 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x0, 0x0) 16:08:12 executing program 3: syz_mount_image$vfat(0x0, &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:08:12 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, 0x0, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:12 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000dc0)=ANY=[@ANYRESOCT], 0x17) r3 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x100, 0x4) splice(r0, 0x0, r2, 0x0, 0x0, 0x0) 16:08:12 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(0xffffffffffffffff, &(0x7f00000008c0)=""/105, 0x69) 16:08:12 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') getdents(0xffffffffffffffff, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, &(0x7f0000001440)=""/177, 0xb1) 16:08:12 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:12 executing program 1: r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:12 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000740)=@ipv4_newroute={0x24, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x1}, [@RTA_GATEWAY={0x8, 0x5, @loopback}]}, 0x24}}, 0x0) 16:08:12 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') getdents(0xffffffffffffffff, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, &(0x7f0000001440)=""/177, 0xb1) 16:08:12 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, 0x0, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:12 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, 0x0, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:12 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='.\x00', 0x0, 0x0) r1 = dup2(r0, r0) r2 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f0000000380)='threaded\x00', 0x20a9d7b6) unlinkat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) 16:08:13 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, 0x0, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:13 executing program 1: r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:13 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') getdents(0xffffffffffffffff, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, &(0x7f0000001440)=""/177, 0xb1) 16:08:13 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, 0x0, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:13 executing program 5: mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) chdir(&(0x7f0000000280)='./file0\x00') r0 = creat(&(0x7f0000001c00)='./bus\x00', 0x0) write$binfmt_script(r0, &(0x7f00000002c0)=ANY=[@ANYBLOB='#'], 0x1) ftruncate(r0, 0x0) write$P9_RVERSION(r0, &(0x7f00000000c0)={0x13, 0x65, 0xffff, 0x0, 0x6, '9P2000'}, 0x13) 16:08:13 executing program 3: syz_mount_image$vfat(0x0, &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:08:13 executing program 1: r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:13 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:13 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:13 executing program 1: syz_mount_image$msdos(0x0, &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:13 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, 0x0, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:13 executing program 5: mkdir(&(0x7f0000000380)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f00000003c0)='./bus\x00', 0x2) 16:08:13 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:14 executing program 3: syz_mount_image$vfat(0x0, &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:08:14 executing program 1: syz_mount_image$msdos(0x0, &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:14 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0), &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:14 executing program 5: accept$inet6(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) connect$tipc(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000000080)='./file0\x00', 0x1070c5, 0x0) r2 = open$dir(&(0x7f0000000380)='./file0\x00', 0x0, 0x0) write$9p(r1, &(0x7f0000001400)="3b27a4b46ee92b4a59073c369a5e19f9db153c4fdbc76aa2a4bb9f3e5e1aa197a9e97d1016c01813792e50c2692c175aad715d110a892949ccc6e2e54c2d5c8f0b7932b69797f217168b0c1feb128ae34f0daf487a70b5c117acd43725fe17993634f1695dabd7f998cd55e9d5bd911e86aa7a4ad75a574bb96951d6018b25d942a9544bca1ebb0e8d10c092cdcb85797673972099e4041aaf8d636f66cb1103ef2050ad28fabaed33d6927889d97f4b5ce0de71d3fd832980f4f088d0d824e20549b4bbd906ffa51ce9de54d779eb4de462faac20a3ab0ed9934373ca22cea5454f4c2a740cd461e39956bb5f98df2aebc60cf32623adbffbcc378fa7250b6a3fc863dadcf6d4f8b855c4e70f0796eee6218445dad2811dd6b540ff52efa2f167dd9c1b8b016268d37db430983fefc0645d20614c8df2eb0872c58e09664e672b0b6a9970fec199257e1c606ec3e364c66a0f4d258c74accd43b987c756d602fd8787fed3aa43fd8d84e9656d4a413fa9a423bc54b873583d6d497005e54712fafc71384988d80134fbf84f53fdd74b354848006b8b5b67e7cc5a472475d3ae545ca1fcf7628b873e31ba83a98a7ad5b0cfbe9711b517a9a1388ad0efa2a3b4e22152021d631b731e2e100a9831111db7acce948bb5deeea260463c140ac929e77c58402776caf85d4569a75dde2f64c4491508afb541ed9b2c81fc95c06706235f383e31cf662c95b1e49cfd94871e22720a41535756e419b271276941692bd023dd9c9dbec4f7db1e5c00d8b3be7b8e826a6aadd001edd0dfeb00f8048442b5c48456fd642e629dcb2ff55592665ff491cd832672ce4d999da186db2c3a1f8b6b1f7d3750d7cdb3097954e6e14fb2183ad662c63d4ce8b82dc2487f0fe2ea2827b53a7c6dcced878d2fb29c1d3ff583570e7bc172d1a5c716e0447cb08ce3c468ffdf975da372f3f3eb455aaf5822bc04a51b6cad24a2331369df81c123b009a2381b42e9aeb077f621608d81c12a5f5c6c295d74afd4dd5c051296be0b54c70bf899b347c36bff62", 0x2ea) sendfile(r1, r2, 0x0, 0x10000) connect$inet6(0xffffffffffffffff, 0x0, 0x0) 16:08:14 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:14 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:14 executing program 1: syz_mount_image$msdos(0x0, &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:14 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) [ 292.107764] audit: type=1804 audit(1578672494.431:65): pid=12600 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir839441714/syzkaller.VTwmM1/169/file0/file0" dev="loop5" ino=38 res=1 16:08:14 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={0x0}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:14 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x8, 0x4, &(0x7f0000000100)=ANY=[@ANYBLOB="b40500000000000071108000000000001d00000000000000950000000000000066490a80b955dcbf7f8c415e61b150af0b1a2c022e42351cbc4db97c749581aa9fc93da4a05a8ff62a3ca6685473ec41a80ad5ac41626a5dc590f0a9eaff93f55be5cd137dd9f9fba0bc14a22fbf159cea9e27d7053affb68b713cefd433c48a0816"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/190, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffd06, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) 16:08:14 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:14 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={0x0}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:15 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000000c0)={@mcast1, 0x800, 0x0, 0x103, 0x1}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f00000005c0)=0x1, 0x4) sendmsg$inet6(r0, &(0x7f0000000180)={&(0x7f0000000080)={0xa, 0x4f24, 0x1000000080000, @remote, 0x1}, 0x1c, 0x0, 0x0, &(0x7f0000000000)=[@rthdrdstopts={{0x30, 0x29, 0x2, {0x0, 0x3, [], [@jumbo, @hao={0xc9, 0x10, @mcast2}]}}}], 0x30}, 0x0) 16:08:15 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', 0x0, 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:17 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', 0x0, 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:08:17 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0), &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:17 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={0x0}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:17 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:17 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', 0x0, 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:17 executing program 5: dup(0xffffffffffffffff) perf_event_open(&(0x7f0000000100)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0x80000001, 0x1, &(0x7f0000000080)=[{&(0x7f00000001c0)="800000001000000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0x3a, 0x400}], 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, 0x0, 0x2, 0x0) 16:08:17 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) [ 295.247103] EXT4-fs (loop5): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock 16:08:17 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x0, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) [ 295.325995] EXT4-fs (loop5): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 295.375707] EXT4-fs (loop5): ext4_check_descriptors: Inode table for group 0 overlaps superblock 16:08:17 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', 0x0, 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:17 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) [ 295.424499] EXT4-fs error (device loop5): ext4_fill_super:4398: inode #2: comm syz-executor.5: iget: root inode unallocated [ 295.441758] EXT4-fs (loop5): get root inode failed [ 295.448066] EXT4-fs (loop5): mount failed [ 295.568967] overlayfs: failed to resolve './file0': -2 16:08:17 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:17 executing program 5: accept(0xffffffffffffffff, &(0x7f00000001c0)=@caif=@dgm, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fchdir(0xffffffffffffffff) syz_mount_image$vfat(0x0, &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{0x0}], 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0x5, &(0x7f0000000080)=0x4, 0x4) [ 295.777879] overlayfs: failed to resolve './file0': -2 16:08:18 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x0, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:20 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0), &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:20 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:20 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:20 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', 0x0, 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:08:20 executing program 5: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(0x0, &(0x7f000000aff8)='./file0\x00', &(0x7f0000000040)='ramfs\x00', 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') mount$fuseblk(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x20, &(0x7f0000000140)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[], [{@context={'context', 0x3d, 'staff_u'}, 0x22}], 0x22}}) 16:08:20 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x0, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) [ 298.452845] SELinux: security_context_str_to_sid(staff_unts) failed for (dev ramfs, type ramfs) errno=-22 [ 298.475558] overlayfs: failed to resolve './file0': -2 16:08:20 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) [ 298.513480] FAT-fs (loop1): bogus number of reserved sectors [ 298.526179] FAT-fs (loop1): Can't find a valid FAT filesystem 16:08:20 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:20 executing program 5: syz_read_part_table(0x3f000000, 0x0, 0x0) 16:08:21 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:21 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:21 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) [ 298.828661] FAT-fs (loop1): bogus number of reserved sectors [ 298.862910] FAT-fs (loop1): Can't find a valid FAT filesystem 16:08:23 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:23 executing program 5: prlimit64(0x0, 0xe, 0x0, 0x0) pipe(&(0x7f0000000680)) sched_setscheduler(0x0, 0x0, &(0x7f0000000380)) r0 = dup(0xffffffffffffffff) setsockopt$packet_int(r0, 0x107, 0x10000000000f, 0x0, 0x0) r1 = getpgrp(0x0) capget(&(0x7f0000000000)={0x0, r1}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000000)='./file0\x00', 0x1070c5, 0x28) write$9p(r2, &(0x7f0000001400)="3b27a4b46ee92b4a59073c369a5e19f9db153c4fdbc76aa2a4bb9f3e5e1aa197a9e97d1016c01813792e50c2692c175aad715d110a892949ccc6e2e54c2d5c8f0b7932b69797f217168b0c1feb128ae34f0daf487a70b5c117acd43725fe17993634f1695dabd7f998cd55e9d5bd911e86aa7a4ad75a574bb96951d6018b25d942a9544bca1ebb0e8d10c092cdcb85797673972099e4041aaf8d636f66cb1103ef2050ad28fabaed33d6927889d97f4b5ce0de71d3fd832980f4f088d0d824e20549b4bbd906ffa51ce9de54d779eb4de462faac20a3ab0ed9934373ca22cea5454f4c2a740cd461e39956bb5f98df2aebc60cf32623adbffbcc378fa7250b6a3fc863dadcf6d4f8b855c4e70f0796eee6218445dad2811dd6b540ff52efa2f167dd9c1b8b016268d37db430983fefc0645d20614c8df2eb0872c58e09664e672b0b6a9970fec199257e1c606ec3e364c66a0f4d258c74accd43b987c756d602fd8787fed3aa43fd8d84e9656d4a413fa9a423bc54b873583d6d497005e54712fafc71384988d80134fbf84f53fdd74b354848006b8b5b67e7cc5a472475d3ae545ca1fcf7628b873e31ba83a98a7ad5b0cfbe9711b517a9a1388ad0efa2a3b4e22152021d631b731e2e100a9831111db7acce948bb5deeea260463c140ac929e77c58402776caf85d4569a75dde2f64c4491508afb541ed9b2c81fc95c06706235f383e31cf662c95b1e49cfd94871e22720a41535756e419b271276941692bd023dd9c9dbec4f7db1e5c00d8b3be7b8e826a6aadd001edd0dfeb00f8048442b5c48456fd642e629dcb2ff55592665ff491cd832672ce4d999da186db2c3a1f8b6b1f7d3750d7cdb3097954e6e14fb2183ad662c63d4ce8b82dc2487f0fe2ea2827b53a7c6dcced878d2fb29c1d3ff583570e7bc172d1a5c716e0447cb08ce3c468ffdf975da372f3f3eb455aaf5822bc04a51b6cad24a2331369df81c123b009a2381b42e9aeb077f621608d81c12a5f5c6c295d74afd4dd5c051296be0b54c70bf899b347c36bff62f313079983409d7f9cf1242c917985c1b5d0736fe21f8514f63d0369a374c42da40bd5140bc3e602d00c3cb4f8e621863ab47422778d67d72de34753fd72cef80649a1548e4e8dcbcffe4054cc9d8a1f922623a75904cbdaacde768131e587269a4a99d82f7009c1b8ab79aa232a2fd45ad71b603803123f6ba979fa6a87525884b08d721a21400fb1f950b96ead82f408cc4388d3b78fb456616429a520656d5e5a876fd04748498902c86f58d45f4c1b3919eb846a00edf07e7a830bf723e4774f085f15534dd3b5246c0c0970b5ad7bb39b30b156a9430378c5b0aab1261c78d72ac301cd552d5e8dd4b642ec1dc0672745d593bb26d095b5b23576e3cfd6ab580f6e09419d0f0c64250fafaa3759aa1888da48d89c3f7c9454b0b3d0ab40445f5bed4493ef43ab08f31b1345ac4ffd94ad79c9eee53904ed6f572817153190d2e6863f2e39356bb99926419fd314341a536b7e76cae60bf7750a4c29e3f4c7f005530b1d4ee0e25b93b76fcc1108222f0b00de52cf4100e97adfd7b9db1370586ba27e1e183299be00d0df8439c380edf2f79deb441eac59b814b04accdff5e17f02046139f91f0332661676ff506e575f0cb2850bcc9f8666f6d1f69f8f4271cb804a79fccd7016f049d1a494c26a527c437fa0be6d51ec7543d9bd7a2f016194ebe3c99080a6c9b5119863dfe865f8e60cae29f50b67dbfaa0a3c9794d73034485ca1613344c572783db3dfab01b28089c51cda99cefa4c1c881a29e229f04c7e0fd04dc425ae8417852e6e31520c6207e9d4e35285feef2a2cb8a3bceb08a166fa4284a516362621e2c06731a442791f1db063a32cf1f005c914102c7273cb4d7ab1bf567d72f230783d2ea99c43a60e8729132441ee6c5362c33f9b613f84417c3c5549f4e3d9e73c6f83f16c8e57ae22fe5f54515e111fe43ad7c400d214281452bb6141cecad84b23a695f061988d9", 0x59e) 16:08:23 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:23 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x800000800000012, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:23 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:23 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', 0x0, 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:08:24 executing program 0: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) [ 301.745040] FAT-fs (loop1): bogus number of reserved sectors [ 301.784798] FAT-fs (loop1): Can't find a valid FAT filesystem 16:08:24 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, 0x0, 0x0) [ 301.889034] overlayfs: failed to resolve './file1': -2 16:08:24 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x0, 0x0, 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:24 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000005500)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000380)=0x80000008) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000140)) r2 = syz_open_pts(r0, 0x0) ioctl$TCFLSH(r2, 0x540b, 0x0) 16:08:24 executing program 0: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:24 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, 0x0, 0x0) [ 302.078624] FAT-fs (loop1): bogus number of reserved sectors [ 302.090103] FAT-fs (loop1): Can't find a valid FAT filesystem 16:08:24 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x0, 0x0, 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) [ 302.194590] overlayfs: failed to resolve './file1': -2 16:08:24 executing program 0: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:24 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, 0x0, 0x0) 16:08:24 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x8, 0x4, &(0x7f0000000100)=ANY=[@ANYBLOB="b40500000000000071109900000000001d00000000000000950000000000000066490a80b955dcbf7f8c415e61b150af0b1a2c022e42351cbc4db97c749581aa9fc93da4a05a8ff62a3ca6685473ec41a80ad5ac41626a5dc590f0a9eaff93f55be5cd137dd9f9fba0bc14a22fbf159cea9e27d7053affb68b713cefd433c48a0816"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/190, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffd06, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) [ 302.398102] FAT-fs (loop1): bogus number of reserved sectors [ 302.417785] FAT-fs (loop1): Can't find a valid FAT filesystem [ 302.449795] overlayfs: failed to resolve './file1': -2 16:08:27 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:27 executing program 5: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000280)='devtmpfs\x00', 0x0, 0x0) chdir(&(0x7f00000000c0)='./file0\x00') perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$overlay(0x40000f, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) 16:08:27 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:08:27 executing program 0: mkdir(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:27 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x0, 0x0, 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:27 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) [ 304.879685] FAT-fs (loop3): bogus number of reserved sectors [ 304.903786] FAT-fs (loop1): bogus number of reserved sectors [ 304.907126] overlayfs: failed to resolve './file1': -2 [ 304.918007] overlayfs: conflicting lowerdir path 16:08:27 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) 16:08:27 executing program 0: mkdir(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) [ 304.936119] FAT-fs (loop3): Can't find a valid FAT filesystem [ 304.957912] FAT-fs (loop1): Can't find a valid FAT filesystem 16:08:27 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x0, &(0x7f00000001c0), 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:27 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', &(0x7f0000001740)='bpf\x00', 0x0, &(0x7f0000001780)) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) mount$bpf(0x0, &(0x7f0000000600)='./file0/file0\x00', &(0x7f0000000340)='bpf\x00', 0x100000, &(0x7f0000000540)) mount$bpf(0x20000000, &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000000c0)='bpf\x00', 0x2001001, &(0x7f0000000580)=ANY=[]) mount$bpf(0x0, &(0x7f00000001c0)='./file0/file0\x00', &(0x7f0000000280)='bpf\x00', 0x80000, &(0x7f0000000580)) mount$bpf(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f00000004c0)='bpf\x00', 0x0, &(0x7f00000005c0)) [ 305.154499] overlayfs: failed to resolve './file1': -2 16:08:27 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) 16:08:27 executing program 0: mkdir(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) [ 305.281101] FAT-fs (loop1): bogus number of reserved sectors [ 305.328269] FAT-fs (loop1): Can't find a valid FAT filesystem [ 305.388471] overlayfs: failed to resolve './file1': -2 16:08:30 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', &(0x7f0000001740)='bpf\x00', 0x0, &(0x7f0000001780)) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) mount$bpf(0x0, &(0x7f0000000600)='./file0/file0\x00', &(0x7f0000000340)='bpf\x00', 0x100000, &(0x7f0000000540)) mount$bpf(0x20000000, &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000000c0)='bpf\x00', 0x2001001, &(0x7f0000000580)=ANY=[]) mount$bpf(0x0, &(0x7f00000001c0)='./file0/file0\x00', &(0x7f0000000280)='bpf\x00', 0x80000, &(0x7f0000000580)) mount$bpf(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f00000004c0)='bpf\x00', 0x0, &(0x7f00000005c0)) 16:08:30 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x0, &(0x7f00000001c0), 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:30 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:30 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:30 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) 16:08:30 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) [ 308.074717] FAT-fs (loop1): bogus number of reserved sectors [ 308.076014] FAT-fs (loop3): bogus number of reserved sectors 16:08:30 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:30 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) 16:08:30 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', &(0x7f0000001740)='bpf\x00', 0x0, &(0x7f0000001780)) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) mount$bpf(0x0, &(0x7f0000000600)='./file0/file0\x00', &(0x7f0000000340)='bpf\x00', 0x100000, &(0x7f0000000540)) mount$bpf(0x20000000, &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000000c0)='bpf\x00', 0x2001001, &(0x7f0000000580)=ANY=[]) mount$bpf(0x0, &(0x7f00000001c0)='./file0/file0\x00', &(0x7f0000000280)='bpf\x00', 0x80000, &(0x7f0000000580)) mount$bpf(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f00000004c0)='bpf\x00', 0x0, &(0x7f00000005c0)) [ 308.129584] FAT-fs (loop1): Can't find a valid FAT filesystem [ 308.164329] FAT-fs (loop3): Can't find a valid FAT filesystem 16:08:30 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x0, &(0x7f00000001c0), 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:30 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) [ 308.346488] FAT-fs (loop1): bogus number of reserved sectors [ 308.376556] FAT-fs (loop1): Can't find a valid FAT filesystem 16:08:30 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', &(0x7f0000001740)='bpf\x00', 0x0, &(0x7f0000001780)) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) mount$bpf(0x0, &(0x7f0000000600)='./file0/file0\x00', &(0x7f0000000340)='bpf\x00', 0x100000, &(0x7f0000000540)) mount$bpf(0x20000000, &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000000c0)='bpf\x00', 0x2001001, &(0x7f0000000580)=ANY=[]) mount$bpf(0x0, &(0x7f00000001c0)='./file0/file0\x00', &(0x7f0000000280)='bpf\x00', 0x80000, &(0x7f0000000580)) mount$bpf(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f00000004c0)='bpf\x00', 0x0, &(0x7f00000005c0)) 16:08:30 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) 16:08:30 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{0x0}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) [ 308.610775] FAT-fs (loop1): bogus number of reserved sectors [ 308.622103] FAT-fs (loop1): Can't find a valid FAT filesystem 16:08:33 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x0, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:33 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:33 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', &(0x7f0000001740)='bpf\x00', 0x0, &(0x7f0000001780)) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) mount$bpf(0x0, &(0x7f0000000600)='./file0/file0\x00', &(0x7f0000000340)='bpf\x00', 0x100000, &(0x7f0000000540)) mount$bpf(0x20000000, &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000000c0)='bpf\x00', 0x2001001, &(0x7f0000000580)=ANY=[]) mount$bpf(0x0, &(0x7f00000001c0)='./file0/file0\x00', &(0x7f0000000280)='bpf\x00', 0x80000, &(0x7f0000000580)) mount$bpf(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f00000004c0)='bpf\x00', 0x0, &(0x7f00000005c0)) 16:08:33 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, 0x0, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:33 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{0x0}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:33 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) [ 311.252871] FAT-fs (loop1): bogus number of reserved sectors [ 311.259467] FAT-fs (loop3): bogus number of reserved sectors [ 311.268633] FAT-fs (loop1): Can't find a valid FAT filesystem [ 311.280997] overlayfs: failed to resolve './file0': -2 [ 311.291433] FAT-fs (loop3): Can't find a valid FAT filesystem 16:08:33 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:33 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x0, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 16:08:33 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{0x0}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:33 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', &(0x7f0000001740)='bpf\x00', 0x0, &(0x7f0000001780)) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) mount$bpf(0x0, &(0x7f0000000600)='./file0/file0\x00', &(0x7f0000000340)='bpf\x00', 0x100000, &(0x7f0000000540)) mount$bpf(0x20000000, &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000000c0)='bpf\x00', 0x2001001, &(0x7f0000000580)=ANY=[]) mount$bpf(0x0, &(0x7f00000001c0)='./file0/file0\x00', &(0x7f0000000280)='bpf\x00', 0x80000, &(0x7f0000000580)) [ 311.510729] overlayfs: failed to resolve './file0': -2 16:08:33 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:33 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$key(0xf, 0x3, 0x2) dup3(r0, r1, 0x0) sendmsg$key(r1, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000000000)={0x2, 0xd, 0x0, 0x0, 0x2}, 0x10}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x2, 0x0, 0x0, 0x0, 0x2}, 0x10}}, 0x0) [ 311.553968] FAT-fs (loop1): bogus number of reserved sectors [ 311.569374] FAT-fs (loop1): Can't find a valid FAT filesystem 16:08:34 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) [ 311.734807] overlayfs: failed to resolve './file0': -2 16:08:34 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', &(0x7f0000001740)='bpf\x00', 0x0, &(0x7f0000001780)) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) mount$bpf(0x0, &(0x7f0000000600)='./file0/file0\x00', &(0x7f0000000340)='bpf\x00', 0x100000, &(0x7f0000000540)) mount$bpf(0x20000000, &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000000c0)='bpf\x00', 0x2001001, &(0x7f0000000580)=ANY=[]) 16:08:34 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, 0x0, &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) [ 311.838315] FAT-fs (loop1): bogus number of reserved sectors [ 311.868076] FAT-fs (loop1): Can't find a valid FAT filesystem 16:08:36 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, 0x0, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:36 executing program 2: mount$bpf(0x20000000, 0x0, 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000040)=0x1, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f00008c0000)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 16:08:36 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:36 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', &(0x7f0000001740)='bpf\x00', 0x0, &(0x7f0000001780)) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) mount$bpf(0x0, &(0x7f0000000600)='./file0/file0\x00', &(0x7f0000000340)='bpf\x00', 0x100000, &(0x7f0000000540)) 16:08:36 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x0, 0x0, 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:08:36 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, 0x0, &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) [ 314.453416] FAT-fs (loop1): bogus number of reserved sectors [ 314.459941] FAT-fs (loop3): bogus number of reserved sectors [ 314.465248] FAT-fs (loop1): Can't find a valid FAT filesystem [ 314.476524] FAT-fs (loop3): Can't find a valid FAT filesystem 16:08:36 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', &(0x7f0000001740)='bpf\x00', 0x0, &(0x7f0000001780)) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:36 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:36 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, 0x0, &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) [ 314.691035] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 314.764677] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 314.801528] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 16:08:37 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', &(0x7f0000001740)='bpf\x00', 0x0, &(0x7f0000001780)) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) [ 314.908594] FAT-fs (loop1): bogus number of reserved sectors [ 314.946482] FAT-fs (loop1): Can't find a valid FAT filesystem 16:08:37 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:37 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e666174", 0xb}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) [ 315.230691] FAT-fs (loop1): bogus number of reserved sectors [ 315.255524] FAT-fs (loop1): Can't find a valid FAT filesystem 16:08:39 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, 0x0, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:39 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', &(0x7f0000001740)='bpf\x00', 0x0, &(0x7f0000001780)) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:39 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x0, 0x0, 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:08:39 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:39 executing program 2: mount$bpf(0x20000000, 0x0, 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000040)=0x1, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f00008c0000)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 16:08:39 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e666174", 0xb}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) [ 317.666619] FAT-fs (loop3): bogus number of reserved sectors [ 317.680340] FAT-fs (loop1): bogus number of reserved sectors [ 317.708762] FAT-fs (loop3): Can't find a valid FAT filesystem [ 317.714779] FAT-fs (loop1): Can't find a valid FAT filesystem 16:08:40 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:40 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', &(0x7f0000001740)='bpf\x00', 0x0, &(0x7f0000001780)) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) [ 317.892964] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 16:08:40 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e666174", 0xb}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) [ 317.959143] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 317.972832] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 16:08:40 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', &(0x7f0000001740)='bpf\x00', 0x0, &(0x7f0000001780)) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) [ 318.141012] FAT-fs (loop1): bogus number of reserved sectors 16:08:40 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) [ 318.214041] FAT-fs (loop1): Can't find a valid FAT filesystem 16:08:40 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e666174000204010002", 0x11}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) [ 318.342658] overlayfs: missing 'lowerdir' [ 318.423977] FAT-fs (loop1): invalid media value (0x00) [ 318.430078] FAT-fs (loop1): Can't find a valid FAT filesystem 16:08:43 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(0x0, 0x1000000000016) r2 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r2, r0) 16:08:43 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', &(0x7f0000001740)='bpf\x00', 0x0, &(0x7f0000001780)) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:43 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:43 executing program 2: syz_mount_image$vfat(0x0, 0x0, 0xe004, 0x0, 0x0, 0x0, 0x0) open(0x0, 0x0, 0x0) r0 = creat(&(0x7f0000000080)='./file0\x00', 0x0) fallocate(r0, 0x1, 0x0, 0x369e5d84) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000100)='./file0\x00', 0x33) 16:08:43 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x0, 0x0, 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:08:43 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e666174000204010002", 0x11}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) [ 320.840278] overlayfs: missing 'lowerdir' [ 320.857281] FAT-fs (loop1): invalid media value (0x00) [ 320.870878] FAT-fs (loop3): bogus number of reserved sectors 16:08:43 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', &(0x7f0000001740)='bpf\x00', 0x0, &(0x7f0000001780)) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:43 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) [ 320.902569] FAT-fs (loop1): Can't find a valid FAT filesystem [ 320.924441] FAT-fs (loop3): Can't find a valid FAT filesystem 16:08:43 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e666174000204010002", 0x11}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:43 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(0x0, 0x1000000000016) r2 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r2, r0) [ 321.153058] overlayfs: missing 'lowerdir' 16:08:43 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', &(0x7f0000001740)='bpf\x00', 0x0, &(0x7f0000001780)) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) [ 321.193670] FAT-fs (loop1): invalid media value (0x00) [ 321.205410] FAT-fs (loop1): Can't find a valid FAT filesystem 16:08:43 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:43 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e666174000204010002000274", 0x14}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:43 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(0x0, 0x1000000000016) r2 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r2, r0) [ 321.439266] overlayfs: missing 'lowerdir' [ 321.461026] FAT-fs (loop1): invalid media value (0x00) 16:08:43 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', &(0x7f0000001740)='bpf\x00', 0x0, &(0x7f0000001780)) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:43 executing program 2: syz_mount_image$vfat(0x0, 0x0, 0xe004, 0x0, 0x0, 0x0, 0x0) open(0x0, 0x0, 0x0) r0 = creat(&(0x7f0000000080)='./file0\x00', 0x0) fallocate(r0, 0x1, 0x0, 0x369e5d84) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000100)='./file0\x00', 0x33) [ 321.490101] FAT-fs (loop1): Can't find a valid FAT filesystem 16:08:44 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x0, &(0x7f0000000140), 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:08:44 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:44 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e666174000204010002000274", 0x14}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:44 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', &(0x7f0000001740)='bpf\x00', 0x0, &(0x7f0000001780)) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:44 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x0) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) [ 321.772814] FAT-fs (loop1): invalid media value (0x00) [ 321.787125] overlayfs: missing 'lowerdir' [ 321.804394] FAT-fs (loop1): Can't find a valid FAT filesystem 16:08:44 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) [ 321.845901] FAT-fs (loop3): bogus number of reserved sectors [ 321.885355] FAT-fs (loop3): Can't find a valid FAT filesystem 16:08:44 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e666174000204010002000274", 0x14}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:44 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', &(0x7f0000001740)='bpf\x00', 0x0, &(0x7f0000001780)) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) [ 322.075782] FAT-fs (loop1): invalid media value (0x00) [ 322.092990] overlayfs: missing 'lowerdir' 16:08:44 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) [ 322.120608] FAT-fs (loop1): Can't find a valid FAT filesystem 16:08:44 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x0) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:44 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400", 0x15}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:44 executing program 2: mknod$loop(&(0x7f0000000100)='./file0\x00', 0x0, 0xffffffffffffffff) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) [ 322.443139] overlayfs: './file0' not a directory [ 322.443872] FAT-fs (loop1): invalid media value (0x00) [ 322.462289] FAT-fs (loop1): Can't find a valid FAT filesystem [ 322.490942] overlayfs: missing 'lowerdir' 16:08:44 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x0, &(0x7f0000000140), 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:08:45 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:45 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='bdev\x00', 0x0, &(0x7f0000000200)='context') 16:08:45 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', &(0x7f0000001740)='bpf\x00', 0x0, &(0x7f0000001780)) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:45 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x0) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, r0) 16:08:45 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400", 0x15}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:45 executing program 2: syz_mount_image$vfat(&(0x7f0000000140)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0x100000000000e000, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb64c86d6b66732e66617400020441000500077008f8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f00000003c0)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(&(0x7f0000000080)='./file0/file0\x00', 0x3fffa, 0x0) creat(&(0x7f0000000540)='./file0/file0\x00', 0x0) [ 322.788335] FAT-fs (loop1): invalid media value (0x00) [ 322.788697] overlayfs: missing 'lowerdir' [ 322.814914] FAT-fs (loop3): bogus number of reserved sectors 16:08:45 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', &(0x7f0000001740)='bpf\x00', 0x0, &(0x7f0000001780)) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:45 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) [ 322.836819] FAT-fs (loop3): Can't find a valid FAT filesystem [ 322.847769] FAT-fs (loop1): Can't find a valid FAT filesystem 16:08:45 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(0x0, 0x0) dup2(r3, r0) [ 323.022503] audit: type=1800 audit(1578672525.341:66): pid=14266 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor.2" name="file0" dev="sda1" ino=17253 res=0 16:08:45 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400", 0x15}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) [ 323.106590] overlayfs: missing 'lowerdir' 16:08:45 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) [ 323.173907] audit: type=1800 audit(1578672525.491:67): pid=14266 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor.2" name="file0" dev="loop2" ino=39 res=0 [ 323.234662] FAT-fs (loop1): invalid media value (0x00) [ 323.272094] FAT-fs (loop1): Can't find a valid FAT filesystem 16:08:45 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x0, &(0x7f0000000140), 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:08:45 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:45 executing program 2: syz_mount_image$vfat(&(0x7f0000000140)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0x100000000000e000, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb64c86d6b66732e66617400020441000500077008f8", 0x16}], 0x0, 0x0) perf_event_open(&(0x7f00000003c0)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(&(0x7f0000000080)='./file0/file0\x00', 0x3fffa, 0x0) creat(&(0x7f0000000540)='./file0/file0\x00', 0x0) 16:08:45 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:45 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) [ 323.692452] FAT-fs (loop3): bogus number of reserved sectors [ 323.699309] FAT-fs (loop3): Can't find a valid FAT filesystem [ 323.721104] overlayfs: option "workdir=." is useless in a non-upper mount, ignore 16:08:46 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) [ 323.735632] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 323.757255] audit: type=1800 audit(1578672526.081:68): pid=14303 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor.2" name="file0" dev="sda1" ino=17273 res=0 16:08:46 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:46 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:46 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(0x0, 0x0) dup2(r3, r0) 16:08:46 executing program 5: mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', &(0x7f0000001740)='bpf\x00', 0x0, &(0x7f0000001780)) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) [ 324.049442] overlayfs: option "workdir=." is useless in a non-upper mount, ignore 16:08:46 executing program 2: unshare(0x400) r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r0, 0xc008551b, &(0x7f00000000c0)={0x9, 0x8, [0x0, 0x0]}) [ 324.106196] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent 16:08:46 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:46 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{0x0}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:08:46 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', 0x0, 0x800000000e004, 0x0, 0x0, 0x0, 0x0) open(0x0, 0x0, 0x0) fchdir(0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x0, 0x0, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r0, &(0x7f00000012c0)="0c268a927f1f6588b967481241ba7860005cf65ac618ded8974895abeaf4b4834f", 0x21, 0x11, 0x0, 0x0) 16:08:46 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:46 executing program 5: mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', &(0x7f0000001740)='bpf\x00', 0x0, &(0x7f0000001780)) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:46 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:46 executing program 5: mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', &(0x7f0000001740)='bpf\x00', 0x0, &(0x7f0000001780)) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) [ 324.551251] overlayfs: option "workdir=." is useless in a non-upper mount, ignore [ 324.562710] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent 16:08:46 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) [ 324.697818] FAT-fs (loop3): bogus number of reserved sectors 16:08:47 executing program 2: mknod(&(0x7f00000005c0)='./bus\x00', 0x94d, 0x0) execve(&(0x7f0000000040)='./bus\x00', 0x0, &(0x7f0000000340)=[0xfffffffffffffffd, &(0x7f0000000280)='-\x89&\x00']) [ 324.743717] FAT-fs (loop3): Can't find a valid FAT filesystem [ 324.830746] overlayfs: unrecognized mount option "upper" or missing value 16:08:47 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(0x0, 0x0) dup2(r3, r0) 16:08:47 executing program 5: mkdir(0x0, 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', &(0x7f0000001740)='bpf\x00', 0x0, &(0x7f0000001780)) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:47 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:47 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) [ 325.085727] overlayfs: unrecognized mount option "upper" or missing value 16:08:47 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{0x0}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:08:47 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000740)=@updpolicy={0xb8, 0x15, 0x1, 0x0, 0x0, {{@in6=@empty, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x2}}}, 0xb8}}, 0x0) 16:08:47 executing program 5: mkdir(0x0, 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', &(0x7f0000001740)='bpf\x00', 0x0, &(0x7f0000001780)) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:47 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:47 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) [ 325.504434] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.2'. 16:08:47 executing program 2: mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='bpf\x00', 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) creat(&(0x7f0000000180)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x110001) 16:08:47 executing program 5: mkdir(0x0, 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', &(0x7f0000001740)='bpf\x00', 0x0, &(0x7f0000001780)) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) [ 325.588278] overlayfs: unrecognized mount option "upper" or missing value [ 325.619200] FAT-fs (loop3): bogus number of reserved sectors 16:08:47 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) [ 325.640620] FAT-fs (loop3): Can't find a valid FAT filesystem 16:08:48 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(0xffffffffffffffff, r0) 16:08:48 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:48 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, 0x0, &(0x7f0000001740)='bpf\x00', 0x0, &(0x7f0000001780)) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:48 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) [ 325.962930] audit: type=1804 audit(1578672528.281:69): pid=14429 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir934736970/syzkaller.JwVWG1/173/file0/file0" dev="loop2" ino=41 res=1 [ 326.089616] audit: type=1800 audit(1578672528.341:70): pid=14428 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed comm="syz-executor.2" name="cgroup.controllers" dev="loop2" ino=40 res=0 [ 326.179062] overlayfs: workdir and upperdir must be separate subtrees 16:08:48 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, 0x0, &(0x7f0000001740)='bpf\x00', 0x0, &(0x7f0000001780)) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:48 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x213) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=@ipv6_getroute={0x24, 0x12, 0x201, 0x0, 0x0, {0x2}, [@RTA_MARK={0x8}]}, 0x24}}, 0x0) 16:08:48 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:48 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{0x0}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:08:48 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) [ 326.447638] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'. [ 326.468008] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'. [ 326.502363] overlayfs: workdir and upperdir must be separate subtrees [ 326.504339] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'. 16:08:48 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, 0x0, &(0x7f0000001740)='bpf\x00', 0x0, &(0x7f0000001780)) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:48 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) [ 326.543406] FAT-fs (loop3): bogus number of reserved sectors [ 326.568374] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'. [ 326.579486] FAT-fs (loop3): Can't find a valid FAT filesystem 16:08:48 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) [ 326.811893] overlayfs: workdir and upperdir must be separate subtrees 16:08:49 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(0xffffffffffffffff, r0) 16:08:49 executing program 2: mkdir(&(0x7f0000000100)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) chdir(&(0x7f0000000280)='./file0\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r0, 0x40046629, 0x0) 16:08:49 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, &(0x7f0000001780)) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:49 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:49 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:49 executing program 2: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f0000000980), 0x10a9) sendfile(r1, r1, &(0x7f00000000c0), 0x8080fffffffe) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) 16:08:49 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) [ 327.237329] overlayfs: failed to resolve './fil': -2 16:08:49 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:08:49 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:49 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) [ 327.449676] overlayfs: failed to resolve './fil': -2 16:08:49 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:49 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, 0x0, &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) [ 327.482849] FAT-fs (loop2): error, fat_get_cluster: invalid cluster chain (i_pos 16) [ 327.495743] FAT-fs (loop2): Filesystem has been set read-only [ 327.519225] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000020) [ 327.562796] FAT-fs (loop3): bogus number of reserved sectors [ 327.634066] FAT-fs (loop3): Can't find a valid FAT filesystem [ 327.689312] overlayfs: failed to resolve './fil': -2 16:08:50 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:50 executing program 2: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ptrace(0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = creat(&(0x7f0000000180)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000402) fallocate(r0, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f00000000c0)={0x4, r1, 0x83}) wait4(0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000100)='./file0\x00', 0x0) mount$overlay(0x0, 0x0, &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000240)=ANY=[]) 16:08:50 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, 0x0, &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:50 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:50 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(0xffffffffffffffff, r0) [ 328.211717] overlayfs: failed to resolve './file': -2 16:08:50 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, 0x0, &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:50 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) 16:08:50 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:08:50 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:50 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', 0x0, 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:50 executing program 2: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0xc}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x24, 0x0, 0x0) syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000200)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r1, &(0x7f0000002c00)=ANY=[@ANYBLOB="ffd90300d8ef5b7213f6012f7f3000000000e0529ce3a9eb0700930100008000000000315f93c32cfd7a8ac705be19"], 0x2f) sendfile(r1, r1, &(0x7f0000000240), 0x7fff) [ 328.507427] overlayfs: failed to resolve './file': -2 16:08:50 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getdents(r0, &(0x7f00000008c0)=""/105, 0x69) [ 328.579068] FAT-fs (loop3): bogus number of reserved sectors 16:08:51 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) [ 328.625644] FAT-fs (loop3): Can't find a valid FAT filesystem 16:08:51 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', 0x0, 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) [ 328.887107] overlayfs: failed to resolve './file': -2 16:08:51 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getdents(0xffffffffffffffff, &(0x7f00000008c0)=""/105, 0x69) 16:08:51 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', 0x0, 0x0, &(0x7f00000016c0)=ANY=[]) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) [ 329.026068] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000811) [ 329.033388] FAT-fs (loop2): Filesystem has been set read-only [ 329.045927] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000811) [ 329.054779] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000811) 16:08:51 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, 0xffffffffffffffff) 16:08:51 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(0x0) r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) [ 329.078393] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000811) 16:08:51 executing program 2: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(0xffffffffffffffff) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x1, 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000240)={0xfffffffc, 0x0, 0x0, 0x0, 0x1a, "00000000000000000000000000ddc1517600"}) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:08:51 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:08:51 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:51 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(0x0) r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:51 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getdents(0xffffffffffffffff, &(0x7f00000008c0)=""/105, 0x69) [ 329.446848] FAT-fs (loop2): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 329.468969] FAT-fs (loop2): Filesystem has been set read-only [ 329.513237] FAT-fs (loop2): error, fat_free: invalid cluster chain (i_pos 970769) 16:08:51 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getdents(0xffffffffffffffff, &(0x7f00000008c0)=""/105, 0x69) 16:08:51 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:51 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(0x0) r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:52 executing program 2: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x3a9, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/route\x00') preadv(r0, &(0x7f00000017c0), 0x315, 0xa903) [ 329.594889] FAT-fs (loop3): bogus number of reserved sectors [ 329.628812] FAT-fs (loop3): Can't find a valid FAT filesystem 16:08:52 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:52 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, 0xffffffffffffffff) 16:08:52 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getdents(r0, 0x0, 0x0) 16:08:52 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(0x0, 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:52 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:52 executing program 2: syz_mount_image$msdos(&(0x7f0000001100)='msdos\x00', &(0x7f0000001140)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000016c0)={[{@nodots='nodots'}, {@fat=@check_relaxed='check=relaxed'}], [{@seclabel='seclabel'}]}) 16:08:52 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getdents(r0, 0x0, 0x0) 16:08:52 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(0x0, 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:52 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e666174", 0xb}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:08:52 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, 0x0, &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) [ 330.444592] FAT-fs (loop2): bogus number of reserved sectors [ 330.460802] FAT-fs (loop2): Can't find a valid FAT filesystem 16:08:52 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(0x0, 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:52 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getdents(r0, 0x0, 0x0) [ 330.547852] FAT-fs (loop3): bogus number of reserved sectors [ 330.595673] FAT-fs (loop3): Can't find a valid FAT filesystem [ 330.604147] FAT-fs (loop2): bogus number of reserved sectors [ 330.627735] FAT-fs (loop2): Can't find a valid FAT filesystem 16:08:53 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, 0x0, &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:53 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0xc0, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) r3 = creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) dup2(r3, 0xffffffffffffffff) 16:08:53 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(0xffffffffffffffff, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, &(0x7f0000001440)=""/177, 0xb1) 16:08:53 executing program 1: r0 = syz_open_dev$sndpcmc(&(0x7f0000000400)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x0) r2 = dup2(r0, r1) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r2, 0xc2604110, &(0x7f0000000080)={0x0, [[0xc], [0x0, 0x2], [0x1f]], [], [{}, {}, {0x2}], [], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 16:08:53 executing program 2: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x2, 0x0) socket$packet(0x11, 0x3, 0x300) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x2021}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'veth0\x00'}) syz_mount_image$vfat(&(0x7f0000000440)='vfat\x00', &(0x7f0000000400)='./file0\x00', 0xfffffffffffffffa, 0x1, &(0x7f00000003c0)=[{&(0x7f0000000080)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x280001c, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000000300)='./file0\x00', 0x0, 0x0) fchdir(r0) open(&(0x7f00000000c0)='./bus\x00', 0x1fe, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x120) rename(&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)='./file1\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) 16:08:53 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, 0x0, &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) [ 331.155267] protocol 88fb is buggy, dev hsr_slave_0 [ 331.160612] protocol 88fb is buggy, dev hsr_slave_1 16:08:53 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:53 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(0xffffffffffffffff, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, &(0x7f0000001440)=""/177, 0xb1) 16:08:53 executing program 2: syz_mount_image$vfat(&(0x7f0000000440)='vfat\x00', &(0x7f0000000400)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) fchdir(0xffffffffffffffff) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() r1 = socket(0xa, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000880)=@nat={'nat\x00', 0x19, 0x2, 0x348, [0x20000280, 0x0, 0x0, 0x200002b0, 0x200002e0], 0x11, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000030000000000000000007663616e30000000000000000000000062726964676530000000000000000000736974300000000000000000000000007465616d300000000000000000000000aaaaaaaaaaaa000000000000aaaaaaaaaabb0000000000000000d8010000d801000010020000636f6d6d656e7400000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000003f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073746174697374696300000000000000000000000000000000000000000000001800000000000000000000000000000000000000000000000000000000000000736e6174000000000000000000000000170000000000000000000000000000001000000000000000aaaaaaaaaa000000ffffffff000000001b0000000000000000007465616d5f736c6176655f310000000069726c616e300000000000000000000069726c616e3000e575dd73000000000073797a6b616c6c6572300000000000000180c2000000000000000000f646793b7b3900000000000000007000000070000000a8000000736e61740000e0f19a3cc6c9a60b9a8500000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa00"]}, 0x3c0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x20) wait4(0x0, 0x0, 0x0, 0x0) open(&(0x7f00000009c0)='./bus\x00', 0x141042, 0x0) 16:08:53 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:08:53 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e666174", 0xb}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) [ 331.491877] overlayfs: invalid origin (7900742f69705f76735f73746174735f706572637075000000000000000000000000000000000000000000000000000000000000000000000000000000000000) [ 331.520175] FAT-fs (loop3): bogus number of reserved sectors 16:08:53 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x0, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) [ 331.553200] FAT-fs (loop3): Can't find a valid FAT filesystem [ 331.571623] FAT-fs (loop2): bogus number of reserved sectors [ 331.592812] FAT-fs (loop2): Can't find a valid FAT filesystem 16:08:53 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(0xffffffffffffffff, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, &(0x7f0000001440)=""/177, 0xb1) [ 331.750286] x_tables: eb_tables: snat.0 target: invalid size 16 (kernel) != (user) 0 [ 331.808735] FAT-fs (loop2): bogus number of reserved sectors [ 331.844778] FAT-fs (loop2): Can't find a valid FAT filesystem 16:08:54 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x0, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:54 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:08:54 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(0x0, 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:54 executing program 2: mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) chdir(&(0x7f0000000280)='./file0\x00') r0 = creat(&(0x7f0000000080)='./file1\x00', 0x0) fallocate(r0, 0x20, 0x0, 0x801ffff) 16:08:54 executing program 4: syz_open_procfs(0x0, &(0x7f0000000100)='net/arp\x00') mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, 0x0, 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(0x0, &(0x7f0000000600)='./file0\x00') request_key(&(0x7f00000001c0)='cifs.spnego\x00', 0x0, 0x0, 0xfffffffffffffffa) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x211, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @empty}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='bbr\x00', 0x3) write$binfmt_script(0xffffffffffffffff, &(0x7f00000009c0)=ANY=[], 0x0) write$binfmt_elf32(r0, &(0x7f0000002380)=ANY=[@ANYBLOB="7220cc22aec049f37f5e42da69a5c66371998fafdf4c19c6438806bddccdc17fcc03418efd8309acea7e2bb3c8c26c725155256158f52e613a6a4b7c0feb52b132671d77bc182a5942fac0a28af2cd5095448c0a7eae18aedb14397a0d8d8687a260d93b7563b62eb475d780443def956104"], 0x72) sendto$inet(r0, &(0x7f00000012c0)="0c268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0x811, 0x0, 0x140) sendmsg(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000140)="24000000220007031dfffd946f610500000000000543000000000000421ba3a20400ff7e280000001100ff5613d3475bb65f64000000000004000000000000eff24d8238cfa47e23f7ef", 0x4a}], 0x1}, 0x0) r1 = open(0x0, 0x141042, 0x0) io_setup(0x1ff, &(0x7f00000003c0)=0x0) socket$nl_route(0x10, 0x3, 0x0) io_submit(r2, 0x1, &(0x7f0000001b00)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000580)='\'', 0x1, 0xffffffff000}]) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0xe, 0x4, 0x4, 0x1}, 0x3c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r3, 0x28, &(0x7f0000000040)}, 0x10) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0xc, &(0x7f0000000040)}, 0x8) dup(0xffffffffffffffff) 16:08:54 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x0, &(0x7f0000000480)) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) [ 332.260307] overlayfs: invalid origin (7900742f69705f76735f73746174735f706572637075000000000000000000000000000000000000000000000000000000000000000000000000000000000000) 16:08:54 executing program 2: r0 = socket$inet(0x2, 0x3, 0x29) ioctl$sock_inet_SIOCDELRT(r0, 0x890c, &(0x7f0000000340)={0x0, {0x2, 0x0, @dev}, {0x2, 0x0, @remote}, {}, 0xcea40250d17e1c85}) 16:08:54 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(0x0, 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:54 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e666174", 0xb}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:08:54 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:54 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) [ 332.621148] audit: type=1400 audit(1578672534.941:71): avc: denied { map_read map_write } for pid=14881 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 16:08:55 executing program 2: mount$bpf(0x20000000, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) getpid() creat(0x0, 0x20005d) syz_open_procfs(0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) lchown(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) socket(0x0, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\a'], 0x48}}, 0x0) [ 332.738247] FAT-fs (loop3): bogus number of reserved sectors 16:08:55 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, 0x0, &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) [ 332.795971] FAT-fs (loop3): Can't find a valid FAT filesystem 16:08:55 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(0x0, 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:55 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, 0x0, &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:55 executing program 2: mkdir(&(0x7f0000000100)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) chdir(&(0x7f0000000280)='./file0\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc0185879, 0x0) [ 333.055970] overlayfs: invalid origin (7900742f69705f76735f73746174735f706572637075000000000000000000000000000000000000000000000000000000000000000000000000000000000000) 16:08:55 executing program 4: r0 = open(&(0x7f0000103ff8)='./file0\x00', 0x141042, 0x0) ftruncate(r0, 0x21000) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x806, 0x0) sendfile(r1, r0, 0x0, 0x40801001) 16:08:55 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000000c0)={@mcast1, 0x800, 0x0, 0x103, 0x1}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f00000005c0)=0x1, 0x4) sendmsg$inet6(r0, &(0x7f0000000180)={&(0x7f0000000080)={0xa, 0x4e24, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f00000002c0)=[@dstopts_2292={{0x18, 0x29, 0x4, {0x0, 0x4}}}], 0x18}, 0x0) 16:08:55 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:55 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, 0x0, &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:55 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01", 0x11}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:08:55 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x2001001, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:55 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:08:55 executing program 2: r0 = syz_open_dev$sndpcmc(&(0x7f0000000400)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x0) r2 = dup2(r0, r1) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r2, 0xc2604110, &(0x7f0000001180)={0x0, [[0xc], [0x4], [0x1f]], [], [{0x0, 0x800}], [], 0x107}) 16:08:55 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e", 0x8}], 0x0, 0x0) r0 = open(0x0, 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) write(r1, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r2, 0x0, 0xcf5) 16:08:55 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) [ 333.680792] FAT-fs (loop3): invalid media value (0x00) [ 333.702654] FAT-fs (loop4): bogus number of reserved sectors [ 333.719680] overlayfs: invalid origin (7900742f69705f76735f73746174735f706572637075000000000000000000000000000000000000000000000000000000000000000000000000000000000000) 16:08:56 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x0, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) [ 333.753116] FAT-fs (loop3): Can't find a valid FAT filesystem [ 333.775660] FAT-fs (loop4): Can't find a valid FAT filesystem 16:08:56 executing program 2: r0 = syz_open_dev$sndpcmc(&(0x7f0000000400)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x0) r2 = dup2(r0, r1) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r2, 0xc2604110, &(0x7f0000001180)={0x0, [[0xc], [0x4], [0x1f]], [], [{0x0, 0x800}], [], 0x107}) [ 333.840367] FAT-fs (loop4): bogus number of reserved sectors [ 333.848987] FAT-fs (loop4): Can't find a valid FAT filesystem 16:08:56 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) 16:08:56 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x0, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:56 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:08:56 executing program 4: syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) pwrite64(r1, &(0x7f0000000000)="c2", 0x1, 0x1960) r2 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r2, 0x0, 0x8080fffffffe) [ 334.183735] attempt to access beyond end of device [ 334.226416] loop4: rw=2049, want=114, limit=112 [ 334.244242] Buffer I/O error on dev loop4, logical block 113, lost async page write [ 334.258864] attempt to access beyond end of device [ 334.263930] loop4: rw=2049, want=115, limit=112 [ 334.274067] Buffer I/O error on dev loop4, logical block 114, lost async page write [ 334.289158] attempt to access beyond end of device [ 334.294475] loop4: rw=2049, want=116, limit=112 [ 334.304184] Buffer I/O error on dev loop4, logical block 115, lost async page write [ 334.333820] attempt to access beyond end of device [ 334.346467] loop4: rw=2049, want=117, limit=112 [ 334.351286] Buffer I/O error on dev loop4, logical block 116, lost async page write [ 334.367368] attempt to access beyond end of device [ 334.373114] loop4: rw=2049, want=130, limit=112 [ 334.391193] Buffer I/O error on dev loop4, logical block 129, lost async page write [ 334.402313] attempt to access beyond end of device [ 334.412264] loop4: rw=0, want=114, limit=112 [ 334.420722] Buffer I/O error on dev loop4, logical block 113, async page read [ 334.429094] attempt to access beyond end of device [ 334.434216] loop4: rw=0, want=115, limit=112 [ 334.439361] Buffer I/O error on dev loop4, logical block 114, async page read [ 334.447872] attempt to access beyond end of device [ 334.453375] loop4: rw=0, want=116, limit=112 [ 334.459443] Buffer I/O error on dev loop4, logical block 115, async page read [ 334.467554] attempt to access beyond end of device [ 334.472803] loop4: rw=0, want=117, limit=112 [ 334.477662] Buffer I/O error on dev loop4, logical block 116, async page read [ 334.485686] attempt to access beyond end of device 16:08:56 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01", 0x11}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:08:56 executing program 2: r0 = socket$inet6(0xa, 0x3, 0x80000000000004) setsockopt$inet6_int(r0, 0x29, 0x21, &(0x7f0000000100)=0xfffffffffffffffe, 0x4) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x380000, @empty}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000003a40)=[{{0x0, 0x27d, 0x0, 0x0, &(0x7f0000000200)=[@hoplimit_2292={{0x14}}], 0xf}}], 0x1, 0x0) 16:08:56 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x0, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:56 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:08:56 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(0x0, 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) [ 334.490771] loop4: rw=0, want=130, limit=112 [ 334.495811] Buffer I/O error on dev loop4, logical block 129, async page read 16:08:56 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) fsync(r0) [ 334.592740] FAT-fs (loop3): invalid media value (0x00) [ 334.598526] attempt to access beyond end of device [ 334.603720] loop4: rw=0, want=114, limit=112 16:08:57 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x2001001, 0x0) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:57 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(0x0, 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) [ 334.642523] FAT-fs (loop3): Can't find a valid FAT filesystem [ 334.668211] attempt to access beyond end of device 16:08:57 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) [ 334.699146] loop4: rw=0, want=115, limit=112 [ 334.703995] attempt to access beyond end of device [ 334.721626] loop4: rw=0, want=116, limit=112 [ 334.743065] attempt to access beyond end of device [ 334.765710] loop4: rw=0, want=117, limit=112 [ 334.770706] attempt to access beyond end of device [ 334.800572] loop4: rw=0, want=130, limit=112 [ 334.813602] overlayfs: failed to resolve './bus': -2 [ 334.835036] audit: type=1800 audit(1578672537.151:72): pid=14995 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed comm="syz-executor.4" name="bus" dev="loop4" ino=48 res=0 16:08:57 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x2001001, 0x0) mount$bpf(0x0, 0x0, &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) [ 334.908361] audit: type=1800 audit(1578672537.201:73): pid=15000 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed comm="syz-executor.4" name="bus" dev="loop4" ino=48 res=0 16:08:57 executing program 2: syz_open_dev$loop(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x4}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setown(0xffffffffffffffff, 0x8, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup/syz0\x00', 0x200002, 0x0) fchdir(r0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x4000000000000, 0x40, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) umount2(&(0x7f0000000540)='./file0\x00', 0x0) 16:08:57 executing program 4: syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) pwrite64(r1, &(0x7f0000000000)="c2", 0x1, 0x1960) r2 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r2, 0x0, 0x8080fffffffe) [ 335.233989] attempt to access beyond end of device [ 335.255071] loop4: rw=2049, want=130, limit=112 [ 335.270452] attempt to access beyond end of device [ 335.288341] loop4: rw=2049, want=131, limit=112 [ 335.295065] attempt to access beyond end of device [ 335.313507] loop4: rw=2049, want=132, limit=112 [ 335.327394] attempt to access beyond end of device [ 335.332483] loop4: rw=2049, want=133, limit=112 [ 335.340745] attempt to access beyond end of device [ 335.347995] loop4: rw=2049, want=142, limit=112 [ 335.352986] attempt to access beyond end of device 16:08:57 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01", 0x11}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:08:57 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(0x0, 0x0, 0x0) getdents(r1, &(0x7f0000001440)=""/177, 0xb1) [ 335.362212] loop4: rw=0, want=130, limit=112 [ 335.369176] attempt to access beyond end of device [ 335.385431] loop4: rw=0, want=131, limit=112 [ 335.394962] attempt to access beyond end of device 16:08:57 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:08:57 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x2001001, 0x0) mount$bpf(0x0, 0x0, &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:57 executing program 2: rt_sigaction(0x8, &(0x7f0000000180)={&(0x7f00000000c0)="f1460f1c1e460f475f0cc4637d40c100faf3410f1efac4a17e2d46d580ae800400000645ae", {}, 0x0, 0x0}, 0x0, 0x8, &(0x7f0000000000)) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='stat\x00') read$FUSE(r0, 0x0, 0x0) [ 335.413057] loop4: rw=0, want=132, limit=112 [ 335.427117] attempt to access beyond end of device [ 335.463599] loop4: rw=0, want=133, limit=112 [ 335.480640] attempt to access beyond end of device [ 335.490620] loop4: rw=0, want=142, limit=112 [ 335.513397] FAT-fs (loop3): invalid media value (0x00) 16:08:57 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:08:57 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x2001001, 0x0) mount$bpf(0x0, 0x0, &(0x7f0000000400)='bpf\x00', 0x80000, &(0x7f0000000440)) 16:08:57 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000005500)='/dev/ptmx\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000140)) r2 = socket$key(0xf, 0x3, 0x2) dup3(r2, r1, 0x0) [ 335.534486] FAT-fs (loop3): Can't find a valid FAT filesystem 16:08:57 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(0xffffffffffffffff, &(0x7f0000001440)=""/177, 0xb1) 16:08:58 executing program 4: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$binfmt_aout(r1, &(0x7f0000000000)=ANY=[], 0xfb) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000380)={0x50, 0x0, 0x0, {0x7, 0x1c, 0x3, 0x29230c}}, 0x50) sendfile(r1, r1, &(0x7f00000000c0), 0x8080fffffffe) 16:08:58 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:08:58 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x2001001, 0x0) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', 0x0, 0x80000, &(0x7f0000000440)) [ 335.966494] attempt to access beyond end of device [ 335.972399] loop4: rw=2049, want=114, limit=112 16:08:58 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270", 0x14}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:08:58 executing program 2: mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) chdir(&(0x7f0000000280)='./file0\x00') creat(&(0x7f0000000080)='./file1\x00', 0x0) 16:08:58 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(0xffffffffffffffff, &(0x7f0000001440)=""/177, 0xb1) 16:08:58 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:08:58 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x2001001, 0x0) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', 0x0, 0x0, &(0x7f0000000440)) 16:08:58 executing program 4: open(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup/syz0\x00', 0x200002, 0x0) fchdir(r0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) umount2(&(0x7f0000000540)='./file0\x00', 0x0) 16:08:58 executing program 2: perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) syz_genetlink_get_family_id$nbd(&(0x7f00000000c0)='nbd\x00') sendmsg$NBD_CMD_CONNECT(r0, &(0x7f00000002c0)={&(0x7f0000000040), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4000010}, 0x200088c4) r1 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000180)={0x0, 0x1b1, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="18000000230047faffffff00000000000400000204001000b115f8b9207ac3d78578125082f4fcc477cb57f5650731dfaf12ea77ad43cb08000000a9fdd6c1610c621c85fe3e348527b05e5d71460af16b42bede5105ec4fde821ef57e8d4306f47f6ea4a656379a221558fa14efab3bbee0"], 0x18}}, 0x0) close(r2) write$binfmt_elf32(r2, &(0x7f0000000840)={{0x7f, 0x45, 0x4c, 0x46, 0x10, 0xc2, 0x8, 0xff, 0x1, 0x2, 0x6, 0xffffffffffffffff, 0x1f6, 0x38, 0x0, 0x200000000, 0xfffffffffffffffb, 0x20, 0x0, 0x100, 0x4, 0x7}, [], "", [[], [], [], [], [], [], [], [], [], []]}, 0xa38) sendfile(r1, r1, &(0x7f0000000380), 0x1000000020000) 16:08:58 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(0xffffffffffffffff, &(0x7f0000001440)=""/177, 0xb1) [ 336.396903] overlayfs: invalid origin (79000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000) 16:08:58 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x2001001, 0x0) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', 0x0, 0x0, &(0x7f0000000440)) 16:08:58 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) [ 336.497689] FAT-fs (loop3): invalid media value (0x00) 16:08:58 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) [ 336.566041] FAT-fs (loop3): Can't find a valid FAT filesystem 16:08:59 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x2001001, 0x0) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', 0x0, 0x0, &(0x7f0000000440)) [ 336.768443] overlayfs: invalid origin (79000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000) 16:08:59 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270", 0x14}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:08:59 executing program 2: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) fchdir(0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0xffffffffffffff92}], 0x0, 0x0) umount2(0x0, 0x0) 16:08:59 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) 16:08:59 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, 0x0, 0x0) 16:08:59 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f0000001700)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x2001001, 0x0) mount$bpf(0x0, &(0x7f0000000100)='./file0/file0\x00', 0x0, 0x80000, 0x0) 16:08:59 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) [ 337.327460] overlayfs: invalid origin (79000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000) [ 337.364688] FAT-fs (loop3): invalid media value (0x00) 16:08:59 executing program 5: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) 16:08:59 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) 16:08:59 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, 0x0, 0x0) [ 337.383990] FAT-fs (loop3): Can't find a valid FAT filesystem 16:08:59 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:08:59 executing program 5: mkdir(&(0x7f0000000100)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='bpf\x00', 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) creat(&(0x7f0000000180)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x110001) 16:09:00 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) [ 337.663759] overlayfs: failed to resolve './file1': -2 16:09:00 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:09:00 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x68042, 0x0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, 0x0, 0x0) 16:09:00 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) 16:09:00 executing program 2: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) ioctl$USBDEVFS_RELEASEINTERFACE(0xffffffffffffffff, 0x80045510, 0x0) creat(&(0x7f0000000040)='./bus\x00', 0x0) socket(0x0, 0x0, 0x0) 16:09:00 executing program 5: perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000600)="eb3c906d6b66732e66617400020401290200032df7f8", 0x16}], 0x0, 0x0) 16:09:00 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270", 0x14}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) [ 338.210981] overlayfs: failed to resolve './file1': -2 16:09:00 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:09:00 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) 16:09:00 executing program 0: syz_mount_image$msdos(&(0x7f0000000340)='msdos\x00', &(0x7f0000000280)='./file0\x00', 0xe800, 0x1, &(0x7f0000000180)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) fchdir(r0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) r1 = creat(&(0x7f0000000700)='./bus\x00', 0x0) writev(r1, &(0x7f0000000040)=[{&(0x7f00000004c0)="ca", 0x1}], 0x1) ftruncate(r1, 0x4000ff9) r2 = open(&(0x7f0000000240)='./bus\x00', 0x105000, 0x0) sendfile(r1, r2, 0x0, 0x8000fffffffe) [ 338.325054] FAT-fs (loop3): invalid media value (0x00) [ 338.331174] FAT-fs (loop5): Directory bread(block 10497) failed [ 338.341002] FAT-fs (loop3): Can't find a valid FAT filesystem 16:09:00 executing program 2: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000040)) ioctl$TIOCSRS485(0xffffffffffffffff, 0x542f, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x1000014, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) set_tid_address(&(0x7f0000000080)) r2 = open$dir(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) write(r1, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e6", 0x1e0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r2, 0x0, 0x7fffffa7) [ 338.404797] FAT-fs (loop5): Directory bread(block 10498) failed [ 338.457548] FAT-fs (loop5): Directory bread(block 10499) failed [ 338.479333] FAT-fs (loop5): Directory bread(block 10500) failed [ 338.498746] overlayfs: failed to resolve './file1': -2 16:09:00 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) [ 338.510575] FAT-fs (loop5): Directory bread(block 10501) failed [ 338.538640] FAT-fs (loop5): Directory bread(block 10502) failed [ 338.564527] FAT-fs (loop5): Directory bread(block 10503) failed [ 338.583159] audit: type=1800 audit(1578672540.901:74): pid=15337 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor.2" name="file0" dev="sda1" ino=16537 res=0 [ 338.607201] FAT-fs (loop5): Directory bread(block 10504) failed 16:09:00 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) [ 338.619338] FAT-fs (loop5): Directory bread(block 10505) failed [ 338.634196] FAT-fs (loop5): Directory bread(block 10506) failed [ 338.663357] audit: type=1804 audit(1578672540.931:75): pid=15337 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir934736970/syzkaller.JwVWG1/200/file0" dev="sda1" ino=16537 res=1 16:09:01 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) io_setup(0xab, &(0x7f0000000200)=0x0) fcntl$setstatus(r1, 0x4, 0x44800) r3 = creat(&(0x7f0000000180)='./bus\x00', 0x0) io_setup(0x2, &(0x7f0000000280)=0x0) io_submit(r4, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x3, 0x1, 0x0, r3, &(0x7f0000000000), 0x3000}]) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x3, 0x1, 0x0, r1, &(0x7f0000000000), 0x3000}]) 16:09:01 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) sendmmsg$sock(r0, 0x0, 0x0, 0x0) io_setup(0xab, &(0x7f0000000200)=0x0) getsockopt$packet_buf(0xffffffffffffffff, 0x111, 0x0, 0x0, 0x0) r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$PIO_UNIMAP(r3, 0x4b67, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x3, 0x1, 0x0, r1, &(0x7f0000000000), 0x3000}]) 16:09:01 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) [ 338.822072] audit: type=1804 audit(1578672540.951:76): pid=15330 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir236049892/syzkaller.gGFRYo/224/file0/bus" dev="sda1" ino=16609 res=1 [ 338.837718] overlayfs: failed to resolve './file0': -2 [ 338.861892] audit: type=1800 audit(1578672540.951:77): pid=15330 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor.0" name="bus" dev="sda1" ino=16609 res=0 16:09:01 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:09:01 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) [ 339.104541] attempt to access beyond end of device [ 339.137958] loop5: rw=2049, want=78, limit=63 [ 339.154529] attempt to access beyond end of device [ 339.165024] loop5: rw=2049, want=79, limit=63 [ 339.171399] attempt to access beyond end of device 16:09:01 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270ff", 0x15}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:01 executing program 2: mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) chdir(&(0x7f0000000280)='./file0\x00') r0 = creat(&(0x7f0000001c00)='./bus\x00', 0x0) write$binfmt_script(r0, &(0x7f00000002c0)=ANY=[@ANYBLOB='#'], 0x1) ftruncate(r0, 0x800fe) r1 = socket(0x2, 0x803, 0xff) r2 = dup(r1) r3 = open(&(0x7f0000000240)='./bus\x00', 0x127800, 0xc09e92389a454427) sendfile(r2, r3, 0x0, 0x8000fffffffe) 16:09:01 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) [ 339.185916] loop5: rw=2049, want=80, limit=63 [ 339.195025] attempt to access beyond end of device [ 339.197823] overlayfs: failed to resolve './file0': -2 [ 339.207716] loop5: rw=2049, want=81, limit=63 [ 339.214903] attempt to access beyond end of device [ 339.221515] loop5: rw=2049, want=130, limit=63 [ 339.227057] attempt to access beyond end of device [ 339.232391] loop5: rw=2049, want=131, limit=63 [ 339.254208] buffer_io_error: 20 callbacks suppressed [ 339.254236] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 339.272478] audit: type=1804 audit(1578672541.601:78): pid=15336 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir236049892/syzkaller.gGFRYo/224/file0/file0" dev="sda1" ino=16595 res=1 [ 339.316499] attempt to access beyond end of device [ 339.321804] loop5: rw=2049, want=132, limit=63 [ 339.373748] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 339.390452] audit: type=1804 audit(1578672541.631:79): pid=15336 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir236049892/syzkaller.gGFRYo/224/file0/bus" dev="sda1" ino=16609 res=1 [ 339.418126] attempt to access beyond end of device 16:09:01 executing program 0: unshare(0x400) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x202000, 0x0) r1 = socket$inet6(0xa, 0x803, 0x2) sendfile(r0, r1, 0x0, 0x0) 16:09:01 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:09:01 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) ioctl$sock_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000100)) perf_event_open(&(0x7f0000000280)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000040), 0x0) unshare(0x40000000) ioctl$UI_SET_KEYBIT(0xffffffffffffffff, 0x40045565, 0x190) sendmsg$DEVLINK_CMD_GET(0xffffffffffffffff, 0x0, 0x40000) r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000a, 0x8031, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000100)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_INFO(r1, 0x29, 0x40, &(0x7f0000000180)={'filter\x00'}, &(0x7f0000000100)=0x54) 16:09:01 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) [ 339.420482] FAT-fs (loop3): invalid media value (0x00) [ 339.423697] loop5: rw=2049, want=133, limit=63 [ 339.443638] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 339.465325] FAT-fs (loop3): Can't find a valid FAT filesystem [ 339.494203] audit: type=1804 audit(1578672541.641:80): pid=15369 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir934736970/syzkaller.JwVWG1/202/file0/bus" dev="sda1" ino=16674 res=1 [ 339.495980] overlayfs: failed to resolve './file0': -2 [ 339.544875] audit: type=1800 audit(1578672541.641:81): pid=15369 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16674 res=0 [ 339.547905] attempt to access beyond end of device 16:09:01 executing program 1: mkdir(0x0, 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) [ 339.567876] audit: type=1800 audit(1578672541.661:82): pid=15369 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16694 res=0 [ 339.599782] loop5: rw=2049, want=142, limit=63 [ 339.604963] Buffer I/O error on dev loop5, logical block 141, lost async page write [ 339.614530] attempt to access beyond end of device [ 339.621363] loop5: rw=2049, want=143, limit=63 [ 339.626869] Buffer I/O error on dev loop5, logical block 142, lost async page write [ 339.751391] attempt to access beyond end of device [ 339.799771] loop5: rw=2049, want=144, limit=63 [ 339.829606] Buffer I/O error on dev loop5, logical block 143, lost async page write [ 339.847118] attempt to access beyond end of device [ 339.859014] overlayfs: failed to resolve './file0': -2 [ 339.864149] loop5: rw=2049, want=145, limit=63 [ 339.872390] Buffer I/O error on dev loop5, logical block 144, lost async page write [ 339.892820] attempt to access beyond end of device [ 339.901719] loop5: rw=2049, want=153, limit=63 16:09:02 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) sendmmsg$sock(r0, 0x0, 0x0, 0x0) io_setup(0xab, &(0x7f0000000200)=0x0) getsockopt$packet_buf(0xffffffffffffffff, 0x111, 0x0, 0x0, 0x0) r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$PIO_UNIMAP(r3, 0x4b67, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x3, 0x1, 0x0, r1, &(0x7f0000000000), 0x3000}]) 16:09:02 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) 16:09:02 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) 16:09:02 executing program 1: mkdir(0x0, 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) [ 340.058242] IPVS: ftp: loaded support on port[0] = 21 [ 340.152495] overlayfs: failed to resolve './file0': -2 [ 340.192243] EXT4-fs (sda1): changing journal_checksum during remount not supported; ignoring [ 340.240546] EXT4-fs (sda1): re-mounted. Opts: journal_async_commit, 16:09:02 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270ff", 0x15}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:02 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) [ 340.304878] EXT4-fs (sda1): changing journal_checksum during remount not supported; ignoring 16:09:02 executing program 1: mkdir(0x0, 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) [ 340.376149] EXT4-fs (sda1): re-mounted. Opts: journal_async_commit, 16:09:02 executing program 4: mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) 16:09:02 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) [ 340.486119] attempt to access beyond end of device [ 340.496704] loop5: rw=2049, want=78, limit=63 [ 340.535193] Buffer I/O error on dev loop5, logical block 77, lost async page write [ 340.550696] FAT-fs (loop3): invalid media value (0x00) [ 340.566262] attempt to access beyond end of device [ 340.571941] overlayfs: failed to resolve './file0': -2 [ 340.577731] FAT-fs (loop3): Can't find a valid FAT filesystem [ 340.585087] loop5: rw=2049, want=79, limit=63 [ 340.602310] Buffer I/O error on dev loop5, logical block 78, lost async page write [ 340.648486] attempt to access beyond end of device [ 340.683566] loop5: rw=2049, want=80, limit=63 [ 340.731145] Buffer I/O error on dev loop5, logical block 79, lost async page write [ 340.763366] attempt to access beyond end of device [ 340.770431] EXT4-fs (sda1): changing journal_checksum during remount not supported; ignoring [ 340.781101] loop5: rw=2049, want=81, limit=63 [ 340.814286] EXT4-fs (sda1): re-mounted. Opts: journal_async_commit, [ 340.834464] attempt to access beyond end of device [ 340.841986] loop5: rw=2049, want=114, limit=63 [ 340.856392] attempt to access beyond end of device [ 340.861836] loop5: rw=2049, want=115, limit=63 [ 340.884145] attempt to access beyond end of device [ 340.890046] loop5: rw=2049, want=116, limit=63 [ 340.902003] attempt to access beyond end of device [ 340.908960] loop5: rw=2049, want=117, limit=63 [ 340.914301] attempt to access beyond end of device [ 340.919992] loop5: rw=2049, want=130, limit=63 [ 340.946528] attempt to access beyond end of device [ 340.951619] loop5: rw=2049, want=131, limit=63 [ 340.952516] attempt to access beyond end of device [ 340.974625] IPVS: ftp: loaded support on port[0] = 21 [ 340.995736] loop5: rw=2049, want=132, limit=63 [ 341.002237] attempt to access beyond end of device [ 341.015863] loop5: rw=2049, want=133, limit=63 [ 341.027297] attempt to access beyond end of device [ 341.046192] loop5: rw=2049, want=149, limit=63 16:09:03 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) ioctl$sock_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000100)) perf_event_open(&(0x7f0000000280)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000040), 0x0) unshare(0x40000000) ioctl$UI_SET_KEYBIT(0xffffffffffffffff, 0x40045565, 0x190) sendmsg$DEVLINK_CMD_GET(0xffffffffffffffff, 0x0, 0x40000) r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000a, 0x8031, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000100)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_INFO(r1, 0x29, 0x40, &(0x7f0000000180)={'filter\x00'}, &(0x7f0000000100)=0x54) 16:09:03 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:09:03 executing program 4: mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) 16:09:03 executing program 5: mkdir(&(0x7f0000000100)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='bpf\x00', 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) creat(&(0x7f0000000180)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x110001) 16:09:03 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) 16:09:03 executing program 4: mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) [ 341.244572] EXT4-fs (sda1): changing journal_checksum during remount not supported; ignoring [ 341.267997] overlayfs: failed to resolve './file1': -2 [ 341.292714] EXT4-fs (sda1): re-mounted. Opts: journal_async_commit, 16:09:03 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:09:03 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270ff", 0x15}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:03 executing program 4: mkdir(0x0, 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) [ 341.481468] FAT-fs (loop3): invalid media value (0x00) [ 341.527712] overlayfs: failed to resolve './file1': -2 16:09:03 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) [ 341.553701] FAT-fs (loop3): Can't find a valid FAT filesystem 16:09:04 executing program 5: rt_sigaction(0x40, &(0x7f0000000180)={&(0x7f00000000c0)="f1460f1c1e460f475f0cc4637d40c100faf3410f1efac4a17e2d46d580ae800400000645ae", {}, 0x0, 0x0}, 0x0, 0x8, &(0x7f00000001c0)) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='stat\x00') r1 = syz_open_procfs(0x0, &(0x7f0000000140)='auxv\x00') sendfile(r1, r0, 0x0, 0x1f7) 16:09:04 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) [ 341.750433] IPVS: ftp: loaded support on port[0] = 21 [ 341.810413] EXT4-fs (sda1): changing journal_checksum during remount not supported; ignoring [ 341.878652] EXT4-fs (sda1): re-mounted. Opts: journal_async_commit, [ 341.917893] overlayfs: failed to resolve './file1': -2 16:09:05 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = fcntl$dupfd(r0, 0x0, r1) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000500)=ANY=[@ANYBLOB="726177000000000000000000000000000000000000000000000000000000000008f80000030000003003000098020000000000000000000000000000000000009802000098020000980200009802000098020000030080000000000000000000ffffffffe00000010000000000000000e4000000010000000000bd00000000007465616d5f736c6176655f310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c001080200000000000000000000000000000000000000005001686173686c696d6974000000000000000000000000000000000000000002726f73653000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffffffffffff00000000000000000000000003000000070000000000000000000000000000004800435400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000400000000000000000000000000000070009000000000000000000000000000000000000000000020004e4f545241434b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000980000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff"], 0x1) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000000)={0x0, 0x40004007fff, 0x32fe3cf0}, 0x14) shutdown(r3, 0x1) 16:09:05 executing program 4: mkdir(0x0, 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) 16:09:05 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:09:05 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) 16:09:05 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_GET_WIPHY(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)={0x1c, r1, 0x221, 0x0, 0x0, {0x2}, [@NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}]}, 0x1c}}, 0x0) 16:09:05 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:05 executing program 4: mkdir(0x0, 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) 16:09:05 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) [ 343.030588] xt_CT: netfilter: NOTRACK target is deprecated, use CT instead or upgrade iptables [ 343.038932] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 343.047436] overlayfs: invalid origin (79000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000) 16:09:05 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendmmsg$inet(r0, &(0x7f0000001bc0)=[{{&(0x7f0000000080)={0x2, 0x0, @remote}, 0x2ee, &(0x7f0000000200)=[{&(0x7f00000000c0)="9624", 0x2}], 0x1}}, {{&(0x7f0000000240)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f00000002c0)=[@ip_retopts={{0x3c, 0x0, 0x7, {[@timestamp={0x44, 0x8, 0x5f, 0x0, 0x0, [0x0]}, @cipso={0x86, 0xe, 0xffffffffffffffff, [{0x0, 0x0, "874351ba31eb"}]}, @ra={0x94, 0x4}, @rr={0x7, 0xf, 0x0, [@loopback, @local, @empty]}, @generic={0x0, 0x0, "3f52b052d37e23a8ac7cb238"}]}}}, @ip_tos_u8, @ip_tos_int, @ip_tos_int, @ip_retopts={{0x0, 0x0, 0x7, {[@rr={0x7, 0x0, 0x0, [@initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast]}, @cipso={0x86, 0x0, 0x0, [{0x0, 0x0, "2efe9eea73597151defcff"}, {}, {0x0, 0x0, "8baee464006cdff7142d5a"}, {0x0, 0x0, "a047d17236d8e9b8f39281e2db39"}, {0x0, 0x0, "9bfb7020eac62cd1f7c7428638fbdffb"}, {0x0, 0x0, "d59edd2416eee293de"}, {0x0, 0x0, "4ec87757d008d4e5c7"}, {0x0, 0x0, "6a5ff186"}]}]}}}], 0x40}}], 0x40000000000008c, 0x0) 16:09:05 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) [ 343.111930] FAT-fs (loop3): Filesystem has been set read-only [ 343.147208] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:05 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, 0x0, &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) 16:09:05 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) [ 343.447771] overlayfs: invalid origin (79000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000) [ 343.587152] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 343.617899] FAT-fs (loop3): Filesystem has been set read-only [ 343.624026] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) [ 343.665275] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 343.701705] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:06 executing program 2: capset(&(0x7f0000000000)={0x19980330}, &(0x7f0000000040)) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000280)={@remote}, 0x14) 16:09:06 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) 16:09:06 executing program 5: mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) chdir(&(0x7f0000000280)='./file0\x00') unlink(&(0x7f00000001c0)='./file1\x00') open(&(0x7f0000000100)='./file1\x00', 0x143042, 0x0) 16:09:06 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, 0x0, &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) 16:09:06 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:09:06 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(0x0, 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:06 executing program 0: mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) [ 344.500895] capability: warning: `syz-executor.2' uses 32-bit capabilities (legacy support in use) 16:09:06 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, 0x0, &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) [ 344.559930] overlayfs: invalid origin (79000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000) 16:09:07 executing program 5: accept4$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000800)='auxv\x00') close(0xffffffffffffffff) perf_event_open(&(0x7f00000004c0)={0x0, 0x6f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0xabb, &(0x7f0000000100)=[{&(0x7f00000000c0)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000101308006d5ebe5a0000ffff53ef", 0x4db, 0x400}], 0x4802, 0x0) 16:09:07 executing program 0: mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) 16:09:07 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x1000100) r1 = open(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x10, r1, 0x0) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) fallocate(r0, 0x0, 0x0, 0xc740) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000440)={0x10, 0xf0ffffff}, 0xc, 0x0}, 0x0) r2 = socket$inet6(0xa, 0x3, 0x9) perf_event_open(&(0x7f0000001600)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(r2, &(0x7f0000002b40)=[{{0x0, 0x40000, 0x0}}], 0x4000000000003be, 0x0, 0x0) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback, 0xfffffffe}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) perf_event_open(&(0x7f0000000080)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SVE_GET_VL(0x33, 0x0) syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 16:09:07 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) 16:09:07 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(0x0, 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:09:07 executing program 0: mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) 16:09:07 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) [ 345.010046] EXT4-fs (loop5): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 345.051872] EXT4-fs (loop5): group descriptors corrupted! 16:09:07 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(0x0, 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:09:07 executing program 5: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents64(0xffffffffffffffff, 0x0, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000280)='devtmpfs\x00', 0x0, 0x0) chdir(&(0x7f0000000300)='./file0\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) fallocate(r0, 0x0, 0x0, 0x110001) syz_open_procfs(0x0, &(0x7f0000000040)='map_files\x00') syz_mount_image$tmpfs(&(0x7f0000000100)='tmpfs\x00', &(0x7f0000000140)='./file0\x00', 0x0, 0x3, &(0x7f0000001340)=[{&(0x7f0000000180), 0x0, 0x3}, {&(0x7f0000000340)="9656c9ff16a7472d65ec70232b757827b1d6817afd941db83832c828b34283efbf53bba6d64fba47521e65a830402097733ce8a2626e4e3efefe1e0fee46eb40e7be43eaf55b9773c24fd73225db0ab2a012abd87e1d29a1449f488fef9c315313f2c8fe1cecea9a60c270ff08970609a52ca65681e70d86b2d52eae6a30b9ce06a130cf5c8f6da02ffef72fe97f2e85b01cd678b2ef2b5e7e1d0abb2992063d7a05b79ea841dedb75a15f5d7b19aea81701651131c4e24eacb2efee0ddfe48375448d0aa710ff17690adf51d0682a92e05fb0a2bd6947131b15f775c2c64e66040a79c3b757d7463d0044937c56e6abac86a4c9569fc156316742e7b606b452bcf72b48981a29f735fa8111f8d5abc077a878f2e5aa6bc6add1cc9c303b1772965f957dae2753c5b20581b6aceef4163590422d634f1b543df48b2721943ab695809b83389bbcd2e6a9bd4444b8b8aaa27302b3e596ab362b1a6a6ac59b4e8796ade56a59472117e8df7759084a86c72bb49f7951670fdccb28b7c0e7e6b6f3766cdfd829ab881c48cf1273c0eee0f8b7ba096afa0f6ba1da48a1c3a9c5ba0c3b6af7b2629d5d9786a6c2b399760514271484a0a4aa49165f2938dcad538aa661f7335730b5981f1d2f58b07f523de37e256011bfe5d6274341d8b353581f0d2525de6a397e9a2a188ecbeb581cd6eaffa216466559c3f20a973b823bfd0d39b1209d7d18300f997ac636bc3e69ecc80413b81c3a49750af9b6a348437723807b8c59056b970b97e4c2b6731630773b3ab6e557732a7c8508e87cd9665ecf6ac3df76588da5f71c63bc897a5125cf6139c48d5bf69e2ad9f96d0c260e73b34f016c72195b2cc310239c3e96df3ec2005d1828e2fe77ff5949b1082b9c8c39451ae75b75c90caf61fa31d1e800077e292f5f0e414678ea861a66de01b9ab2ec8b7fba5ffc691832ef0b17bc69eb3785a1fe64375cf8c3fa236ce36b24fcbca1906f012a08c8f45a9d9d0294074b45c2fd2084eb53f3e3b4bf54bddc3e039204385aff5bda12d8606263b71c23281ded029fb9d905964dc1847224af47e5e5950f0b641bf87443538946af5b79beaa6253a1732cf42fa7ebc4b6ab4449c22ed620d911d5f2d3a61df14d80873b16d0a03df2c2f166eb2aa26addb38793964977b45b4799caf4a70ba864d7cf9304c0a7bf068a9cdf84efc2984a5a33f8106788c58640d26761f965fd47a7f05fbb9332af7795f58c4c7f370e1ef386ed1f7b0585ff395d60a523cb25fcb67b51991a26fd55d15bfc4e461ec568659f27d3bbe13aacbe246dd034ad02fd8aa23b97156d13bb9af8b9571c8ae485b1b4162ed3a0f0804509dbdf1a42782ad283efcd692f6cda56964089c6b10d1919110272ba7d29cb2e07760c75a841a08be9eb1c031d8fe8e19efcd0dce604ec8ff1a88ec8d193a21ae002eb7fb62bf0ad6e46b837281647557e669d05b9562cc46a20a2691081c6d6f6384db1a9ceba41a3496d9066b886ea3dd440362a421ec8c5bccd07a3029bd96689409ddc3b578c69095104f961e5cfadff6723c7b51c2cfb8f63e85bc9b8ee6c1fd07e776efba61e1a96dcf7ca010814870ec298f1678c3c27d1f39afb7507fcaefcf5ed73398634e9e4932eb0f444b080087d7459bdba4cd14e8fb664f4cb6a264bb01c5a8df01ab184d9cf7d83826d8e507dd443e3cfeb9976dc1583daed20bb85881eb4a86f1fb7f25ed982830e64f14bc4beed88ad8c4ca361caddd291b3271b8fd6642a2799117a555d631aaf327f04b4d75eaf909784ae089e9d4a48ddf81513bbf11ca8f9ecd0047adff7e967e8c6d593231f5bc26af359c78717715e476af7a34658b0dbb56675564106a23aea1c02610e7c967fa6db71d8b1a7d2b440bcb0989e092aebeddaaa1a42bc64df0cd702224e6006d45eeef603f4d601b81232babd0e6467a6ba39c63bfd3ce5e28bc7bc332e0a4fffe0496d0dc0ebe70ae82d1cb3d681eec7430872319dbe666ee7d9af60bb26b129db236c577a089e1fa5371415e9217d4d51a1f63eccef819aef160e4856a4c1f82b190d9f55be55e9df87b66b2bfbe41fa72ca97b8d29d0696d2abc963db83f5c3f2307d4c8bbd07f1a1516faab94040f2556da5f20bf2e8df17d3a554ed9c95f6ccd6b9ffa214f1d12b3b1b7d4d951dc3eaa1b1c5a2832f235049ff831b2d0bf18b08104fb1501b546f3094dbe05934b8fc412b6a1edbdb1e80e2bf4cc5f79c34e6fd3af116f1e28376fc454118a66719bb9f8f1b1a346df951da2c5851dfac36ab6bc4dcc5d9c77ba8c9d3e12fbde4d8c96170c5b4a44785527ec00e9d2de9859134a4802d4331e203d717afd6fbd895d70a01584ab29bb4b2e576ed2af47ab845abb74cd6724ffbf75a5eab8479fca7ad02cde4d39a68d76d90ed932062d0cb149fdbff7ab5ba16b6d8d7d440cc2dc8ef800c7906dd2ece89210a7c2a8281be19ac794e095167f6663182fdfc3ed1940c241c8d91d7c6087879970a865e0e55da51d3f43ec2944d9b18984e33ee47ad4369cd9138c8edd6d8087f5ab94c4eb430abf9ef74758ee87cd2354a0a0c288b1679a1387f98a03010bb1e6d66b91dffee19ef0894390d4dd77e4802ef3f88b4da3bd46c9c0a19d2cfc4712f3b221fb2fa448863bfa814ee4a8c9a3e22e07d7a37f218c45a5c5853e901fc04d7ebe3940d65dae13cca89bd34cdb22699aae83fece699b5ea50f1d3a32ae7ff783ef5454cf4961cd576f6a780bc6e567fd9b25763e650e31324621d6c1a7f44acf1beeb970e411a45ef1c8b031861d4da9bcd7367775fafcdd8dd76927a0bb8783fca315ec05d1b38768bb1a0555f729b16f6b1463cc65535703fe4905c3d35690fdb84cad19cbc1672d11979b9d82a225a3328743d3da2ed587085ad809d029a5270f93e1d5e29779665e5513fba3e18fb47c17fc864cb8c7a0c6193463611cd00cf1abb94c62cf6878942827f65d8aea7ab736c940bfafb7c1924207cd2359f8436558a933b76808edb440dea41bfc558e60953ab0a2ae7efcb64384a10b56b2ed109834841ca1576b0c8847ddddc5d0ba4e0d639d0f8bc18e9099ff419781d36dfce3c26d8b0a6ccd468cfe86c00a6e058b0e4dc10b051426f4881ac14c0362c105ec328c215bdda9f0ae63ffcae0291c9874c07d3f6bf8c746f0ac426fe01c3205ea80cf88cf2febbe14eaa29e2b350d5a23c6018a7cdd32b3e961642896615cf3b5cfe899cc7856b373eee07c1ae66b6898697b670577e4a3eaa674cf88cf22647c84f3db857a76f275e8554decec71b60794b976406a565ef075cbbe4c099ba606ef9176e1df4717292164433509f94dc3fd8215704bc8f01bc198aeb36bdfc85c440884abc90c9b53db8ca0523e6327abe5725733f6e65b44c8c45fb0c130d16b54d9b7e9f76d748376d941bc293b9e8822481c162b5a6c183a3eb44967b0a93f9c5416432ca65c087e8f608b8a6eab909119275babf9fa32c4118a723c59352f56c3fcf596531b9d51bea37a0b4a74750dbec1c72152e880ce244d399e525d7ed26e910c1484aa83cbdeac0a9e9020c4541c1e2dce4d15f0c36aaa220a8962197d27dee1ec47aabfa056dc262196d3322ace19dc02aa3d751bd33b4b26d514e97c8b1fb5f740a4e570b3b269459658ebf27fe0a90351e01a16a3dcd1d99f97a20d666cfdb9257064466ce57fbb74b009d344e4dde5cd901cecf4cad422c245eaddb9538cad5d609bb9444ac4669e571c301e276a22d167735dbba645894df70971d809c0aa553b7f307cb5df653d58cdf1a1827f9acd76b8f6e7f621b91ad757c49517748ecf72941e97b9aec41ee772705c03de14cef853c5a1e968deefb754c458713039604ad8e6d01de0009cfe7fdff9727bf25ca6903e6d0566572bd2a9092a5019323ddb206eabfa2de3dc5fb10be1fa529aa52ea9d553608f688b73f331df168afb14ca1487837508379597afea783ce308d0cfc580ec5a3ef7377305be4c29f77603489174d6c35457cf59e556abf7187d4e314127e0a3deab4b80d9ab7b3f1094c166caccb4cf01ef33c36da387e33a306d0ed1c87f0356ccaf3a8ff27d115d24a9417f0d691fb13f9b5abf5644becb715148170088dd09e6db1aec000b93a1d115574fc8ab9892c74f459bb2e8287426f945b13afec8cf7b0b44385f688361c6a1e6a82d3a1cf02af6eec4d9ea05534d7eeb343cbd4b157e8c7b3b7b04f7dcdaa012c3e0660417cbf69bacc72b8c781694a5139d3690df10d1f8434997e379d966d01d7980192e91f5a404f115308b73ae56055f22f551de9d0bfc1522252708f6adad2935eeeaee142c150c693ac284f5478e361205a1516cb4fe73e77dc346247e2174346655796bac80c480135b4a5e9416c5b21051b6b53e3c43e7b80bad27c1fd2fd3eb326ecc1fd4f5c9a90d5dbab23a3566e6d99b415d30958269cf81db2caf38949534fdafd1555e1c491407622e5d5248a436865474c73a75fab60c1636c8cac2f212a04fb71d5bf0b4a6f3c13f7de3958d72226ee143022fe5d199976d9c1e206e74342b15278d3436792f56cec3ace80e3fb260e1cc8e3d66b2b0be1a94887771b1b3d598bb59a26f2abe3223707f86ab9d55c2f00d84d0ec26cd5203e5805316061c699ff9e4dc077e37502fc6f56fb1d249794d789a0889cf4af63264ad08c1b970c60f7c58290049e5f15a734f02aebddaa568f07d8da97432dfce2e5e43f2063e4fdc94e7e653601fecc4bc8e899abd815c14b5ab24a94599258f02c2cfdff43e16764a1e4e4a42a0cbc19750805353cde2cf41b41c54a41217cf49cdaa7f1e6f32f137b8c27572a04190ad9b82d39c6c70b59fa17803cf275ff3933415ad0bf5e039cb73219e77f44d676ea97e919d5e212962989b1149786a9c0c22b2a76ca5e5cc84cae55a164ea879260b11872b137eab07a49e916b2270d5cc3cbca94ddb0d1048013cf8d803f8c51b1d5581688cdeb1a8c6fd4430400581ec1c082972dcab6eb2f5bd55132013134ed44912911150a1ef52783dce101e084cf1125fecd9284e2762af6bd74e263a6f21f82e3045ebf18a814ff5daf9f8b53ad9532a6aa46652301bf9f5c008e7e36b64ff1312d83693162ccb503cd6f00a3e4ca7a83ca3256105caeba01ce3ef3ade25b811be813a129b7c436543495e78eadd3f6b4177fa07cbbaeedee9996995f55bc34bc07b1421651f3695bb971e7314e201e84d0818f17a1fb4d35e2dcb66c955447753c1341c8db33b2d3b9fb63a873294b100596e061f2c41a86ef43a94c173198c42adf326521734b4ebf16b47a1caa04674daf4c40913edb2a8cd40ce2804d0f32fa24fd45abdfbe304fe3ac19fee0f6831b843ec1da97b9437f17f737571998a5bd1bdee60d2db8eeeba8daf316f32cd56cc26882f2398e16d24dee1a5350f52124dbaf4cc54d9521c8558cab2e6a3a9d215dea74b2ce07aa41d1d6934c184e0803da473d7110820c3221ccd73be8af52f8c682077f23449979cf6b70fadfe89f1a5f0adfb1e54bafb132653d7e6f771827490b66ab47c8d4b4493c1c7fd7bed45f6e0ea7559645311b95797f4394dc97a1057b9195b7296b5a85bcb019e7cbf69a91cce9caec8fa7c73acce39893548a56a378e2acc0d8dde07515d9b0795e88ee318bfba3b80e5ca76c374526be227eb759f3adf248ca7552d9208e3349e3cb2f58094657117bcd9f8c0e4024db1ecf91fdc1b578c5c63d74265996b0e8f9cb662d1a684a8bab", 0xfff, 0x1a}, {&(0x7f0000000200), 0x0, 0xff}], 0x1000, 0x0) 16:09:07 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(0x0, 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:07 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) 16:09:07 executing program 0: open(0x0, 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) 16:09:07 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(0x0, 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:09:07 executing program 0: open(0x0, 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) 16:09:08 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000000c0)={@mcast1, 0x800, 0x0, 0x103, 0x1}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f00000005c0)=0x1, 0x4) sendmsg$inet6(r0, &(0x7f0000000180)={&(0x7f0000000080)={0xa, 0x4e24, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f00000002c0)=[@rthdrdstopts={{0x12, 0x29, 0x5}}], 0x18}, 0x0) 16:09:08 executing program 0: open(0x0, 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) 16:09:08 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, 0x0, 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) 16:09:08 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(0x0, &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x2, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:09:08 executing program 5: syz_mount_image$msdos(&(0x7f0000000100)='msdos\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_read_part_table(0x0, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="02006800000f000000000005000000e08128b14700000000d59863d20000000002000f2020cc00", 0x27, 0x1a0}]) 16:09:08 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, 0x0, 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) 16:09:08 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(0x0, &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x2, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:09:08 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(0x0, 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:08 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) 16:09:08 executing program 2: r0 = syz_open_dev$sndpcmc(&(0x7f0000000400)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x0) r2 = dup2(r0, r1) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r2, 0xc2604110, &(0x7f0000000080)={0x0, [[0xc], [0x80000000, 0x2], [0x1f]], [], [], [], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 16:09:08 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000005500)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000380)=0x80000008) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000140)) r2 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) ioctl$TCXONC(r2, 0x540a, 0x1) 16:09:08 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, 0x0, 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) 16:09:08 executing program 2: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) 16:09:09 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) 16:09:09 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(0x0, &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x2, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:09:09 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) 16:09:09 executing program 5: r0 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8) sendmmsg(r0, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x2e5}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1ceb", 0xf7}, {&(0x7f0000000140)="cd27c0d84df0ad804ad5262a10c5f452", 0x10}, {&(0x7f00000012c0)="496288e0b56eefd3ff461c68e4fd5c8ecdcff3c85146c785e809c9ca7cb538fa2f0e2ca36adfc49e66123dec9cac26f3e4e77eadba335fecf61c5891ceea669ef775557e1b9d3415515a3ed13c2f932d1beb7d0e66fcf84982e7dc839dd15878", 0x60}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e2c812a5eefbd78546783b6bd280dc4ec1cd015bee7d07f0993d6d8f64f95c69e8a45bd4a19cff0e5", 0xe3}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45ee22ba99cfe850d62e87e556e8fa3459d346b4d1a572c7334773786ad61a45508f7e", 0x44}], 0x6, 0x0, 0x0, 0xffffffe0}}], 0x4000027, 0x4000000) 16:09:09 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x22, &(0x7f00000001c0)={@ipv4={[0x4, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2], [], @loopback}, 0x10, 0x2}, 0x20) 16:09:09 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) 16:09:09 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(0xffffffffffffffff) r0 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r0, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r0, r0, &(0x7f00000001c0), 0x8080fffffffe) 16:09:09 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) 16:09:09 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0x0, @empty={[0x75]}, @local, {[], {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 16:09:09 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', 0x0, &(0x7f0000000040)='y\x00', 0x2, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:09:09 executing program 5: r0 = socket$inet6(0xa, 0x80803, 0x87) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000600)={{{@in6=@remote, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x2b}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@dev, 0x0, 0x2b}, 0x0, @in6=@remote}}, 0xe8) connect$inet6(r0, &(0x7f00000000c0), 0x1c) 16:09:09 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) 16:09:09 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x0, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) 16:09:09 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0x0, @empty={[0x75]}, @local, {[], {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 16:09:09 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', 0x0, &(0x7f0000000040)='y\x00', 0x2, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:09:10 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) 16:09:10 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f0000000400)) 16:09:10 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, 0x0, 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) 16:09:10 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(0xffffffffffffffff) r0 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r0, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r0, r0, &(0x7f00000001c0), 0x8080fffffffe) 16:09:10 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', 0x0, &(0x7f0000000040)='y\x00', 0x2, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:09:10 executing program 2: mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) chdir(&(0x7f0000000280)='./file0\x00') r0 = socket$inet6(0xa, 0x400000000803, 0x5f) close(r0) r1 = open(&(0x7f0000000100)='./file1\x00', 0x143042, 0x0) sendfile(r0, r1, 0x0, 0x80001d00c0d0) 16:09:10 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) 16:09:10 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, 0x0, 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) 16:09:10 executing program 5: syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f0000000000)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000080)='./file0\x00', 0x0) fallocate(r1, 0x1, 0x0, 0x369e5d84) r2 = socket(0x0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, 0x0) sendmsg$TEAM_CMD_PORT_LIST_GET(0xffffffffffffffff, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) socket(0x0, 0x0, 0x0) sendmsg$nl_route(r3, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x0, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000100)='./file0\x00', 0x0) 16:09:10 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, 0x0, 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) 16:09:11 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000400)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = add_key$keyring(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz'}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$get_keyring_id(0x0, r0, 0x0) keyctl$revoke(0x3, r0) truncate(0x0, 0x0) 16:09:11 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', 0x0, 0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:09:11 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) 16:09:11 executing program 2: setsockopt$IP_VS_SO_SET_EDITDEST(0xffffffffffffffff, 0x0, 0x489, &(0x7f0000000080)={{0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 'none\x00', 0x0, 0x100002}, {@empty}}, 0x44) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x1000000, 0x1, &(0x7f0000000000)=[{&(0x7f0000000080)="eb3c906d6b66732e666174000204010002000270fff8", 0x268}], 0x0, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000100)=""/230, 0xe6) 16:09:11 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x0, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) 16:09:11 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', 0x0, 0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:09:11 executing program 5: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x14, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$LOOP_SET_STATUS64(0xffffffffffffffff, 0x4c04, &(0x7f0000001dc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "87a7f49a073be31d24bf1afa697774373d1b45aceebe33c4d5e7f9161b2852f8b2fb8c3a31cf23f2969197c093538a91b434ad0127f09eb2d8f3a6f287955285", "c308a72fde1cf04214dd83ed26167f70fc8ea66b77652b7134caa1ed55423dd94837b3b6403637c2ad5f42e5c7fca8b70dcade0f70f5a30db4ea9efb6f7d2d66", "d213ae659e432a79a676389d5a2b3cfd3c93c2b6a405607f570faa83e624da69"}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x24ba1dc0}) 16:09:11 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) 16:09:11 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(&(0x7f0000000100), &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f0000000380)) mount(&(0x7f0000000a00)=ANY=[], &(0x7f0000903000)='./file0\x00', &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount$bpf(0x0, &(0x7f0000000000)='./file0/file0\x00', &(0x7f0000000080)='bpf\x00', 0x0, &(0x7f0000000580)) mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:11 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(0xffffffffffffffff) r0 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r0, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r0, r0, &(0x7f00000001c0), 0x8080fffffffe) 16:09:11 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x0, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) 16:09:12 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x0, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) 16:09:12 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', 0x0, 0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:09:12 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) 16:09:12 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(&(0x7f0000000100), &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f0000000380)) mount(&(0x7f0000000a00)=ANY=[], &(0x7f0000903000)='./file0\x00', &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount$bpf(0x0, &(0x7f0000000000)='./file0/file0\x00', &(0x7f0000000080)='bpf\x00', 0x0, &(0x7f0000000580)) mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:12 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) 16:09:12 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) 16:09:12 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) 16:09:12 executing program 5: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) renameat(r0, &(0x7f0000000400)='./bus\x00', r0, &(0x7f0000000440)='./file0\x00') write$UHID_INPUT(r1, &(0x7f0000000980), 0x10a9) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) fallocate(r2, 0x0, 0x0, 0xa6ba0) sendfile(r1, r1, &(0x7f00000000c0), 0x8080fffffffe) 16:09:12 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, 0x0, &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:09:12 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(&(0x7f0000000100), &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f0000000380)) mount(&(0x7f0000000a00)=ANY=[], &(0x7f0000903000)='./file0\x00', &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount$bpf(0x0, &(0x7f0000000000)='./file0/file0\x00', &(0x7f0000000080)='bpf\x00', 0x0, &(0x7f0000000580)) mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:13 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(0x0, 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:13 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) 16:09:13 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000, 0x0) 16:09:13 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(&(0x7f0000000100), &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f0000000380)) mount(&(0x7f0000000a00)=ANY=[], &(0x7f0000903000)='./file0\x00', &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount$bpf(0x0, &(0x7f0000000000)='./file0/file0\x00', &(0x7f0000000080)='bpf\x00', 0x0, &(0x7f0000000580)) mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:13 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, 0x0, &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:09:13 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', 0x0, 0x0, 0x2000, 0x0) 16:09:13 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, 0x0, &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:09:13 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) 16:09:13 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', 0x0, 0x0, 0x2000, 0x0) 16:09:13 executing program 5: perf_event_open(&(0x7f0000000440)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000004c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0xabb, &(0x7f0000000100)=[{&(0x7f00000000c0)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000101308006d5ebe5a0000ffff53ef", 0x4db, 0x400}], 0x4801, 0x0) 16:09:13 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:09:13 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(&(0x7f0000000100), &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f0000000380)) mount(&(0x7f0000000a00)=ANY=[], &(0x7f0000903000)='./file0\x00', &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) [ 351.005404] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 351.019486] FAT-fs (loop3): Filesystem has been set read-only [ 351.026266] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:13 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(0x0, 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:13 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./fi'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) 16:09:13 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', 0x0, 0x0, 0x2000, 0x0) 16:09:13 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) 16:09:13 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(&(0x7f0000000100), &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f0000000380)) mount(&(0x7f0000000a00)=ANY=[], &(0x7f0000903000)='./file0\x00', &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) [ 351.335705] EXT4-fs (loop5): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock 16:09:13 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./fi'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) [ 351.405410] EXT4-fs (loop5): ext4_check_descriptors: Inode table for group 0 overlaps superblock 16:09:13 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0) 16:09:13 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(&(0x7f0000000100), &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f0000000380)) mount(&(0x7f0000000a00)=ANY=[], &(0x7f0000903000)='./file0\x00', &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:13 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) [ 351.504434] EXT4-fs error (device loop5): ext4_fill_super:4398: inode #2: comm syz-executor.5: iget: root inode unallocated [ 351.510062] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 351.526256] EXT4-fs (loop5): get root inode failed [ 351.533103] EXT4-fs (loop5): mount failed [ 351.547122] FAT-fs (loop3): Filesystem has been set read-only [ 351.554989] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:14 executing program 5: syz_mount_image$msdos(&(0x7f0000000100)='msdos\x00', 0x0, 0x0, 0x0, 0x0, 0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_read_part_table(0x0, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="02006800000f000000000005000000e08128b14700000000d59863d20000000002000f2020cc00000000ff0700690000000000000000000000000000000000000000000000000000000000000000000000000000000000008a6e94c0000055aa", 0x16f, 0x1a0}]) 16:09:14 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(0x0, 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:14 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./fi'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) 16:09:14 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, 0x0) 16:09:14 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0) 16:09:14 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(&(0x7f0000000100), &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f0000000380)) mount(&(0x7f0000000a00)=ANY=[], &(0x7f0000903000)='./file0\x00', &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) [ 351.927038] overlayfs: missing 'lowerdir' 16:09:14 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) [ 351.950559] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) 16:09:14 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000680)='./file0\x00', 0x0, 0x2001001, 0x0) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0) 16:09:14 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, 0x0) [ 352.018664] FAT-fs (loop3): Filesystem has been set read-only [ 352.024996] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) [ 352.045662] loop5: p1 < > p4 [ 352.049727] loop5: partition table partially beyond EOD, truncated 16:09:14 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(&(0x7f0000000100), &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f0000000380)) mount(&(0x7f0000000a00)=ANY=[], &(0x7f0000903000)='./file0\x00', &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:14 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) [ 352.073199] loop5: p1 size 2 extends beyond EOD, truncated [ 352.103307] loop5: p4 start 1854537728 is beyond EOD, truncated 16:09:14 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) [ 352.199317] overlayfs: missing 'lowerdir' 16:09:14 executing program 5: syz_mount_image$msdos(&(0x7f0000000100)='msdos\x00', 0x0, 0x0, 0x0, 0x0, 0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_read_part_table(0x0, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="02006800000f000000000005000000e08128b14700000000d59863d20000000002000f2020cc00000000ff0700690000000000000000000000000000000000000000000000000000000000000000000000000000000000008a6e94c0000055aa", 0x16f, 0x1a0}]) 16:09:14 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) close(r1) 16:09:14 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, 0x0) 16:09:14 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(&(0x7f0000000100), &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f0000000380)) mount(&(0x7f0000000a00)=ANY=[], &(0x7f0000903000)='./file0\x00', &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) [ 352.424844] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) 16:09:14 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) [ 352.523865] audit: type=1800 audit(1578672554.841:83): pid=17720 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor.4" name="file0" dev="loop4" ino=63 res=0 [ 352.556747] FAT-fs (loop3): Filesystem has been set read-only [ 352.567235] overlayfs: missing 'lowerdir' [ 352.567261] audit: type=1804 audit(1578672554.841:84): pid=17720 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir115633152/syzkaller.YcevLE/194/file0/file0" dev="loop4" ino=63 res=1 [ 352.592615] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:14 executing program 4: syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f0000000000)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000080)='./file0\x00', 0x0) fallocate(r1, 0x1, 0x0, 0x369e5d84) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000100)='./file0\x00', 0x0) 16:09:15 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(&(0x7f0000000100), &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f0000000380)) mount(&(0x7f0000000a00)=ANY=[], &(0x7f0000903000)='./file0\x00', &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:15 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[]) 16:09:15 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:15 executing program 5: syz_mount_image$msdos(&(0x7f0000000100)='msdos\x00', 0x0, 0x0, 0x0, 0x0, 0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_read_part_table(0x0, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="02006800000f000000000005000000e08128b14700000000d59863d20000000002000f2020cc00000000ff0700690000000000000000000000000000000000000000000000000000000000000000000000000000000000008a6e94c0000055aa", 0x16f, 0x1a0}]) 16:09:15 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], 0x0, 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) [ 352.854129] overlayfs: missing 'lowerdir' 16:09:15 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[]) 16:09:15 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(&(0x7f0000000100), &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f0000000380)) mount(&(0x7f0000000a00)=ANY=[], &(0x7f0000903000)='./file0\x00', &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:15 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], 0x0, 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) [ 353.092817] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) 16:09:15 executing program 5: syz_mount_image$msdos(&(0x7f0000000100)='msdos\x00', 0x0, 0x0, 0x0, 0x0, 0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_read_part_table(0x0, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="02006800000f000000000005000000e08128b14700000000d59863d20000000002000f2020cc00000000ff0700690000000000000000000000000000000000000000000000000000000000000000000000000000000000008a6e94c0000055aa", 0x16f, 0x1a0}]) [ 353.145935] FAT-fs (loop3): Filesystem has been set read-only [ 353.175629] overlayfs: missing 'lowerdir' [ 353.181913] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:15 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[]) 16:09:15 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(&(0x7f0000000100), &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f0000000380)) mount(&(0x7f0000000a00)=ANY=[], &(0x7f0000903000)='./file0\x00', &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) [ 353.356342] overlayfs: missing 'lowerdir' [ 353.371115] loop5: p1 < > p4 [ 353.374509] loop5: partition table partially beyond EOD, truncated [ 353.387294] loop5: p1 size 2 extends beyond EOD, truncated [ 353.407359] loop5: p4 start 1854537728 is beyond EOD, truncated [ 353.766214] audit: type=1804 audit(1578672556.091:85): pid=17951 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir115633152/syzkaller.YcevLE/195/file0/file0" dev="loop4" ino=64 res=1 16:09:16 executing program 4: r0 = socket(0x10, 0x802, 0x0) write(r0, &(0x7f0000294f74)="fc0000004a000700ab092509090007000aab80ff010000000000369321000100ff050000000500000000000000036915fa2c1ec28656aaa79bb94b46fe0000000700020800008c0000036c6c256f1a272f2e117c22ebc205214000000000008934d07302ade01720d7d5bbc91a3e2e80772c74fb2cc56ce1f0f156272f5b00000005defd5a32e280fc83ab82f605f70c9ddef2fe082038f4f8b29d3ef3d92c83170e5bbab2ccd243f295ed94e0ad91bd0734babc7c3f2eeb57d43dd16b17e583df150c3b880f411f46a6b567b4d5715587e658a1ad0a4f01731d05b0350b0041f0d48f6f0000080548deac270e33429fd3000175e63fb8d38a873cf1", 0xfc) 16:09:16 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:16 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB]) 16:09:16 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], 0x0, 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) 16:09:16 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(&(0x7f0000000100), &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f0000000380)) mount(&(0x7f0000000a00)=ANY=[], &(0x7f0000903000)='./file0\x00', &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:16 executing program 5: mkdir(&(0x7f0000000100)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) chdir(&(0x7f0000000280)='./file0\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc020662a, 0x0) [ 353.793716] audit: type=1804 audit(1578672556.091:86): pid=18006 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir115633152/syzkaller.YcevLE/195/file0/file0" dev="loop4" ino=64 res=1 [ 353.841883] audit: type=1804 audit(1578672556.091:87): pid=18008 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir115633152/syzkaller.YcevLE/195/file0/file0" dev="loop4" ino=64 res=1 16:09:16 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(&(0x7f0000000100), &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f0000000380)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) [ 353.906530] overlayfs: missing 'lowerdir' 16:09:16 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB]) 16:09:16 executing program 5: socket$inet6_tcp(0xa, 0x1, 0x0) syz_mount_image$ext4(0x0, 0x0, 0x0, 0x1, &(0x7f00000007c0)=[{&(0x7f0000000580)="62f23e748cdfecc0d3bcb88248f9f8f8e87edc5637656d6e511dcdc6041c8d8a0957939950c15c7ac6360c7820e1d5957ba4167f17600b58767db91e29eb92a20f86dddfb0f8dda322d3ddeadba924051c7894f228f090746b1a55e851e7dcaae4d8411f6806d216b4f2e7eca231a301cc0c9bb4bb5598a94336a99790d3b77dcda45483c1fb1194c56ddfddb587442754e6c815", 0x94, 0x9}], 0x0, 0x0) perf_event_open(&(0x7f0000000440)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000340)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8c}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0xabb, &(0x7f0000000100)=[{&(0x7f00000000c0)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000101308006d5ebe5a0000ffff53ef", 0x4db, 0x400}], 0x4801, 0x0) 16:09:16 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x0, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) [ 354.076429] netlink: 180 bytes leftover after parsing attributes in process `syz-executor.4'. 16:09:16 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(&(0x7f0000000100), &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f0000000380)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:16 executing program 4: r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000000)={0x8001}, 0x10) write(r0, &(0x7f00000000c0)="240000001e005f0214fffffffffffff8070000000000000000000000080040000d000000", 0x24) [ 354.184423] overlayfs: missing 'lowerdir' 16:09:16 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB]) [ 354.291704] EXT4-fs (loop5): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 354.374782] EXT4-fs (loop5): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 354.420194] EXT4-fs (loop5): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 354.458668] overlayfs: missing 'lowerdir' [ 354.475353] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue 16:09:16 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(0x0, 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:16 executing program 4: r0 = socket(0x11, 0x800000003, 0x0) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c58110308d9123127ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000100)={r2, 0x5, 0x3, @random="cecfccad338b"}, 0x10) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000040)={r2, 0x1, 0x1, @random="ea6cffc594fd"}, 0x3eaa63f06ce455aa) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f00000001c0)={r2, 0x5, 0x6, @link_local}, 0x10) 16:09:16 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x0, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) 16:09:16 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(&(0x7f0000000100), &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f0000000380)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:16 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=.']) 16:09:16 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ashmem\x00', 0x0, 0x0) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) socket$inet6(0xa, 0x0, 0x0) connect$vsock_stream(r1, &(0x7f0000000280)={0x28, 0x0, 0x0, @my=0x1}, 0x10) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(0x0, 0x0) socket(0x10, 0x2, 0x0) mount$overlay(0x40000f, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f0000000200), 0x8) [ 354.705639] device lo entered promiscuous mode [ 354.718429] audit: type=1400 audit(1578672557.041:88): avc: denied { map } for pid=18271 comm="syz-executor.5" path="/dev/ashmem" dev="devtmpfs" ino=1934 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=chr_file permissive=1 [ 354.736017] overlayfs: missing 'lowerdir' 16:09:17 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(&(0x7f0000000a00)=ANY=[], &(0x7f0000903000)='./file0\x00', &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:17 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=.']) [ 354.763051] device lo left promiscuous mode 16:09:17 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x0, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) 16:09:17 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000733000)={0x5, 0x5, 0x7, 0x1}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0xc, 0x4, 0x4, 0x3d, 0x0, r0, 0x0, [0x1a0ffffffff, 0x1a0ffffffff, 0x2e], 0x0, 0xffffffffffffffff, 0x2, 0x2}, 0x3c) 16:09:17 executing program 5: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ashmem\x00', 0x0, 0x0) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) socket$inet6(0xa, 0x0, 0x0) connect$vsock_stream(r1, &(0x7f0000000280)={0x28, 0x0, 0x0, @my=0x1}, 0x10) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(0x0, 0x0) socket(0x10, 0x2, 0x0) mount$overlay(0x40000f, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f0000000200), 0x8) [ 355.004769] overlayfs: missing 'lowerdir' [ 355.020138] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) 16:09:17 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, 0x0, 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) [ 355.064170] FAT-fs (loop3): Filesystem has been set read-only [ 355.098864] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:17 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(0x0, 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:17 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=.']) 16:09:17 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(&(0x7f0000000a00)=ANY=[], &(0x7f0000903000)='./file0\x00', &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:17 executing program 4: 16:09:17 executing program 5: 16:09:17 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, 0x0, 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) 16:09:17 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(&(0x7f0000000a00)=ANY=[], &(0x7f0000903000)='./file0\x00', &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:17 executing program 4: [ 355.341974] overlayfs: missing 'lowerdir' 16:09:17 executing program 5: 16:09:17 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lower']) 16:09:17 executing program 4: [ 355.608265] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) 16:09:18 executing program 5: [ 355.665583] FAT-fs (loop3): Filesystem has been set read-only [ 355.707423] overlayfs: unrecognized mount option "lower" or missing value [ 355.711008] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:18 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(0x0, 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:18 executing program 4: 16:09:18 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, 0x0, 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) 16:09:18 executing program 2: mount(&(0x7f0000000100), &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f0000000380)) mount(&(0x7f0000000a00)=ANY=[], &(0x7f0000903000)='./file0\x00', &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:18 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lower']) 16:09:18 executing program 5: 16:09:18 executing program 4: 16:09:18 executing program 2: mount(&(0x7f0000000100), &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f0000000380)) mount(&(0x7f0000000a00)=ANY=[], &(0x7f0000903000)='./file0\x00', &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:18 executing program 5: 16:09:18 executing program 4: [ 355.982063] overlayfs: unrecognized mount option "lower" or missing value 16:09:18 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) 16:09:18 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lower']) [ 356.120357] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 356.179598] FAT-fs (loop3): Filesystem has been set read-only [ 356.214549] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:18 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x0, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:18 executing program 2: mount(&(0x7f0000000100), &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f0000000380)) mount(&(0x7f0000000a00)=ANY=[], &(0x7f0000903000)='./file0\x00', &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:18 executing program 5: 16:09:18 executing program 4: 16:09:18 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) [ 356.294696] overlayfs: unrecognized mount option "lower" or missing value 16:09:18 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./']) 16:09:18 executing program 4: 16:09:18 executing program 2: mkdir(0x0, 0x0) mount(&(0x7f0000000100), &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f0000000380)) mount(&(0x7f0000000a00)=ANY=[], &(0x7f0000903000)='./file0\x00', &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:18 executing program 5: 16:09:18 executing program 5: 16:09:18 executing program 4: [ 356.637044] overlayfs: invalid origin (7900742f69705f76735f73746174735f706572637075000000000000000000000000000000000000000000000000000000000000000000000000000000000000) 16:09:19 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@journal_async_commit='journal_async_commit'}]}) [ 356.706990] audit: type=1804 audit(1578672559.031:89): pid=18621 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir750286331/syzkaller.1tpX84/150/file0/bus" dev="sda1" ino=17323 res=1 [ 356.750823] overlayfs: overlapping upperdir path 16:09:19 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x0, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:19 executing program 2: mkdir(0x0, 0x0) mount(&(0x7f0000000100), &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f0000000380)) mount(&(0x7f0000000a00)=ANY=[], &(0x7f0000903000)='./file0\x00', &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:19 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./']) 16:09:19 executing program 5: 16:09:19 executing program 4: 16:09:19 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, 0x0) 16:09:19 executing program 4: 16:09:19 executing program 5: 16:09:19 executing program 2: mkdir(0x0, 0x0) mount(&(0x7f0000000100), &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f0000000380)) mount(&(0x7f0000000a00)=ANY=[], &(0x7f0000903000)='./file0\x00', &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) [ 357.453493] overlayfs: invalid origin (7900742f69705f76735f73746174735f706572637075000000000000000000000000000000000000000000000000000000000000000000000000000000000000) [ 357.524241] EXT4-fs (sda1): re-mounted. Opts: [ 357.548733] overlayfs: overlapping upperdir path 16:09:19 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, 0x0) 16:09:19 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f0000000380)) mount(&(0x7f0000000a00)=ANY=[], &(0x7f0000903000)='./file0\x00', &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:20 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./']) [ 357.667765] audit: type=1804 audit(1578672559.991:90): pid=18657 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir750286331/syzkaller.1tpX84/151/file0/bus" dev="loop3" ino=69 res=1 [ 357.675999] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 357.735750] FAT-fs (loop3): Filesystem has been set read-only [ 357.742141] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:20 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x0, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:20 executing program 5: 16:09:20 executing program 4: 16:09:20 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f0000000380)) mount(&(0x7f0000000a00)=ANY=[], &(0x7f0000903000)='./file0\x00', &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) [ 357.861813] EXT4-fs (sda1): re-mounted. Opts: 16:09:20 executing program 4: 16:09:20 executing program 5: 16:09:20 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./fil']) [ 357.892784] overlayfs: invalid origin (7900742f69705f76735f73746174735f706572637075000000000000000000000000000000000000000000000000000000000000000000000000000000000000) [ 357.919880] overlayfs: overlapping upperdir path 16:09:20 executing program 5: 16:09:20 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, 0x0) 16:09:20 executing program 4: [ 358.190917] audit: type=1804 audit(1578672560.511:91): pid=18687 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir750286331/syzkaller.1tpX84/152/file0/bus" dev="loop3" ino=70 res=1 [ 358.227620] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) 16:09:20 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f0000000380)) mount(&(0x7f0000000a00)=ANY=[], &(0x7f0000903000)='./file0\x00', &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:20 executing program 5: [ 358.243725] overlayfs: failed to resolve './fil': -2 [ 358.245380] FAT-fs (loop3): Filesystem has been set read-only [ 358.277782] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) [ 358.353871] EXT4-fs (sda1): re-mounted. Opts: 16:09:20 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:20 executing program 4: 16:09:20 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./fil']) 16:09:20 executing program 5: 16:09:20 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)) 16:09:20 executing program 4: 16:09:20 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f0000000380)) mount(&(0x7f0000000a00)=ANY=[], &(0x7f0000903000)='./file0\x00', &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) [ 358.547777] overlayfs: failed to resolve './fil': -2 16:09:20 executing program 5: 16:09:20 executing program 4: 16:09:21 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./fil']) [ 358.676732] EXT4-fs (sda1): re-mounted. Opts: 16:09:21 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)) [ 358.786609] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) 16:09:21 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', 0x0, 0x0, &(0x7f0000000380)) mount(&(0x7f0000000a00)=ANY=[], &(0x7f0000903000)='./file0\x00', &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) [ 358.858537] FAT-fs (loop3): Filesystem has been set read-only [ 358.894925] overlayfs: failed to resolve './fil': -2 [ 358.900567] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) [ 358.929003] EXT4-fs (sda1): re-mounted. Opts: 16:09:21 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:21 executing program 5: 16:09:21 executing program 4: 16:09:21 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file']) 16:09:21 executing program 0: open(&(0x7f0000000100)='./file0\x00', 0x204c2, 0x0) mount(&(0x7f0000001340)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', 0x0, 0x30c5004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x38828b8, &(0x7f0000000040)) 16:09:21 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', 0x0, 0x0, &(0x7f0000000380)) mount(&(0x7f0000000a00)=ANY=[], &(0x7f0000903000)='./file0\x00', &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:21 executing program 5: 16:09:21 executing program 4: 16:09:21 executing program 5: [ 359.209144] EXT4-fs (sda1): re-mounted. Opts: 16:09:21 executing program 4: [ 359.278893] overlayfs: failed to resolve './file': -2 16:09:21 executing program 5: 16:09:21 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file']) [ 359.406125] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 359.432722] FAT-fs (loop3): Filesystem has been set read-only [ 359.440898] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:21 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:21 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', 0x0, 0x0, &(0x7f0000000380)) mount(&(0x7f0000000a00)=ANY=[], &(0x7f0000903000)='./file0\x00', &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:21 executing program 4: 16:09:21 executing program 0: 16:09:21 executing program 5: 16:09:21 executing program 0: 16:09:22 executing program 4: [ 359.643320] overlayfs: failed to resolve './file': -2 16:09:22 executing program 1: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mkdir(&(0x7f0000000180)='./bus\x00', 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000300)='./bus\x00', &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x70, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file']) 16:09:22 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000a00)=ANY=[], &(0x7f0000903000)='./file0\x00', &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:22 executing program 5: 16:09:22 executing program 4: 16:09:22 executing program 0: [ 359.907952] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 359.983067] overlayfs: failed to resolve './file': -2 [ 359.985363] FAT-fs (loop3): Filesystem has been set read-only [ 360.035792] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:22 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, 0x0, 0x0) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:22 executing program 5: 16:09:22 executing program 4: 16:09:22 executing program 0: 16:09:22 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:22 executing program 1: 16:09:22 executing program 5: 16:09:22 executing program 4: 16:09:22 executing program 1: 16:09:22 executing program 0: 16:09:22 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, 0x0, &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:22 executing program 5: [ 360.414096] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 360.461868] FAT-fs (loop3): Filesystem has been set read-only [ 360.476640] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:22 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, 0x0, 0x0) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:22 executing program 4: 16:09:22 executing program 1: 16:09:22 executing program 0: 16:09:22 executing program 1: 16:09:22 executing program 5: 16:09:22 executing program 4: 16:09:22 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, 0x0, &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:23 executing program 0: 16:09:23 executing program 1: 16:09:23 executing program 4: 16:09:23 executing program 5: [ 360.856152] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 360.937418] FAT-fs (loop3): Filesystem has been set read-only [ 360.970416] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:23 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, 0x0, 0x0) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:23 executing program 0: 16:09:23 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, 0x0, &(0x7f0000000a80)='sysfs\x00', 0x100000, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:23 executing program 4: 16:09:23 executing program 1: 16:09:23 executing program 5: 16:09:23 executing program 1: 16:09:23 executing program 4: 16:09:23 executing program 0: 16:09:23 executing program 5: 16:09:23 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x100000, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:23 executing program 1: [ 361.323617] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 361.345445] FAT-fs (loop3): Filesystem has been set read-only [ 361.386649] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:23 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(0xffffffffffffffff, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:23 executing program 0: 16:09:23 executing program 5: 16:09:23 executing program 4: 16:09:23 executing program 1: 16:09:23 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x0, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:23 executing program 0: 16:09:23 executing program 4: 16:09:23 executing program 5: 16:09:24 executing program 0: 16:09:24 executing program 1: 16:09:24 executing program 5: 16:09:24 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(0xffffffffffffffff, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:24 executing program 4: 16:09:24 executing program 1: 16:09:24 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x0, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:24 executing program 0: 16:09:24 executing program 5: 16:09:24 executing program 0: 16:09:24 executing program 1: 16:09:24 executing program 4: 16:09:24 executing program 5: 16:09:24 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x0, &(0x7f0000000a40)) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:25 executing program 4: 16:09:25 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(0xffffffffffffffff, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:25 executing program 1: 16:09:25 executing program 0: 16:09:25 executing program 5: 16:09:25 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x100000, 0x0) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:25 executing program 4: [ 362.870246] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 362.883730] FAT-fs (loop3): Filesystem has been set read-only [ 362.891296] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:25 executing program 0: 16:09:25 executing program 1: 16:09:25 executing program 5: 16:09:25 executing program 4: 16:09:25 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x100000, 0x0) mkdir(0x0, 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:25 executing program 1: [ 363.302944] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 363.345311] FAT-fs (loop3): Filesystem has been set read-only [ 363.359140] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:25 executing program 4: 16:09:25 executing program 0: 16:09:25 executing program 5: 16:09:25 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x100000, 0x0) mkdir(0x0, 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:25 executing program 1: 16:09:25 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, 0xffffffffffffffff, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:25 executing program 0: 16:09:25 executing program 1: 16:09:25 executing program 5: 16:09:25 executing program 4: 16:09:25 executing program 0: 16:09:25 executing program 4: 16:09:26 executing program 1: 16:09:26 executing program 5: 16:09:26 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x100000, 0x0) mkdir(0x0, 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) [ 363.767885] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 363.800817] FAT-fs (loop3): Filesystem has been set read-only 16:09:26 executing program 0: 16:09:26 executing program 4: [ 363.819848] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:26 executing program 5: 16:09:26 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, 0xffffffffffffffff, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:26 executing program 1: 16:09:26 executing program 0: 16:09:26 executing program 4: 16:09:26 executing program 1: 16:09:26 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x100000, 0x0) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(0x0, &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:26 executing program 5: 16:09:26 executing program 0: 16:09:26 executing program 5: 16:09:26 executing program 4: 16:09:26 executing program 1: 16:09:26 executing program 0: [ 364.341230] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 364.402194] FAT-fs (loop3): Filesystem has been set read-only [ 364.417083] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:26 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, 0xffffffffffffffff, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:26 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x100000, 0x0) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(0x0, &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:26 executing program 5: 16:09:26 executing program 4: 16:09:26 executing program 1: 16:09:26 executing program 0: 16:09:26 executing program 5: 16:09:26 executing program 4: 16:09:26 executing program 0: 16:09:27 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x100000, 0x0) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(0x0, &(0x7f0000000200)='.', &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:27 executing program 1: 16:09:27 executing program 4: [ 364.834315] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 364.871749] FAT-fs (loop3): Filesystem has been set read-only [ 364.898021] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:27 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, 0x0, 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:27 executing program 5: 16:09:27 executing program 0: 16:09:27 executing program 1: 16:09:27 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x100000, 0x0) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), 0x0, &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:27 executing program 4: 16:09:27 executing program 1: 16:09:27 executing program 0: 16:09:27 executing program 5: 16:09:27 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x100000, 0x0) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), 0x0, &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:27 executing program 4: 16:09:27 executing program 1: [ 365.322641] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 365.347385] FAT-fs (loop3): Filesystem has been set read-only [ 365.366669] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:27 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, 0x0, 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:27 executing program 0: 16:09:27 executing program 5: 16:09:27 executing program 4: 16:09:27 executing program 1: 16:09:27 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x100000, 0x0) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), 0x0, &(0x7f0000000480)='sysfs\x00', 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:27 executing program 4: 16:09:27 executing program 0: 16:09:27 executing program 5: 16:09:27 executing program 1: 16:09:28 executing program 4: 16:09:28 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x100000, 0x0) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', 0x0, 0x1004, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) [ 365.795612] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 365.834885] FAT-fs (loop3): Filesystem has been set read-only [ 365.886363] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:28 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, 0x0, 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:28 executing program 5: 16:09:28 executing program 1: 16:09:28 executing program 0: 16:09:28 executing program 4: 16:09:28 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x100000, 0x0) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', 0x0, 0x0, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:28 executing program 4: 16:09:28 executing program 1: 16:09:28 executing program 0: 16:09:28 executing program 5: 16:09:28 executing program 1: 16:09:28 executing program 4: [ 366.293485] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 366.325544] FAT-fs (loop3): Filesystem has been set read-only [ 366.353600] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:28 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x0) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:28 executing program 5: 16:09:28 executing program 0: 16:09:28 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x100000, 0x0) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', 0x0, 0x0, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:28 executing program 4: 16:09:28 executing program 1: 16:09:28 executing program 0: 16:09:28 executing program 5: 16:09:28 executing program 4: 16:09:28 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x100000, 0x0) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', 0x0, 0x0, 0x0) mount(&(0x7f0000000140), &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:28 executing program 1: 16:09:28 executing program 0: [ 366.718822] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 366.772612] FAT-fs (loop3): Filesystem has been set read-only [ 366.791568] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:29 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x0) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:29 executing program 5: 16:09:29 executing program 4: 16:09:29 executing program 1: 16:09:29 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x100000, 0x0) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', 0x0, 0x1004, 0x0) mount(0x0, &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:29 executing program 0: 16:09:29 executing program 5: 16:09:29 executing program 4: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) preadv(r0, &(0x7f0000000300)=[{&(0x7f0000000740)=""/4096, 0x1000}], 0x1, 0x0) 16:09:29 executing program 1: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setpriority(0x1, 0x0, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) ioctl$EVIOCGSND(0xffffffffffffffff, 0x8040451a, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x669, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x6, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f0000002940)='\'\xc4\'\v\xec\xe4\t\xc5r<-\x90\xda\x9a\x94\x02\xec\xea\x10\x90\x03\xcb\xf8\x1b6\xa5t\xd6\xd3\x93\xd3\xdf\x85P\x19G7Q\v\xdcHv\x03Qa\xf3\xd4\xfc(\x83\xfb\xf8C\xf6\x8a$\xb1\x90\xeb\'~\xa0\xd8\xc8\xe8\x94#\xcd\xd5Kp\xbf\xc0\x8d7\x1b?A(\xe8^\x9c\xff\x0f\x1ck\xbc\x95\x05\xcd\x17\xf7\x15o\xd4\xdc4\x84uw\xa6w\x0f\xea`1\xec\xb4\x04\xd5\r\x8d\xde\x1f]\x15\xe5\xe8\xd00\xe5\x8d\x9c\x9ec+\x02\x1d\xffa5\x94\xab\xddNe\xfe\x8c\xc4q\xbb#f\xc1\xb9\x81W\xa4$)!\v\x9b\xa7\b\x91\xe5\xeb\x88\x1c\x0f\xb2.Tr\xe4\x99\x9e\x03\xb4\xd2\xf9KW\xce\xd1cC\xd5\xcf\x97\xa9\xeab\xda\xd6:\xa91q\xf7\xc5\xc0C\xd1\'\x89\xee\x84T:\x88x\xe2\x83\xf2r\xf4&t@\x9e\xa4qf\xdf\xf4\xb5\x01\\a\x85\xd3\xe0\xb7\n\xe7\xed\x84Q\xd7s\xcd4B\xcbQ\xa4\x9f[\x99\xdfJ%\xa8\xfc\xe3`\xc1JA\xc9\xbc\xd4~}\xce\xe8\xfejH\x8fb\xdd\xbcJ\vk\'\xe7Q\xfd\xaaA`\xb5\xa1\xe4\xf8\x9eG\xcfb\xe8@\x04\xe1\xf8\xacU)(S\xed\xffA\xfaqt\xb6-\x9b5\xf6\x1e\x13$e\n\xc7\x9b\xb0X\xb6\xd4\t\x99^^\xc2>J\x16\xd0\x8c\xecy*\xa0\a\xe9Ar\xa6\xb4n9j\xe5\xba\x8a\n\xce2\xcf_\x1b.t)\x8d09A[-\xf6\xe7\xe8\x1f\x92>\xb8\xd4>-\xacY\x9e\x88\x96\xa7\xfa\xdaoL\xa6\xec\xe8\xd5\xbfaf\xd7\xfc\x03\x91w)\xcd\x1f\xbe\xc9R\xcfz\x03\xec\br\x83\x8bM-\xf8X\xfd\"\xb4RV\x7f\xda\xd3\xd4h\x1c\xdb\xbe\xa4U\xec\xcd\'\xbc\xd22\x85{,\xe6-,6\x9d\x85\xb4fL\b\x98\xe9@\xee\xc2.\xb3\xd6w\x10\x94\xb5%D\xe8\r\xfe\x98G\x82\fx,\xa2J\x12\x03ec\xd5e-\x1f6\xe7\xb6\xd9\xcf0J\xed\xb7\x9b\xfd\xfc\x00EQ\x1f\x00D\xc95\xdeG +\x1bp\xf4\t\x94\x87\xf1ZbO\xa6\xe9\f`u\xda\xb3\x1d\xf9\x94\x80\xc1\x17\xde(_\xa7\xe7\x11\x9a\xac\x8c\xb1\xd71\xc5\xe9\xd3n\xc2\xa4\x98P\x9aF\xc2\x93\xad@\xa9h\x96\x1b]2\x88\xf3\xd8\xc798\x8c\x9f\xd4W4\xf1}\aD\xa0\xd8\xda\xf4\x1bEx(t|\xf4Y\xfaJ\xc2GS\xc9R\xb5\xda\xa8\x9b\xaa\x01\xe2~\xd8f.#\x94\xbf\x85z\xbf\xa0x62L\x1f\x91\xd2\x1e%\x88\x1f\f\xabb\x8ds\x93\x9e\xed\xd2\xdb\x02\x0e\xcf\xf5\xaf\xc8>+\x03e\xb7\xba\xb9}\xca\xfc\xe8\xed\x9b\xa2\x9ey\bMv\x8f\x8a8\xfd;\x9a5J\xee\x9a\xae\x83>$\x8a6\x05P\x8c\x05\xb8\r\xcf\xdd\x15/\xa9\xa1\xd4\x87{\xc9I4\xe3 i\xa4\xc5\xe5l\x03?\xfdM&\xc0a9}h\x8ef\x10!\xf0\x99\x80\xb72\xcc\x06\'+\xf0\xa1\a\xeeSGH\x12\x068S7s\xd3\xdaT\"\xa9jk\xed\xa2IyM\xa3&t\xfeA\xa9\"\xb4\xec\xdex\x00\x80`p\x91\x84\xbfK\xb6\x00\xa7\xa2\x06\xce\xc8X\x7f\xd1@\xf1\xcf\xdf\xae\xdb\r\xf6h\xdf\xc6+\xac\r\x9f\xc2D\xdf\xd6\xde`\xa4\xd1=\x1b\x8d\xf4\xbe#\tH\x06;a(`\xdcw\x1dc_\v\x046j\xf9`\r\xc0\a\x8d\x12:l\xc7j3E\xd7\xcaX\x97\xad\x93\xea\x99\xca\xd7m\xb8\x1e1\xb6Nz\"U/\x0eP\b=\x01W\xcd\xf1x\x85\xf4&\xe7\xf9W\x06\xa4\xf8&\xbc\xf4\xd0\xd2\xd1W\xee\x9a\xdd\xdbu\x0e\x9aV\xe2\xc5\x84`Bu\x12\xa8/=\x17\xc4F\x11\xdfm-)\xd9hc\xba\xb7\x91\xd9\x11\x9a,\x19\xf4]\xa7Y@B\x1f') 16:09:29 executing program 0: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-vsock\x00', 0x2, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-vsock\x00', 0x2, 0x0) dup2(r0, r1) 16:09:29 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x100000, 0x0) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', 0x0, 0x1004, 0x0) mount(0x0, 0x0, &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:29 executing program 5: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000001440), 0x4) [ 367.164811] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 367.194085] FAT-fs (loop3): Filesystem has been set read-only [ 367.209756] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:29 executing program 4: 16:09:29 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x0) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:29 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x100000, 0x0) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', 0x0, 0x1004, 0x0) mount(0x0, 0x0, &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:29 executing program 4: 16:09:29 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$9p_tcp(&(0x7f0000000040)='127.0.0.1\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000200)=ANY=[]) open_by_handle_at(0xffffffffffffffff, &(0x7f0000000f40)=ANY=[], 0x0) open(0x0, 0x143042, 0xe2691e1f337fb66b) renameat2(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', 0xffffffffffffffff, 0x0, 0x0) pipe2$9p(0x0, 0x800) openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000500)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc008ae05, &(0x7f0000000080)=""/62) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, 0x0, 0x0) chmod(&(0x7f0000000240)='./file0\x00', 0x4) r2 = socket$inet6(0xa, 0x4000000080002, 0x0) ioctl$FS_IOC_SETVERSION(r2, 0x40047602, &(0x7f0000001240)) 16:09:29 executing program 0: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-vsock\x00', 0x2, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-vsock\x00', 0x2, 0x0) dup2(r0, r1) 16:09:29 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") mount$overlay(0x0, 0x0, 0x0, 0xc0ed0000, 0x0) [ 367.567715] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) 16:09:29 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x100000, 0x0) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', 0x0, 0x1004, 0x0) mount(0x0, 0x0, &(0x7f00000006c0)='sysfs\x00', 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) [ 367.615441] FAT-fs (loop3): Filesystem has been set read-only [ 367.644707] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) [ 367.651349] 9pnet_virtio: no channels available for device 127.0.0.1 16:09:30 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000140)={'dummy0\x00'}) 16:09:30 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) writev(r0, &(0x7f0000000580)=[{&(0x7f0000000440)}, {&(0x7f0000000640)="7b756c99ba942241a2d5422c2bb95d340a946df2bd3122487ff2920390d5951a9a20e7aaf396c8eb4ffd397d6b2c35c2e7a4f7ebce17501c14eeb43686ff032803a243c12b0d99fe974b4225a0928d83742497daaa72a0b65e7116dfbc79e30499ab5207d0f298d155251d8f5fb3bb3f47ddd19f3c511d229904d1664902e5378c49b57a70c6b2ff30c739b9bde375bb52ea6f9241a72374aa74de012d33d39dd87c1aa20856fc39d23db4e77a2509c3dc399cd15cab179cb5115069431116e871c574b64e813489712c74f290c09509dfafce58b2a003ed40f76150a943adca", 0xe0}, {&(0x7f00000004c0)="14712f4ea34570fa5b830256f04c605bb3d513581b", 0x15}, {&(0x7f0000001340)="2348ef10f813b2242b4650ee80d3f416985ccf5b289794357645b2b8b51967bfa08848235424e4b32edaad34d2ad62cdfbae8265a7a97d93257ba0cf1b836c805e5839bc66c0e29f9e5eca05b03563b65d2bf995f48d126525f40bf23449dc298c2dcebb470357b5b33363685443df105e8c7c23842b10a97e8acbcdfc2511cb295b372ef701d50df495ec05a59edf44e32b2ebb2031463c9fbce7a8a6528b7734a933aa6508bc3c5789918a7b24f5b34aef366f18fd26297f43aefcfcf1afd0e52043f12b221ab11d904fcd654bfeb63b089101b5060dfccda2e30bb04a4dd20fbb6aa5429a87d4e4443108b4c63327bbcfe3fa17b640dd433bd608565fc75887e94aaedb5bb8dfa060221e03a5d8414189359435514b396897bb08304720c63c10ee28a4f3972608a230218b344b4efacd2fe0f5f158d26a1c28c52d3cfd0d2a82d1c6842475eba32f5d7ed2d5ec81ec5b670e7ea909fa0b9ad10160eaa2b9f102eed9116afaac1fb9174d94098b0954458a03c5dc704973e555abe746d5e2a1342297bda513ba9c1552b71dfa5e8e375590fa169cf9c0db0ce5091a935315cbe32e56bfc2740867ad56e540f295b118c737b71f8aa096e6c92947e9ed3ad470c4d33b08c3502df972db7f52210e3e2f99db823809f4b9ed6fad7266691c64ff3deec88dffbb886c9455e23b7883068ff23026f82c0a19168c68a5b229a53554eea381d293d1e2e69a380fdb9413afd2acf30d8b14f88a3c4b78bed314f64185539f1e06fbc60287eacc457a5cbc1357fda5f80853c1efd8a9a61e6283959bf83d7afa553f066c449a6acb0b9e3758912dd9c212e58029c1b687789cf6cc10cadc6c602131ce35405b8852d554003b15c15d1771a5a070f1d272cc66fcc82c919d68de27aa8f9f24211a28594a13d1902499c9413a3939363de46e3b8a7bbde77012f7bbf83c971fa611963e7d4ab040c47923e4d1289afd739f8a2f1c1b22dfe6827eba764053c949327d8bc8fd9861ede75866196ccfb7c540d8a463ed389967c7d3840e17e84fda75521046ae008f2df90efad43b5b45533cfb35c7f0b8b0c39d962fb46861a3a716e3c9a7ddf0258b5ebb7ff8bd5026949734008a64f9cf159e1e30a5c6161a8b19dd09d1cb314a1655552413f793a46bf57d8fc72ecbcec1a2e7938f28a53409b15be495aa516b", 0x351}], 0x4) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000003c0)='bbr\x00', 0x4) sendto$inet(r0, &(0x7f00000012c0)="0c268a927f1f6588b967481241ba7860005cf65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95425a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x27) 16:09:30 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x8, &(0x7f0000000000)=0x16c, 0x4) 16:09:30 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x100000, 0x0) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', 0x0, 0x1004, 0x0) mount(0x0, &(0x7f0000000180)='./file0/file0\x00', 0x0, 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:30 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:30 executing program 4: r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0x13) 16:09:30 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x100000, 0x0) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', 0x0, 0x1004, 0x0) mount(0x0, &(0x7f0000000180)='./file0/file0\x00', 0x0, 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) [ 368.195259] protocol 88fb is buggy, dev hsr_slave_0 [ 368.200459] protocol 88fb is buggy, dev hsr_slave_1 16:09:30 executing program 4: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, 0x0) 16:09:30 executing program 0: r0 = epoll_create1(0x0) r1 = fcntl$dupfd(r0, 0x0, r0) r2 = epoll_create1(0x0) r3 = timerfd_create(0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000d36ff4)) timerfd_settime(r3, 0x0, &(0x7f0000000000)={{}, {0x0, 0x989680}}, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040)) epoll_wait(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x7ff) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r3, &(0x7f0000021ff4)={0x2001}) 16:09:30 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$9p_tcp(&(0x7f0000000040)='127.0.0.1\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000200)=ANY=[]) open_by_handle_at(0xffffffffffffffff, &(0x7f0000000f40)=ANY=[], 0x0) open(0x0, 0x143042, 0xe2691e1f337fb66b) renameat2(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', 0xffffffffffffffff, 0x0, 0x0) pipe2$9p(0x0, 0x800) openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000500)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc008ae05, &(0x7f0000000080)=""/62) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, 0x0, 0x0) chmod(&(0x7f0000000240)='./file0\x00', 0x4) r2 = socket$inet6(0xa, 0x4000000080002, 0x0) ioctl$FS_IOC_SETVERSION(r2, 0x40047602, &(0x7f0000001240)) 16:09:30 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x100000, 0x0) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', 0x0, 0x1004, 0x0) mount(0x0, &(0x7f0000000180)='./file0/file0\x00', 0x0, 0x0, &(0x7f0000000780)='\x00\x00\x00\x00\x00\x00\x00E\xebtK|}L\xda\x10\xf7\xa7<>\xca\xda>\xcb\x18\xce\xec\x80b\x05\x03\xefy\xca\xc9J\b\x8c\x16\x90\xb9\xed\x13\xa9\x8f\x10\xce\xdaT\xfc\xa9\xbb\x1f\xe1\xdff!\xb0\xa5v\xab\xe7\xbeYHx\x88\x1bz\xe85Y\x96\xf1\x82u\xf6\x84\xcet{>}\xcd\xf6\x1e\x85\x82\xcf\x90R\x8a\x97\xab\x8f?\x8bU[\xaf\x00\t\xd9\xbb\r\x01\xf1\x11G\xcf\x01rj\x9b4B\xed\xd4`%Z\x87\xd5\xb7]\xf3\xfcQ\xc6\xd6\x1fS\xdb\xcf\xf4\xfc{\x10\x8bPE\x15\xdb\xbas\xb6}') mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:31 executing program 0: socket(0x10, 0x2, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528ac06}], 0x1, 0x0) 16:09:31 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) writev(r0, &(0x7f0000000580)=[{&(0x7f0000000440)}, {&(0x7f0000000640)="7b756c99ba942241a2d5422c2bb95d340a946df2bd3122487ff2920390d5951a9a20e7aaf396c8eb4ffd397d6b2c35c2e7a4f7ebce17501c14eeb43686ff032803a243c12b0d99fe974b4225a0928d83742497daaa72a0b65e7116dfbc79e30499ab5207d0f298d155251d8f5fb3bb3f47ddd19f3c511d229904d1664902e5378c49b57a70c6b2ff30c739b9bde375bb52ea6f9241a72374aa74de012d33d39dd87c1aa20856fc39d23db4e77a2509c3dc399cd15cab179cb5115069431116e871c574b64e813489712c74f290c09509dfafce58b2a003ed40f76150a943adca", 0xe0}, {&(0x7f00000004c0)="14712f4ea34570fa5b830256f04c605bb3d513581b", 0x15}, {&(0x7f0000001340)="2348ef10f813b2242b4650ee80d3f416985ccf5b289794357645b2b8b51967bfa08848235424e4b32edaad34d2ad62cdfbae8265a7a97d93257ba0cf1b836c805e5839bc66c0e29f9e5eca05b03563b65d2bf995f48d126525f40bf23449dc298c2dcebb470357b5b33363685443df105e8c7c23842b10a97e8acbcdfc2511cb295b372ef701d50df495ec05a59edf44e32b2ebb2031463c9fbce7a8a6528b7734a933aa6508bc3c5789918a7b24f5b34aef366f18fd26297f43aefcfcf1afd0e52043f12b221ab11d904fcd654bfeb63b089101b5060dfccda2e30bb04a4dd20fbb6aa5429a87d4e4443108b4c63327bbcfe3fa17b640dd433bd608565fc75887e94aaedb5bb8dfa060221e03a5d8414189359435514b396897bb08304720c63c10ee28a4f3972608a230218b344b4efacd2fe0f5f158d26a1c28c52d3cfd0d2a82d1c6842475eba32f5d7ed2d5ec81ec5b670e7ea909fa0b9ad10160eaa2b9f102eed9116afaac1fb9174d94098b0954458a03c5dc704973e555abe746d5e2a1342297bda513ba9c1552b71dfa5e8e375590fa169cf9c0db0ce5091a935315cbe32e56bfc2740867ad56e540f295b118c737b71f8aa096e6c92947e9ed3ad470c4d33b08c3502df972db7f52210e3e2f99db823809f4b9ed6fad7266691c64ff3deec88dffbb886c9455e23b7883068ff23026f82c0a19168c68a5b229a53554eea381d293d1e2e69a380fdb9413afd2acf30d8b14f88a3c4b78bed314f64185539f1e06fbc60287eacc457a5cbc1357fda5f80853c1efd8a9a61e6283959bf83d7afa553f066c449a6acb0b9e3758912dd9c212e58029c1b687789cf6cc10cadc6c602131ce35405b8852d554003b15c15d1771a5a070f1d272cc66fcc82c919d68de27aa8f9f24211a28594a13d1902499c9413a3939363de46e3b8a7bbde77012f7bbf83c971fa611963e7d4ab040c47923e4d1289afd739f8a2f1c1b22dfe6827eba764053c949327d8bc8fd9861ede75866196ccfb7c540d8a463ed389967c7d3840e17e84fda75521046ae008f2df90efad43b5b45533cfb35c7f0b8b0c39d962fb46861a3a716e3c9a7ddf0258b5ebb7ff8bd5026949734008a64f9cf159e1e30a5c6161a8b19dd09d1cb314a1655552413f793a46bf57d8fc72ecbcec1a2e7938f28a53409b15be495aa516b", 0x351}], 0x4) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000003c0)='bbr\x00', 0x4) sendto$inet(r0, &(0x7f00000012c0)="0c268a927f1f6588b967481241ba7860005cf65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95425a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x27) 16:09:31 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x100000, 0x0) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', 0x0, 0x1004, 0x0) mount(0x0, &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, 0x0) mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 16:09:31 executing program 4: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) preadv(r0, &(0x7f0000000740)=[{&(0x7f0000000480)=""/164, 0xa4}], 0x1, 0x0) mknod$loop(&(0x7f00000001c0)='./file0/file1\x00', 0x0, 0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000780), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1e}}, 0x50) read$FUSE(r0, &(0x7f0000001780), 0x1000) write$FUSE_ENTRY(r0, &(0x7f00000005c0)={0x90, 0x0, 0x2}, 0x90) ioctl(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ENTRY(r0, &(0x7f0000000380)={0x90, 0x0, 0x3}, 0x90) 16:09:31 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) [ 368.804309] 9pnet_virtio: no channels available for device 127.0.0.1 16:09:31 executing program 5: unshare(0x400) r0 = socket(0x400000000010, 0x3, 0x0) write(r0, 0x0, 0x0) 16:09:31 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x100000, 0x0) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', 0x0, 0x1004, 0x0) mount(0x0, &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) [ 369.198283] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 369.222455] FAT-fs (loop3): Filesystem has been set read-only [ 369.248274] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:31 executing program 5: mknod$loop(&(0x7f0000000080)='./file0\x00', 0x0, 0x1) mount$overlay(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000280)={[{@nfs_export_off='nfs_export=off'}], [{@hash='hash'}]}) 16:09:31 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:31 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x100000, 0x0) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', 0x0, 0x1004, 0x0) mount(0x0, &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) [ 369.497092] overlayfs: unrecognized mount option "hash" or missing value [ 369.508822] overlayfs: unrecognized mount option "hash" or missing value 16:09:31 executing program 5: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x444, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0xc028660f, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) io_submit(0x0, 0x0, &(0x7f0000000540)) creat(&(0x7f0000000040)='./bus\x00', 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r2 = socket$packet(0x11, 0x0, 0x300) setsockopt$packet_int(r2, 0x107, 0xf, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000240)={'veth0_to_hsr\x00'}) bind$packet(r2, 0x0, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f00000001c0), 0x4) write$P9_RREMOVE(0xffffffffffffffff, &(0x7f0000000280)={0x113}, 0x1033b) dup(0xffffffffffffffff) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'veth0_to_hsr\x00'}) shutdown(0xffffffffffffffff, 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) dup(0xffffffffffffffff) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x24000000) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000001740)) ioctl$FS_IOC_GETFSMAP(0xffffffffffffffff, 0xc0c0583b, &(0x7f0000000100)=ANY=[@ANYBLOB="4691627622c90fdca403c03fc032fe9d370af2c36890e2729b03e6ef01323579a85d73e3b3bd"]) openat(0xffffffffffffffff, 0x0, 0x0, 0x118) r4 = openat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x20200, 0xa80ebe9c1646131b) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, r4, 0x0) openat(0xffffffffffffffff, 0x0, 0x0, 0x118) sendmsg$DEVLINK_CMD_PORT_SET(0xffffffffffffffff, 0x0, 0x0) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000440)={0x0, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, r5, 0x0) ioctl$KVM_GET_XSAVE(r4, 0x9000aea4, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) 16:09:31 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x100000, 0x0) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', 0x0, 0x1004, 0x0) mount(0x0, &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) [ 369.682080] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 369.701135] FAT-fs (loop3): Filesystem has been set read-only [ 369.708712] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:32 executing program 0: mknod$loop(&(0x7f0000000080)='./file0\x00', 0x0, 0x1) r0 = open(&(0x7f0000000080)='./file0\x00', 0x40002, 0x0) write$FUSE_ENTRY(r0, &(0x7f0000000380)={0x395}, 0x90) r1 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) truncate(&(0x7f0000000240)='./file0\x00', 0x90002) sendfile(r0, r1, 0x0, 0x7fffffff) sendfile(r1, r1, 0x0, 0x8800000) 16:09:32 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x20201) ioctl$TCXONC(r1, 0x540a, 0x0) write(r1, &(0x7f0000000100)='b', 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)) 16:09:32 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, 0x0, 0x0) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:32 executing program 4: syz_open_dev$tty20(0xc, 0x4, 0x1) open(0x0, 0x0, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vcsa\x00', 0x0, 0x0) write$FUSE_LK(r0, 0x0, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x59801, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_config_ext, 0x20, 0x0, 0x200000, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) socketpair$unix(0x1, 0x5, 0x0, 0x0) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) mknod$loop(&(0x7f0000000000)='./file0\x00', 0x401, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f0000000280)='./file0\x00', 0x12) write$binfmt_script(r2, &(0x7f00000004c0)=ANY=[@ANYBLOB="010000000000006eda98866e0409e920c35000de210b174a851623eb680e42d0d4a25d05851baf365ad3ad0f818ff8b6f5941dfd36b4a1a5d30b6e5cce49c68ae2095efff3608ee6424cf54c28d941be3b85cc9ac2dd14c6c02505c3740d053a82c190163d3e01301499fc1f15b734"], 0x6f) close(r2) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) 16:09:32 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x100000, 0x0) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', 0x0, 0x1004, 0x0) mount(0x0, &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, 0x0) mount(&(0x7f0000000240), 0x0, &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) [ 370.066720] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 370.099664] FAT-fs (loop3): Filesystem has been set read-only [ 370.114862] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:32 executing program 1: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x669, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f0000002940)='\'\xc4\'\v\xec\xe4\t\xc5r<-\x90\xda\x9a\x94\x02\xec\xea\x10\x90\x03\xcb\xf8\x1b6\xa5t\xd6\xd3\x93\xd3\xdf\x85P\x19(7Q\v\xdcHv\x03Qa\xf3\xd4\xfc(\x83\xfb\xf8C\xf6\x8a$\xb1\x90\xeb\'~\xa0\xd8\xc8\xe8\x94#\xcd\xd5Kp\xbf\xc0\x8d7\x1b?A(\xe8^\x9c\xff\x0f\x1ck\xbc\x95\x05\xcd\x17\xf7\x15o\xd4\xdc4\x84uw\xa6w\x0f\xea`1\xec\xb4\x04\xd5\r\x8d\xde\x1f]\x15\xe5\xe8\xd00\xe5\x8d\x9c\x9ec+\x02\x1d\xffa5\x94\xab\xddNe\xfe\x8c\xc4q\xbb#f\xc1\xb9\x81W\xa4$)!\v\x9b\xa7\b\x91\xe5\xeb\x88\x1c\x0f\xb2.Tr\xe4\x99\x9e\x03\xb4\xd2\xf9KW\xce\xd1cC\xd5\xcf\x97\xa9\xeab\xda\xd6:\xa91q\xf7\xc5\xc0C\xd1\'\x89\xee\x84T:\x88x\xe2\x83\xf2r\xf4&t@\x9e\xa4qf\xdf\xf4\xb5\x01\\a\x85\xd3\xe0\xb7\n\xe7\xed\x84Q\xd7s\xcd4B\xcbQ\xa4\x9f[\x99\xdfJ%\xa8\xfc\xe3`\xc1JA\xc9\xbc\xd4~}\xce\xe8\xfejH\x8fb\xdd\xbcJ\vk\'\xe7Q\xfd\xaaA`\xb5\xa1\xe4\xf8\x9eG\xcfb\xe8@\x04\xe1\xf8\xacU)(S\xed\xffA\xfaqt\xb6-\x9b5\xf6\x1e\x13$e\n\xc7\x9b\xb0X\xb6\xd4\t\x99^^\xc2>J\x16\xd0\x8c\xecy*\xa0\a\xe9Ar\xa6\xb4n9j\xe5\xba\x8a\n\xce2\xcf_\x1b.t)\x8d09A[-\xf6\xe7\xe8\x1f\x92>\xb8\xd4>-\xacY\x9e\x88\x96\xa7\xfa\xdaoL\xa6\xec\xe8\xd5\xbfaf\xd7\xfc\x03\x91w)\xcd\x1f\xbe\xc9R\xcfz\x03\xec\br\x83\x8bM-\xf8X\xfd\"\xb4RV\x7f\xda\xd3\xd4h\x1c\xdb\xbe\xa4U\xec\xcd\'\xbc\xd22\x85{,\xe6-,6\x9d\x85\xb4fL\b\x98\xe9@\xee\xc2.\xb3\xd6w\x10\x94\xb5%D\xe8\r\xfe\x98G\x82\fx,\xa2J\x12\x03ec\xd5e-\x1f6\xe7\xb6\xd9\xcf0J\xed\xb7\x9b\xfd\xfc\x00EQ\x1f\x00D\xc95\xdeG +\x1bp\xf4\t\x94\x87\xf1ZbO\xa6\xe9\f`u\xda\xb3\x1d\xf9\x94\x80\xc1\x17\xde(_\xa7\xe7\x11\x9a\xac\x8c\xb1\xd71\xc5\xe9\xd3n\xc2\xa4\x98P\x9aF\xc2\x93\xad@\xa9h\x96\x1b]2\x88\xf3\xd8\xc798\x8c\x9f\xd4W4\xf1}\aD\xa0\xd8\xda\xf4\x1bEx(t|\xf4Y\xfaJ\xc2GS\xc9R\xb5\xda\xa8\x9b\xaa\x01\xe2~\xd8f.#\x94\xbf\x85z\xbf\xa0x62L\x1f\x91\xd2\x1e%\x88\x1f\f\xabb\x8ds\x93\x9e\xed\xd2\xdb\x02\x0e\xcf\xf5\xaf\xc8>+\x03e\xb7\xba\xb9}\xca\xfc\xe8\xed\x9b\xa2\x9ey\bMv\x8f\x8a8\xfd;\x9a5J\xee\x9a\xae\x83>$\x8a6\x05P\x8c\x05\xb8\r\xcf\xdd\x15/\xa9\xa1\xd4\x87{\xc9I4\xe3 i\xa4\xc5\xe5l\x03?\xfdM&\xc0a9}h\x8ef\x10!\xf0\x99\x80\xb72\xcc\x06\'+\xf0\xa1\a\xeeSGH\x12\x068S7s\xd3\xdaT\"\xa9jk\xed\xa2IyM\xa3&t\xfeA\xa9\"\xb4\xec\xdex\x00\x80`p\x91\x84\xbfK\xb6\x00\xa7\xa2\x06\xce\xc8X\x7f\xd1@\xf1\xcf\xdf\xae\xdb\r\xf6h\xdf\xc6+\xac\r\x9f\xc2D\xdf\xd6\xde`\xa4\xd1=\x1b\x8d\xf4\xbe#\tH\x06;a(`\xdcw\x1dc_\v\x046j\xf9`\r\xc0\a\x8d\x12:l\xc7j3E\xd7\xcaX\x97\xad\x93\xea\x99\xca\xd7m\xb8\x1e1\xb6Nz\"U/\x0eP\b=\x01W\xcd\xf1x\x85\xf4&\xe7\xf9W\x06\xa4\xf8&\xbc\xf4\xd0\xd2\xd1W\xee\x9a\xdd\xdbu\x0e\x9aV\xe2\xc5\x84`Bu\x12\xa8/=\x17\xc4F\x11\xdfm-)\xd9hc\xba\xb7\x91\xd9\x11\x9a,\x19\xf4]\xa7Y@B\x1f') 16:09:32 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, 0x0, 0x0) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:32 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x100000, 0x0) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', 0x0, 0x1004, 0x0) mount(0x0, &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, 0x0) mount(&(0x7f0000000240), 0x0, &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) [ 370.384010] audit: type=1800 audit(1578672572.701:92): pid=19647 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="sda1" ino=17419 res=0 16:09:32 executing program 4: syz_open_dev$tty20(0xc, 0x4, 0x1) open(0x0, 0x0, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vcsa\x00', 0x0, 0x0) write$FUSE_LK(r0, 0x0, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x59801, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_config_ext, 0x20, 0x0, 0x200000, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) socketpair$unix(0x1, 0x5, 0x0, 0x0) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) mknod$loop(&(0x7f0000000000)='./file0\x00', 0x401, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f0000000280)='./file0\x00', 0x12) write$binfmt_script(r2, &(0x7f00000004c0)=ANY=[@ANYBLOB="010000000000006eda98866e0409e920c35000de210b174a851623eb680e42d0d4a25d05851baf365ad3ad0f818ff8b6f5941dfd36b4a1a5d30b6e5cce49c68ae2095efff3608ee6424cf54c28d941be3b85cc9ac2dd14c6c02505c3740d053a82c190163d3e01301499fc1f15b734"], 0x6f) close(r2) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) 16:09:32 executing program 0: mknod$loop(&(0x7f0000000080)='./file0\x00', 0x0, 0x1) r0 = open(&(0x7f0000000080)='./file0\x00', 0x40002, 0x0) write$FUSE_ENTRY(r0, &(0x7f0000000380)={0x395}, 0x90) r1 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) truncate(&(0x7f0000000240)='./file0\x00', 0x90002) sendfile(r0, r1, 0x0, 0x7fffffff) sendfile(r1, r1, 0x0, 0x8800000) [ 370.448476] audit: type=1800 audit(1578672572.751:93): pid=19667 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor.0" name="file0" dev="sda1" ino=17419 res=0 16:09:32 executing program 5: r0 = socket$inet6(0xa, 0x80002, 0x0) sendmmsg$inet6(r0, &(0x7f0000004000)=[{{&(0x7f0000000500)={0xa, 0x4e21, 0x0, @empty}, 0x1c, 0x0}}, {{&(0x7f0000000080)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, [], 0x0, 0x0}}, 0x1c, 0x0}}], 0x2, 0x0) 16:09:32 executing program 1: mount$overlay(0x0, 0x0, 0x0, 0xc0ed0000, &(0x7f0000000280)) 16:09:33 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x100000, 0x0) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', 0x0, 0x1004, 0x0) mount(0x0, &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, 0x0) mount(&(0x7f0000000240), 0x0, &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) [ 370.709585] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) 16:09:33 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0x3}, 0x3c) 16:09:33 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='net/dev_mcast\x00') lseek(r2, 0x6e7d, 0x0) [ 370.760138] FAT-fs (loop3): Filesystem has been set read-only [ 370.793579] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:33 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, 0x0, 0x0) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:33 executing program 1: syz_open_dev$tty20(0xc, 0x4, 0x1) open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vcsa\x00', 0x0, 0x0) write$FUSE_LK(r0, 0x0, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x59801, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000080)='%%.em1keyring(-posix_acl_access\x00', 0xffffffffffffffff}, 0x30) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_config_ext, 0x20, 0x0, 0x200000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) fcntl$F_GET_RW_HINT(0xffffffffffffffff, 0x40b, 0x0) mknod$loop(&(0x7f0000000000)='./file0\x00', 0x401, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000000280)='./file0\x00', 0x12) write$binfmt_script(r1, &(0x7f00000004c0)=ANY=[@ANYBLOB="010000000000006eda98866e0409e920c35000de210b174a851623eb680e42d0d4a25d05851baf365ad3ad0f818ff8b6f5941dfd36b4a1a5d30b6e5cce49c68ae2095efff3608ee6424cf54c28d941be3b85cc9ac2dd14c6c02505c3740d053a82c190163d3e01301499fc1f15b734945457f5fb9c8ab8448b14de3fb8c3378e74990a7429cefc5b47212580b8284c001a67aa8e8d55056fc629d989f47269fd181d775a4791a15cf3d739d78b2e625875103edc8c9d023f59d9baab6e33887cfc6cdce619f1921deedd1e9c80f01c724d71ff8f55d5732be85c"], 0xda) close(r1) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) 16:09:33 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x100000, 0x0) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', 0x0, 0x1004, 0x0) mount(0x0, &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, 0x0) mount(&(0x7f0000000240), &(0x7f0000000140)='.', 0x0, 0x3002480, &(0x7f0000000700)) 16:09:33 executing program 4: syz_open_dev$tty20(0xc, 0x4, 0x1) open(0x0, 0x0, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vcsa\x00', 0x0, 0x0) write$FUSE_LK(r0, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x30) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_config_ext, 0x20, 0x0, 0x200000, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) socketpair$unix(0x1, 0x5, 0x0, 0x0) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) mknod$loop(&(0x7f0000000000)='./file0\x00', 0x401, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f0000000280)='./file0\x00', 0x0) write$binfmt_script(r2, &(0x7f00000004c0)=ANY=[@ANYBLOB="010000000000006eda98866e0409e920c35000de210b174a851623eb680e42d0d4a25d05851baf365ad3ad0f818ff8b6f5941dfd36b4a1a5d30b6e5cce49c68ae2095efff3608ee6424cf54c28d941be3b85cc9ac2dd14c6c02505c3740d053a82c190163d3e01301499fc"], 0x6b) close(r2) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) 16:09:33 executing program 0: sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)={0x44, 0x2, 0x6, 0x1, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}]}, 0x44}}, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_DELETE_ELEM(0x3, 0x0, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000c00)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6ffff0000d74ed8a60ab5632dbb78abd56f94fe58312cbb803a8ecc54a25fba3da80b856445ab100621d6234555c08dc5404737796d507031dbb24a6582d5856b2586cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f137cc5a3fb54aff8eaf5b96790700000000000000ff39aec025e19066318515eff27eff000000000000000000e94ccb6ac7c7a3406807ea6e2f114b87bde2b723135e01f5138051d239f0bb199490a7cbf7f8c1d31286df2297421003b6ed3351d71e0d148f9e74b378eaca3cd7981015b5e85fcb4ace571695144d80524027bbe9a830f81155ceb8f12d437ef144354178fc8ed35d8a23a62eda7c5751e21500"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) vmsplice(0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) umount2(&(0x7f00000001c0)='./file0\x00', 0x1) socket$alg(0x26, 0x5, 0x0) r3 = socket(0x0, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.controllers\x00', 0x275a, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xffc7}}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="48000000100005feff0000006400000000000000", @ANYRES32=r9, @ANYBLOB="0100000000000000280012000c0001007665746800000000ececfac5e025573fb5926c7ae92af81800020814a79f7488f611d01cb85041b7f809000000004600006df0840107d3c3bc1747ef4939dd822dafd6037136a70f304dbcdee66ed673df5c98c00033e06a14e3b513ef72364106b249dd59b35aafee80aa0a9b2e3bbfb4941d2ed7d7fc3c3dae0a3a354339e3572311b364ba77c4e343d199812b3862a78324fd19d159913729e3afec87ff2f99746c2aed6d90fff50cc840f622b17a4a827b1a75a620896107e88aa2009f6fab0d6266ac0a9f8016f7030271266cd02bdcefa421e9c3bf9ab24206348bd6002a2d6154050035b05242a056ff8b8c959baccf89c268249c9d2fe4ce59ce52c1b52dec589920afa9a736ad0c90316d8aa9efc641acb68497086a2b085b66419327690a", @ANYRES32=0x0, @ANYBLOB="00000500000000079eb92ed9bd42a946008cecc0fa34d8158b439ab15337c4e4111088b00aa37fc6efda95ad71de13c0ac9e3b34f427380f89c2a85f0217d430b637dc400b3d4c8557e8f07ede2d0d0617bcb3c0e6020e8c05010ecd716fc33665075ff24111f31565d4e93938b4fc35227787035c86e49acfcf12e0d10000000044c0bc9bcad0424c00"], 0x48}}, 0x0) ioctl$sock_inet6_SIOCADDRT(r6, 0x890b, &(0x7f0000000080)={@initdev={0xfe, 0x88, [], 0x0, 0x0}, @ipv4, @local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r9}) ioctl$sock_inet6_SIOCADDRT(r5, 0x890b, &(0x7f0000000140)={@local, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @rand_addr="fc5400000000000092c2fe4cbc2929db", 0x0, 0x0, 0x0, 0x0, 0x0, 0x400003, r9}) writev(r5, &(0x7f0000000080)=[{&(0x7f0000000340)="6ce0141d111e242cb157ff81310f5373fe61cdc3c853d11bb04137eb43b193ce2e4f63241a24532dfd892f4f5f70b30222ab0a879e3ab6384d808c20ceedf0e46d62bfd02e823d3bba6ee2205f580a3f4f0f61007dde4955ef0bdf6dc5cbfd6d28f0213371102e0280b83d791bc58e96d958ca705abd314be54541bae966556b5e918ea7f85ea3e3721e92b8822d1e715d52eb10af0eaa6af7b079624c7382178cafc060ab35e7cbfb1d9692e9", 0xad}], 0x1) write$binfmt_script(r4, &(0x7f0000000040)=ANY=[], 0xfea7) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r4, 0x0) clock_gettime(0x0, &(0x7f0000006b40)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000006980)=[{{0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000001300)=""/4096, 0x1000}, 0x10000}, {{&(0x7f00000004c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000d40)=[{&(0x7f0000000400)=""/25, 0x19}, {&(0x7f0000002300)=""/4096, 0x1000}, {0x0}, {&(0x7f0000000880)=""/109, 0x6d}, {&(0x7f0000000a80)=""/148, 0x94}, {&(0x7f0000000900)=""/118, 0x76}, {&(0x7f0000000b40)=""/138, 0x8a}], 0x7, &(0x7f0000000dc0)=""/175, 0xaf}, 0x3ff}, {{&(0x7f0000000e80)=@caif=@dbg, 0x80, 0x0, 0x0, &(0x7f0000003300)=""/192, 0xc0}}, {{&(0x7f0000001200)=@can, 0x80, &(0x7f00000036c0)=[{&(0x7f00000033c0)=""/234, 0xea}, {&(0x7f00000034c0)=""/147, 0x93}, {&(0x7f0000003680)=""/12, 0xc}], 0x3, &(0x7f0000003700)=""/1, 0x1}, 0x1}, {{&(0x7f0000005e00)=@l2tp6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000006340)=""/90, 0x5a}}, {{0x0, 0x0, &(0x7f0000006800)=[{&(0x7f0000006440)=""/70, 0x46}, {&(0x7f00000064c0)=""/248, 0xf8}, {&(0x7f00000065c0)=""/199, 0xc7}, {&(0x7f00000066c0)=""/59, 0x3b}, {&(0x7f0000006700)=""/221, 0xdd}], 0x5, &(0x7f0000006880)=""/211, 0xd3}}], 0x6, 0x10100, &(0x7f0000006b80)={0x0, r10+10000000}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000300)={0xffffffffffffffff, 0xa, 0x0, 0x0, &(0x7f00000002c0)}, 0x20) 16:09:33 executing program 5: syz_open_dev$tty20(0xc, 0x4, 0x1) open(0x0, 0x0, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vcsa\x00', 0x0, 0x0) write$FUSE_LK(r0, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x30) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_config_ext, 0x20, 0x0, 0x200000, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) socketpair$unix(0x1, 0x5, 0x0, 0x0) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) mknod$loop(&(0x7f0000000000)='./file0\x00', 0x401, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f0000000280)='./file0\x00', 0x12) write$binfmt_script(r2, &(0x7f00000004c0)=ANY=[@ANYBLOB="010000000000006eda98866e0409e920c35000de210b174a851623eb680e42d0d4a25d05851baf365ad3ad0f818ff8b6f5941dfd36b4a1a5d30b6e5cce49c68ae2095efff3608ee6424cf54c28d941be3b85cc9ac2dd14c6c02505c3740d053a82c190163d3e01301499fc1f15b7"], 0x6e) close(r2) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) 16:09:33 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x100000, 0x0) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', 0x0, 0x1004, 0x0) mount(0x0, &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, 0x0) mount(&(0x7f0000000240), &(0x7f0000000140)='.', 0x0, 0x0, &(0x7f0000000700)) [ 371.300012] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 371.323299] audit: type=1804 audit(1578672573.641:94): pid=19843 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir015316637/syzkaller.ucceHD/302/file0" dev="sda1" ino=17401 res=1 16:09:33 executing program 4: syz_open_dev$tty20(0xc, 0x4, 0x1) open(0x0, 0x0, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vcsa\x00', 0x0, 0x0) write$FUSE_LK(r0, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x30) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_config_ext, 0x20, 0x0, 0x200000, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) socketpair$unix(0x1, 0x5, 0x0, 0x0) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) mknod$loop(&(0x7f0000000000)='./file0\x00', 0x401, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f0000000280)='./file0\x00', 0x12) write$binfmt_script(r2, &(0x7f00000004c0)=ANY=[@ANYBLOB="010000000000006eda98866e0409e920c35000de210b174a851623eb680e42d0d4a25d05851baf365ad3ad0f818ff8b6f5941dfd36b4a1a5d30b6e5cce49c68ae2095efff3608ee6424cf54c28d941be3b85cc9a"], 0x54) close(r2) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) [ 371.338943] FAT-fs (loop3): Filesystem has been set read-only [ 371.359832] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:33 executing program 1: syz_open_dev$tty20(0xc, 0x4, 0x1) open(0x0, 0x0, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vcsa\x00', 0x0, 0x0) write$FUSE_LK(r0, 0x0, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x30) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_config_ext, 0x20, 0x0, 0x200000, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) mknod$loop(&(0x7f0000000000)='./file0\x00', 0x401, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = creat(&(0x7f0000000280)='./file0\x00', 0x12) write$binfmt_script(r4, &(0x7f00000004c0)=ANY=[@ANYBLOB="010000000000006eda98866e0409e920c35000de210b174a851623eb680e42d0d4a25d05851baf365ad3ad0f818ff8b6f5941dfd36b4a1a5d30b6e5cce49c68ae2095efff3608ee6424cf54c28d941be3b85cc9ac2dd14c6c02505c3740d053a82c190163d3e01301499fc1f15b734945457f5fb9c8ab8448b14de3fb8c3378e74990a7429cefc5b47212580b8284c001a67aa8e8d55056fc629d989f47269fd181d775a4791a15cf3d739d78b2e625875103edc8c9d023f59d9baab6e33887cfc6cdce619f1921deedd1e9c80f01c724d71ff8f55d5732be85c25673e"], 0x4a) close(r4) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) 16:09:33 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(0xffffffffffffffff, r1, &(0x7f00000001c0), 0x8080fffffffe) [ 371.519965] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'. [ 371.619412] IPv6: ADDRCONF(NETDEV_UP): veth3: link is not ready 16:09:34 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$9p_tcp(&(0x7f0000000040)='127.0.0.1\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='trans=tc`,']) dup2(0xffffffffffffffff, 0xffffffffffffffff) renameat2(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', 0xffffffffffffffff, 0x0, 0x0) pipe2$9p(0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc008ae05, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) write$P9_RSETATTR(0xffffffffffffffff, &(0x7f0000001200)={0x7}, 0x7) setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000f00)=0x8, 0x4) chmod(&(0x7f0000000240)='./file0\x00', 0x4) r2 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r2, 0x0, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @ipv4={[], [], @remote}}, 0x1c) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40047602, &(0x7f0000001240)) 16:09:34 executing program 4: syz_open_dev$tty20(0xc, 0x4, 0x1) open(0x0, 0x0, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vcsa\x00', 0x0, 0x0) write$FUSE_LK(r0, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x30) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_config_ext, 0x20, 0x0, 0x200000, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) socketpair$unix(0x1, 0x5, 0x0, 0x0) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) mknod$loop(&(0x7f0000000000)='./file0\x00', 0x401, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f0000000280)='./file0\x00', 0x12) write$binfmt_script(r2, &(0x7f00000004c0)=ANY=[@ANYBLOB="010000000000006eda98866e0409e920c35000de210b174a851623eb680e42d0d4a25d05851baf365ad3ad0f818ff8b6f5941dfd36b4a1a5d30b6e5cce49c68ae2095efff3608ee6424cf54c28d941be3b85cc9a"], 0x54) close(r2) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) 16:09:34 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x100000, 0x0) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', 0x0, 0x1004, 0x0) mount(0x0, &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, 0x0) mount(&(0x7f0000000240), &(0x7f0000000140)='.', 0x0, 0x0, &(0x7f0000000700)) [ 371.815000] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 371.869120] 9pnet: Could not find request transport: tc` [ 371.915742] FAT-fs (loop3): Filesystem has been set read-only [ 371.921803] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:34 executing program 1: syz_open_dev$tty20(0xc, 0x4, 0x1) open(0x0, 0x0, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vcsa\x00', 0x0, 0x0) write$FUSE_LK(r0, 0x0, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x30) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_config_ext, 0x20, 0x0, 0x200000, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) mknod$loop(&(0x7f0000000000)='./file0\x00', 0x401, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = creat(&(0x7f0000000280)='./file0\x00', 0x12) write$binfmt_script(r4, &(0x7f00000004c0)=ANY=[@ANYBLOB="010000000000006eda98866e0409e920c35000de210b174a851623eb680e42d0d4a25d05851baf365ad3ad0f818ff8b6f5941dfd36b4a1a5d30b6e5cce49c68ae2095efff3608ee6424cf54c28d941be3b85cc9ac2dd14c6c02505c3740d053a82c190163d3e01301499fc1f15b734945457f5fb9c8ab8448b14de3fb8c3378e74990a7429cefc5b47212580b8284c001a67aa8e8d55056fc629d989f47269fd181d775a4791a15cf3d739d78b2e625875103edc8c9d023f59d9baab6e33887cfc6cdce619f1921deedd1e9c80f01c724d71ff8f55d5732be85c25673e"], 0x4a) close(r4) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) 16:09:34 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x100000, 0x0) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', 0x0, 0x1004, 0x0) mount(0x0, &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, 0x0) mount(&(0x7f0000000240), &(0x7f0000000140)='.', 0x0, 0x0, &(0x7f0000000700)) 16:09:34 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x30002}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$9p_tcp(&(0x7f0000000040)='127.0.0.1\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='trans=tc`,port=0x0']) prctl$PR_SET_ENDIAN(0x14, 0x0) open_by_handle_at(r0, 0x0, 0x0) sendmsg$TIPC_CMD_GET_NETID(0xffffffffffffffff, 0x0, 0x800) dup2(0xffffffffffffffff, 0xffffffffffffffff) renameat2(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', 0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', 0x0) pipe2$9p(0x0, 0x800) openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000500)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r1, 0xc008ae05, &(0x7f0000000080)=""/62) socket$netlink(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) write$P9_RSETATTR(0xffffffffffffffff, &(0x7f0000001200)={0x7}, 0x7) setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000f00)=0x8, 0x4) chmod(&(0x7f0000000240)='./file0\x00', 0x4) r2 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r2, 0x0, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @ipv4={[], [], @remote}}, 0x1c) ioctl$FS_IOC_SETVERSION(r2, 0x40047602, 0x0) 16:09:34 executing program 0: sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)={0x44, 0x2, 0x6, 0x1, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}]}, 0x44}}, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_DELETE_ELEM(0x3, 0x0, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000c00)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6ffff0000d74ed8a60ab5632dbb78abd56f94fe58312cbb803a8ecc54a25fba3da80b856445ab100621d6234555c08dc5404737796d507031dbb24a6582d5856b2586cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f137cc5a3fb54aff8eaf5b96790700000000000000ff39aec025e19066318515eff27eff000000000000000000e94ccb6ac7c7a3406807ea6e2f114b87bde2b723135e01f5138051d239f0bb199490a7cbf7f8c1d31286df2297421003b6ed3351d71e0d148f9e74b378eaca3cd7981015b5e85fcb4ace571695144d80524027bbe9a830f81155ceb8f12d437ef144354178fc8ed35d8a23a62eda7c5751e21500"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) vmsplice(0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) umount2(&(0x7f00000001c0)='./file0\x00', 0x1) socket$alg(0x26, 0x5, 0x0) r3 = socket(0x0, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.controllers\x00', 0x275a, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xffc7}}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="48000000100005feff0000006400000000000000", @ANYRES32=r9, @ANYBLOB="0100000000000000280012000c0001007665746800000000ececfac5e025573fb5926c7ae92af81800020814a79f7488f611d01cb85041b7f809000000004600006df0840107d3c3bc1747ef4939dd822dafd6037136a70f304dbcdee66ed673df5c98c00033e06a14e3b513ef72364106b249dd59b35aafee80aa0a9b2e3bbfb4941d2ed7d7fc3c3dae0a3a354339e3572311b364ba77c4e343d199812b3862a78324fd19d159913729e3afec87ff2f99746c2aed6d90fff50cc840f622b17a4a827b1a75a620896107e88aa2009f6fab0d6266ac0a9f8016f7030271266cd02bdcefa421e9c3bf9ab24206348bd6002a2d6154050035b05242a056ff8b8c959baccf89c268249c9d2fe4ce59ce52c1b52dec589920afa9a736ad0c90316d8aa9efc641acb68497086a2b085b66419327690a", @ANYRES32=0x0, @ANYBLOB="00000500000000079eb92ed9bd42a946008cecc0fa34d8158b439ab15337c4e4111088b00aa37fc6efda95ad71de13c0ac9e3b34f427380f89c2a85f0217d430b637dc400b3d4c8557e8f07ede2d0d0617bcb3c0e6020e8c05010ecd716fc33665075ff24111f31565d4e93938b4fc35227787035c86e49acfcf12e0d10000000044c0bc9bcad0424c00"], 0x48}}, 0x0) ioctl$sock_inet6_SIOCADDRT(r6, 0x890b, &(0x7f0000000080)={@initdev={0xfe, 0x88, [], 0x0, 0x0}, @ipv4, @local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r9}) ioctl$sock_inet6_SIOCADDRT(r5, 0x890b, &(0x7f0000000140)={@local, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @rand_addr="fc5400000000000092c2fe4cbc2929db", 0x0, 0x0, 0x0, 0x0, 0x0, 0x400003, r9}) writev(r5, &(0x7f0000000080)=[{&(0x7f0000000340)="6ce0141d111e242cb157ff81310f5373fe61cdc3c853d11bb04137eb43b193ce2e4f63241a24532dfd892f4f5f70b30222ab0a879e3ab6384d808c20ceedf0e46d62bfd02e823d3bba6ee2205f580a3f4f0f61007dde4955ef0bdf6dc5cbfd6d28f0213371102e0280b83d791bc58e96d958ca705abd314be54541bae966556b5e918ea7f85ea3e3721e92b8822d1e715d52eb10af0eaa6af7b079624c7382178cafc060ab35e7cbfb1d9692e9", 0xad}], 0x1) write$binfmt_script(r4, &(0x7f0000000040)=ANY=[], 0xfea7) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r4, 0x0) clock_gettime(0x0, &(0x7f0000006b40)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000006980)=[{{0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000001300)=""/4096, 0x1000}, 0x10000}, {{&(0x7f00000004c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000d40)=[{&(0x7f0000000400)=""/25, 0x19}, {&(0x7f0000002300)=""/4096, 0x1000}, {0x0}, {&(0x7f0000000880)=""/109, 0x6d}, {&(0x7f0000000a80)=""/148, 0x94}, {&(0x7f0000000900)=""/118, 0x76}, {&(0x7f0000000b40)=""/138, 0x8a}], 0x7, &(0x7f0000000dc0)=""/175, 0xaf}, 0x3ff}, {{&(0x7f0000000e80)=@caif=@dbg, 0x80, 0x0, 0x0, &(0x7f0000003300)=""/192, 0xc0}}, {{&(0x7f0000001200)=@can, 0x80, &(0x7f00000036c0)=[{&(0x7f00000033c0)=""/234, 0xea}, {&(0x7f00000034c0)=""/147, 0x93}, {&(0x7f0000003680)=""/12, 0xc}], 0x3, &(0x7f0000003700)=""/1, 0x1}, 0x1}, {{&(0x7f0000005e00)=@l2tp6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000006340)=""/90, 0x5a}}, {{0x0, 0x0, &(0x7f0000006800)=[{&(0x7f0000006440)=""/70, 0x46}, {&(0x7f00000064c0)=""/248, 0xf8}, {&(0x7f00000065c0)=""/199, 0xc7}, {&(0x7f00000066c0)=""/59, 0x3b}, {&(0x7f0000006700)=""/221, 0xdd}], 0x5, &(0x7f0000006880)=""/211, 0xd3}}], 0x6, 0x10100, &(0x7f0000006b80)={0x0, r10+10000000}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000300)={0xffffffffffffffff, 0xa, 0x0, 0x0, &(0x7f00000002c0)}, 0x20) 16:09:34 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(0xffffffffffffffff, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:34 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") mknod$loop(&(0x7f0000000080)='./file0\x00', 0x0, 0x1) mount$overlay(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000280)={[], [{@hash='hash'}]}) [ 372.280119] overlayfs: unrecognized mount option "hash" or missing value 16:09:34 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000903000)='./file0\x00', 0x0, 0x100000, 0x0) mkdir(&(0x7f0000000880)='./file0/file0\x00', 0x0) mount(&(0x7f0000000240), &(0x7f0000000200)='.', 0x0, 0x1004, 0x0) mount(0x0, &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000006c0)='sysfs\x00', 0x0, 0x0) mount(&(0x7f0000000240), &(0x7f0000000140)='.', 0x0, 0x3002480, 0x0) 16:09:34 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x1) write(r1, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r1, r0, 0x0) 16:09:34 executing program 5: r0 = socket$inet(0x2, 0x3, 0x9) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f0000000280), 0x10) recvmmsg(r0, &(0x7f00000004c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x22, 0x0) [ 372.479833] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 372.521610] FAT-fs (loop3): Filesystem has been set read-only [ 372.533395] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:34 executing program 1: pipe2(&(0x7f00000000c0)={0xffffffffffffffff}, 0x0) fcntl$setflags(r0, 0x2, 0x1) 16:09:34 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(0xffffffffffffffff, r1, &(0x7f00000001c0), 0x8080fffffffe) 16:09:35 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) sendmmsg$sock(r0, &(0x7f0000002440)=[{{&(0x7f0000000100)=@nfc={0x27, 0x1}, 0x80, &(0x7f0000000280)=[{&(0x7f0000000180)="a6", 0x1}], 0x1, &(0x7f00000002c0)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0) 16:09:35 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x1) write(r1, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r1, r0, 0x0) 16:09:35 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$9p_tcp(&(0x7f0000000040)='127.0.0.1\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000200)=ANY=[]) pipe2$9p(0x0, 0x800) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc008ae05, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) write$P9_RSETATTR(0xffffffffffffffff, 0x0, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, 0x0, 0x0) chmod(0x0, 0x4) connect$inet6(0xffffffffffffffff, 0x0, 0x0) [ 372.767114] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'. 16:09:35 executing program 5: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) preadv(r0, &(0x7f0000000740)=[{&(0x7f0000000480)=""/164, 0xa4}], 0x1, 0x0) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1e}}, 0x50) write$FUSE_ENTRY(r0, 0x0, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) umount2(&(0x7f0000000540)='./file0\x00', 0x0) [ 372.890188] IPv6: ADDRCONF(NETDEV_UP): veth5: link is not ready [ 372.963208] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 372.990009] 9pnet_virtio: no channels available for device 127.0.0.1 [ 373.017739] FAT-fs (loop3): Filesystem has been set read-only [ 373.023913] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:35 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae", 0x1}], 0x1) 16:09:35 executing program 2: 16:09:35 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x1) write(r1, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r1, r0, 0x0) 16:09:35 executing program 1: 16:09:35 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, 0xffffffffffffffff, &(0x7f00000001c0), 0x8080fffffffe) 16:09:35 executing program 2: openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x3, 0x100000000000ff) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) sendmsg$key(r0, &(0x7f00000001c0)={0x20480, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[], 0x3b5}, 0x2}, 0x0) 16:09:35 executing program 1: mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x2000007, 0x6031, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000a94000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mmap(&(0x7f0000000000/0xaa2000)=nil, 0xaa2000, 0x0, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf32(0xffffffffffffffff, 0x0, 0x0) 16:09:35 executing program 0: clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x0, 0x0, 0x120, 0x0, 0x238, 0x238, 0x238, 0x238, 0x238, 0x3, 0x0, {[{{@ipv6={@ipv4={[], [], @multicast2}, @loopback, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00'}, 0x0, 0x100, 0x120, 0x0, {}, [@common=@inet=@ecn={{0x28, 'ecn\x00'}}, @common=@srh={{0x30, 'srh\x00'}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@ipv6header={{0x28, 'ipv6header\x00'}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x368) [ 373.432762] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 373.451991] xt_CT: netfilter: NOTRACK target is deprecated, use CT instead or upgrade iptables [ 373.480143] FAT-fs (loop3): Filesystem has been set read-only [ 373.502742] xt_CT: You must specify a L4 protocol and not use inversions on it 16:09:35 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x1) write(r1, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r1, r0, 0x0) 16:09:35 executing program 0: clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x0, 0x0, 0x120, 0x0, 0x238, 0x238, 0x238, 0x238, 0x238, 0x3, 0x0, {[{{@ipv6={@ipv4={[], [], @multicast2}, @loopback, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00'}, 0x0, 0x100, 0x120, 0x0, {}, [@common=@inet=@ecn={{0x28, 'ecn\x00'}}, @common=@srh={{0x30, 'srh\x00'}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@ipv6header={{0x28, 'ipv6header\x00'}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x368) [ 373.539494] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:35 executing program 2: [ 373.733787] xt_CT: You must specify a L4 protocol and not use inversions on it 16:09:36 executing program 5: 16:09:36 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, 0xffffffffffffffff, &(0x7f00000001c0), 0x8080fffffffe) 16:09:36 executing program 0: clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x0, 0x0, 0x120, 0x0, 0x238, 0x238, 0x238, 0x238, 0x238, 0x3, 0x0, {[{{@ipv6={@ipv4={[], [], @multicast2}, @loopback, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00'}, 0x0, 0x100, 0x120, 0x0, {}, [@common=@inet=@ecn={{0x28, 'ecn\x00'}}, @common=@srh={{0x30, 'srh\x00'}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@ipv6header={{0x28, 'ipv6header\x00'}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x368) 16:09:36 executing program 2: 16:09:36 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x1) write(r1, &(0x7f0000000000)="d5", 0xfffffedf) 16:09:36 executing program 5: [ 374.021764] xt_CT: You must specify a L4 protocol and not use inversions on it [ 374.026736] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) 16:09:36 executing program 0: clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x0, 0x0, 0x120, 0x0, 0x238, 0x238, 0x238, 0x238, 0x238, 0x3, 0x0, {[{{@ipv6={@ipv4={[], [], @multicast2}, @loopback, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00'}, 0x0, 0x100, 0x120, 0x0, {}, [@common=@inet=@ecn={{0x28, 'ecn\x00'}}, @common=@srh={{0x30, 'srh\x00'}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@ipv6header={{0x28, 'ipv6header\x00'}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x368) [ 374.071375] FAT-fs (loop3): Filesystem has been set read-only [ 374.089414] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) [ 374.198384] xt_CT: You must specify a L4 protocol and not use inversions on it 16:09:36 executing program 1: 16:09:36 executing program 2: 16:09:36 executing program 5: 16:09:36 executing program 0: clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x0, 0x0, 0x120, 0x0, 0x238, 0x238, 0x238, 0x238, 0x238, 0x3, 0x0, {[{{@ipv6={@ipv4={[], [], @multicast2}, @loopback, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00'}, 0x0, 0x100, 0x120, 0x0, {}, [@common=@inet=@ecn={{0x28, 'ecn\x00'}}, @common=@srh={{0x30, 'srh\x00'}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@ipv6header={{0x28, 'ipv6header\x00'}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x368) 16:09:36 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, 0xffffffffffffffff, &(0x7f00000001c0), 0x8080fffffffe) 16:09:36 executing program 0: clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x0, 0x0, 0x120, 0x0, 0x238, 0x238, 0x238, 0x238, 0x238, 0x3, 0x0, {[{{@ipv6={@ipv4={[], [], @multicast2}, @loopback, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00'}, 0x0, 0x100, 0x120, 0x0, {}, [@common=@inet=@ecn={{0x28, 'ecn\x00'}}, @common=@srh={{0x30, 'srh\x00'}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@ipv6header={{0x28, 'ipv6header\x00'}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x368) 16:09:36 executing program 2: 16:09:36 executing program 5: 16:09:36 executing program 1: 16:09:37 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x1) write(r1, &(0x7f0000000000)="d5", 0xfffffedf) 16:09:37 executing program 0: clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x0, 0x0, 0x120, 0x0, 0x238, 0x238, 0x238, 0x238, 0x238, 0x3, 0x0, {[{{@ipv6={@ipv4={[], [], @multicast2}, @loopback, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00'}, 0x0, 0x100, 0x120, 0x0, {}, [@common=@inet=@ecn={{0x28, 'ecn\x00'}}, @common=@srh={{0x30, 'srh\x00'}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@ipv6header={{0x28, 'ipv6header\x00'}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x368) 16:09:37 executing program 2: 16:09:37 executing program 5: 16:09:37 executing program 1: 16:09:37 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x0, 0x0, 0x120, 0x0, 0x238, 0x238, 0x238, 0x238, 0x238, 0x3, 0x0, {[{{@ipv6={@ipv4={[], [], @multicast2}, @loopback, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00'}, 0x0, 0x100, 0x120, 0x0, {}, [@common=@inet=@ecn={{0x28, 'ecn\x00'}}, @common=@srh={{0x30, 'srh\x00'}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@ipv6header={{0x28, 'ipv6header\x00'}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x368) 16:09:37 executing program 5: [ 375.091804] xt_CT: You must specify a L4 protocol and not use inversions on it 16:09:37 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, 0x0, 0x8080fffffffe) 16:09:37 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x0, 0x0, 0x120, 0x0, 0x238, 0x238, 0x238, 0x238, 0x238, 0x3, 0x0, {[{{@ipv6={@ipv4={[], [], @multicast2}, @loopback, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00'}, 0x0, 0x100, 0x120, 0x0, {}, [@common=@inet=@ecn={{0x28, 'ecn\x00'}}, @common=@srh={{0x30, 'srh\x00'}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@ipv6header={{0x28, 'ipv6header\x00'}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x368) 16:09:37 executing program 2: 16:09:37 executing program 1: 16:09:37 executing program 5: [ 375.247949] xt_CT: You must specify a L4 protocol and not use inversions on it [ 375.439246] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 375.448082] FAT-fs (loop3): Filesystem has been set read-only [ 375.454240] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:38 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x1) write(r1, &(0x7f0000000000)="d5", 0xfffffedf) 16:09:38 executing program 2: 16:09:38 executing program 5: 16:09:38 executing program 1: 16:09:38 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x0, 0x0, 0x120, 0x0, 0x238, 0x238, 0x238, 0x238, 0x238, 0x3, 0x0, {[{{@ipv6={@ipv4={[], [], @multicast2}, @loopback, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00'}, 0x0, 0x100, 0x120, 0x0, {}, [@common=@inet=@ecn={{0x28, 'ecn\x00'}}, @common=@srh={{0x30, 'srh\x00'}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@ipv6header={{0x28, 'ipv6header\x00'}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x368) 16:09:38 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, 0x0, 0x8080fffffffe) 16:09:38 executing program 5: [ 375.835983] xt_CT: You must specify a L4 protocol and not use inversions on it 16:09:38 executing program 2: 16:09:38 executing program 1: 16:09:38 executing program 0: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x0, 0x0, 0x120, 0x0, 0x238, 0x238, 0x238, 0x238, 0x238, 0x3, 0x0, {[{{@ipv6={@ipv4={[], [], @multicast2}, @loopback, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00'}, 0x0, 0x100, 0x120, 0x0, {}, [@common=@inet=@ecn={{0x28, 'ecn\x00'}}, @common=@srh={{0x30, 'srh\x00'}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@ipv6header={{0x28, 'ipv6header\x00'}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x368) [ 375.931642] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 375.981858] FAT-fs (loop3): Filesystem has been set read-only [ 376.021913] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:38 executing program 5: 16:09:38 executing program 1: mmap(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x0, 0x1b071, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000009000/0x3000)=nil, 0x3000, 0x2000, 0x0, &(0x7f0000ff4000/0x2000)=nil) remap_file_pages(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) [ 376.121800] xt_CT: You must specify a L4 protocol and not use inversions on it 16:09:39 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) write(0xffffffffffffffff, &(0x7f0000000000)="d5", 0xfffffedf) dup3(0xffffffffffffffff, r0, 0x0) 16:09:39 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuseblk(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000001c0)='fuseblk\x00', 0x0, &(0x7f00000003c0)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id', 0x3d, 0xee01}, 0x2c, {'group_id'}, 0x2c, {[], [{@audit='audit'}]}}) 16:09:39 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, 0x0, 0x8080fffffffe) 16:09:39 executing program 5: r0 = socket$inet(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000b9aff0)={0x2, 0x4e20}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x8084, &(0x7f0000000140)={0x2, 0x4e20}, 0x10) sendmmsg$sock(r0, &(0x7f0000004240)=[{{0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000700)='1', 0x1}], 0x1}}], 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x2a, &(0x7f0000000000), 0x4) recvmmsg(r0, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}}], 0x1, 0x43, 0x0) 16:09:39 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x5452, &(0x7f0000000140)={'vcan0\x00'}) close(r0) 16:09:39 executing program 0: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x0, 0x0, 0x120, 0x0, 0x238, 0x238, 0x238, 0x238, 0x238, 0x3, 0x0, {[{{@ipv6={@ipv4={[], [], @multicast2}, @loopback, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00'}, 0x0, 0x100, 0x120, 0x0, {}, [@common=@inet=@ecn={{0x28, 'ecn\x00'}}, @common=@srh={{0x30, 'srh\x00'}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@ipv6header={{0x28, 'ipv6header\x00'}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x368) 16:09:39 executing program 1: memfd_create(0x0, 0x591590ecaf2e85b9) [ 376.740400] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 376.764342] xt_CT: You must specify a L4 protocol and not use inversions on it 16:09:39 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000680)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/rt6_stats\x00') 16:09:39 executing program 0: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x0, 0x0, 0x120, 0x0, 0x238, 0x238, 0x238, 0x238, 0x238, 0x3, 0x0, {[{{@ipv6={@ipv4={[], [], @multicast2}, @loopback, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00'}, 0x0, 0x100, 0x120, 0x0, {}, [@common=@inet=@ecn={{0x28, 'ecn\x00'}}, @common=@srh={{0x30, 'srh\x00'}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@ipv6header={{0x28, 'ipv6header\x00'}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x368) [ 376.836911] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) 16:09:39 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) write(0xffffffffffffffff, &(0x7f0000000000)="d5", 0xfffffedf) dup3(0xffffffffffffffff, r0, 0x0) [ 376.878181] FAT-fs (loop3): Filesystem has been set read-only [ 376.914109] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:39 executing program 1: r0 = socket(0x10, 0x80002, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) recvmsg(r1, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x3e8}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) 16:09:39 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000140)="580000001400192340834b80040d8c560a067fbc45ff81054e220000000058000b480400945f64009400050028925a01000000000000008000f0fffeffe809000000fff5dd000000100001000c081000418e00000004fcff", 0xfed1}], 0x1) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) 16:09:39 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x0) 16:09:39 executing program 2: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000300)={'syz', 0x1}, &(0x7f0000000200)="b2", 0x1, 0xffffffffffffffff) keyctl$update(0x2, r0, &(0x7f0000000100)='&', 0x1) [ 377.046801] xt_CT: You must specify a L4 protocol and not use inversions on it 16:09:39 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) write(0xffffffffffffffff, &(0x7f0000000000)="d5", 0xfffffedf) dup3(0xffffffffffffffff, r0, 0x0) 16:09:39 executing program 0: clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x0, 0x0, 0x120, 0x0, 0x238, 0x238, 0x238, 0x238, 0x238, 0x3, 0x0, {[{{@ipv6={@ipv4={[], [], @multicast2}, @loopback, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00'}, 0x0, 0x100, 0x120, 0x0, {}, [@common=@inet=@ecn={{0x28, 'ecn\x00'}}, @common=@srh={{0x30, 'srh\x00'}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@ipv6header={{0x28, 'ipv6header\x00'}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x368) 16:09:39 executing program 2: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', 0x0, 0x100000, 0x0) mount(0x0, &(0x7f0000000180)='./file0/../file0\x00', &(0x7f0000000880)='sysfs\x00', 0x0, 0x0) 16:09:39 executing program 0: clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x0, 0x0, 0x120, 0x0, 0x238, 0x238, 0x238, 0x238, 0x238, 0x3, 0x0, {[{{@ipv6={@ipv4={[], [], @multicast2}, @loopback, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00'}, 0x0, 0x100, 0x120, 0x0, {}, [@common=@inet=@ecn={{0x28, 'ecn\x00'}}, @common=@srh={{0x30, 'srh\x00'}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@ipv6header={{0x28, 'ipv6header\x00'}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x368) 16:09:39 executing program 5: r0 = syz_open_dev$sndtimer(&(0x7f0000000280)='/dev/snd/timer\x00', 0x0, 0x0) r1 = socket$inet(0x10, 0x3, 0x0) dup2(r1, r0) [ 377.295742] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 377.325699] FAT-fs (loop3): Filesystem has been set read-only 16:09:39 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_pts(r0, 0x1) write(r1, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r1, r0, 0x0) [ 377.350044] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:39 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x0) 16:09:39 executing program 0: clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x0, 0x0, 0x120, 0x0, 0x238, 0x238, 0x238, 0x238, 0x238, 0x3, 0x0, {[{{@ipv6={@ipv4={[], [], @multicast2}, @loopback, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00'}, 0x0, 0x100, 0x120, 0x0, {}, [@common=@inet=@ecn={{0x28, 'ecn\x00'}}, @common=@srh={{0x30, 'srh\x00'}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@ipv6header={{0x28, 'ipv6header\x00'}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x368) [ 377.682109] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 377.701969] FAT-fs (loop3): Filesystem has been set read-only [ 377.708802] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:40 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_pts(r0, 0x1) write(r1, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r1, r0, 0x0) 16:09:40 executing program 2: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000), 0x8, 0x0) readv(r0, &(0x7f0000000040)=[{&(0x7f00000001c0)=""/135, 0x87}], 0x1) 16:09:40 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x8, 0x4, &(0x7f0000346fc8)=@framed={{}, [@alu={0x8000000201a7f19, 0x3, 0x7, 0x2, 0x1, 0xa8}]}, &(0x7f0000f6bffb)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [0x0, 0x0, 0x80ffff], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xff30}, 0x48) 16:09:40 executing program 0: clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, 0x0, 0x0) 16:09:40 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000280)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x448b0, 0x0) 16:09:40 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[], 0x49f) sendfile(r1, r1, &(0x7f00000001c0), 0x0) 16:09:40 executing program 0: clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, 0x0, 0x0) 16:09:40 executing program 5: r0 = socket$inet6(0xa, 0x80002, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x88880, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @dev}, 0x1c) sendto$inet6(r0, &(0x7f00000009c0)="c7cfcaaa22e10542fca5c0195350f15147657e0bfc59d383a47190db88690e6fedc3040ab5809ae02a54cd429cc3338c5afa0c9dce3f91950d1f567f358ac21154159130e88cbb6c43197813b2f23f3e442f80877490b393408142ebcfea6821f543e5ee9e27032e2b75d78f1b79f5a6bb6f0645e267770ef7e8f3a92148091217450ce8581e54223eeb6486205a209bf1fe854d211c03f8c3140fc3979d824082990d119473d20e94f253c9621fac339560ae46cb24b88bf2d01559bb658e343257b90f233b81bc5c398be3bbddb23a1e", 0xffd6, 0xc001, 0x0, 0xffffffffffffff0c) setsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000000040)=0x2, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000000)={@dev}, 0x14) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = fcntl$dupfd(r3, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f0000000000), 0x4) 16:09:40 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_pts(r0, 0x1) write(r1, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r1, r0, 0x0) [ 378.102132] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 970769) 16:09:40 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x1c, 0x0, &(0x7f00000011c0)=[@increfs_done={0x40106308, 0x0, 0x1000000}, @release], 0x0, 0x70f000, 0x0}) 16:09:40 executing program 0: clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, 0x0, 0x0) [ 378.148410] FAT-fs (loop3): Filesystem has been set read-only [ 378.162270] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 970769) 16:09:40 executing program 4: ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) r0 = syz_open_pts(0xffffffffffffffff, 0x1) write(r0, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r0, 0xffffffffffffffff, 0x0) 16:09:40 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000140)="580000001400192340834b80040d8c560a067fbc45ff81054e220000000058000b480400945f64009400050028925a01000000000000008000f0fffeffe809000000fff5dd0000001000010003081000418e00000004fcff", 0xfed1}], 0x1) [ 378.329758] audit: type=1400 audit(1578672580.651:95): avc: denied { set_context_mgr } for pid=21134 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 16:09:41 executing program 2: mkdir(&(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000000000)='sysfs\x00', 0x0, 0x0) r0 = inotify_init() inotify_add_watch(r0, &(0x7f0000000040)='./file0\x00', 0x400000008200010d) 16:09:41 executing program 3: keyctl$set_reqkey_keyring(0xe, 0x1) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 16:09:41 executing program 4: ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) r0 = syz_open_pts(0xffffffffffffffff, 0x1) write(r0, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r0, 0xffffffffffffffff, 0x0) 16:09:41 executing program 0: clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x2e0, 0x0, 0x0, 0x0, 0x120, 0x0, 0x238, 0x238, 0x238, 0x238, 0x238, 0x3, 0x0, {[{{@ipv6={@ipv4={[], [], @multicast2}, @loopback, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00'}, 0x0, 0x100, 0x120, 0x0, {}, [@common=@inet=@ecn={{0x28, 'ecn\x00'}}, @common=@srh={{0x30, 'srh\x00'}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x340) 16:09:41 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x1c, 0x0, &(0x7f00000011c0)=[@increfs_done={0x40106308, 0x0, 0x1000000}, @release], 0x0, 0x70f000, 0x0}) 16:09:41 executing program 5: mkdir(&(0x7f0000000100)='./file0\x00', 0x0) stat(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='security.capability\x00', &(0x7f0000000340)=@v3={0x3000000, [], r0}, 0x18, 0x0) 16:09:41 executing program 4: ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) r0 = syz_open_pts(0xffffffffffffffff, 0x1) write(r0, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r0, 0xffffffffffffffff, 0x0) 16:09:41 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x1c, 0x0, &(0x7f00000011c0)=[@increfs_done={0x40106308, 0x0, 0x1000000}, @release], 0x0, 0x70f000, 0x0}) 16:09:41 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000480)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000040)={0x3c6e, 0x0, 0x0, 0x7f, 0x0, "19bbb3e5655a919835d3511d53ade4d1e2355a"}) 16:09:41 executing program 0: clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x2e0, 0x0, 0x0, 0x0, 0x120, 0x0, 0x238, 0x238, 0x238, 0x238, 0x238, 0x3, 0x0, {[{{@ipv6={@ipv4={[], [], @multicast2}, @loopback, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00'}, 0x0, 0x100, 0x120, 0x0, {}, [@common=@inet=@ecn={{0x28, 'ecn\x00'}}, @common=@srh={{0x30, 'srh\x00'}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x340) 16:09:41 executing program 5: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r2, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf3, 0x21fc}, 0x14) r3 = socket(0x10, 0x3, 0x0) write(r3, &(0x7f0000000040)="2400000020005f0214f9f407000904000202000000000000000000000800010000000000", 0x24) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfffffd83) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 16:09:41 executing program 2: r0 = socket(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000240)="080db5055e0bcfe8478071") r1 = socket$unix(0x1, 0x5, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) listen(r1, 0x3f) r2 = socket$unix(0x1, 0x5, 0x0) r3 = socket$unix(0x1, 0x5, 0x0) connect(r3, &(0x7f0000931ff4)=@un=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) sendmsg$unix(r3, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000100000001000000", @ANYRES64=r1], 0x18}, 0x0) socket$unix(0x1, 0x5, 0x0) close(r1) close(r2) 16:09:41 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x1) write(r1, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r1, r0, 0x0) 16:09:41 executing program 0: clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x2e0, 0x0, 0x0, 0x0, 0x120, 0x0, 0x238, 0x238, 0x238, 0x238, 0x238, 0x3, 0x0, {[{{@ipv6={@ipv4={[], [], @multicast2}, @loopback, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00'}, 0x0, 0x100, 0x120, 0x0, {}, [@common=@inet=@ecn={{0x28, 'ecn\x00'}}, @common=@srh={{0x30, 'srh\x00'}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x340) 16:09:41 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x1c, 0x0, &(0x7f00000011c0)=[@increfs_done={0x40106308, 0x0, 0x1000000}, @release], 0x0, 0x70f000, 0x0}) 16:09:41 executing program 3: ioctl(0xffffffffffffffff, 0x0, &(0x7f00000001c0)="080db5055e0bcfe8696071") r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe84780") sendmsg$NL80211_CMD_DEL_KEY(0xffffffffffffffff, 0x0, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, 0x0) accept$inet(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000540)=0x100, 0x34) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e22}, 0x1c) getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl$void(0xffffffffffffffff, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x200408d4, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r1, &(0x7f0000000200)="b3", 0x1, 0x0, 0x0, 0x0) recvfrom$inet6(r1, 0x0, 0x0, 0x3fffffff, 0x0, 0x0) 16:09:41 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x1c, 0x0, &(0x7f00000011c0)=[@increfs_done={0x40106308, 0x0, 0x1000000}, @release], 0x0, 0x70f000, 0x0}) 16:09:41 executing program 0: clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x2d8, 0x0, 0x0, 0x0, 0x120, 0x0, 0x238, 0x238, 0x238, 0x238, 0x238, 0x3, 0x0, {[{{@ipv6={@ipv4={[], [], @multicast2}, @loopback, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00'}, 0x0, 0xd0, 0xf0, 0x0, {}, [@common=@inet=@ecn={{0x28, 'ecn\x00'}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@ipv6header={{0x28, 'ipv6header\x00'}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x338) 16:09:41 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$SNDCTL_DSP_CHANNELS(0xffffffffffffffff, 0xc0045006, 0x0) sched_setscheduler(0x0, 0x5, &(0x7f0000000380)) syz_open_procfs(0x0, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0xc00, &(0x7f0000000000)=[{&(0x7f0000000380)="2e00000014008505f00fc0ecdb4cb92e0a0a00e213000000160002008eb3d81fc77948f328995a017c7b58510600", 0x2e}], 0x1, 0x0, 0x0, 0xa00}, 0x0) 16:09:41 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x1) write(r1, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r1, r0, 0x0) 16:09:41 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x10, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0xc11, &(0x7f0000000000)=[{&(0x7f0000000380)="2e00000014008505f00fc0ecdb4cb92e0a0a00e213000000160002008eb3d81fc77948f328995a017c7b58510600", 0x2e}], 0x1, 0x0, 0x0, 0xa00}, 0x0) 16:09:41 executing program 2: r0 = socket(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000240)="080db5055e0bcfe8478071") r1 = socket$unix(0x1, 0x5, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) listen(r1, 0x3f) r2 = socket$unix(0x1, 0x5, 0x0) r3 = socket$unix(0x1, 0x5, 0x0) connect(r3, &(0x7f0000931ff4)=@un=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) sendmsg$unix(r3, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000100000001000000", @ANYRES64=r1], 0x18}, 0x0) socket$unix(0x1, 0x5, 0x0) close(r1) close(r2) 16:09:41 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x1c, 0x0, &(0x7f00000011c0)=[@increfs_done={0x40106308, 0x0, 0x1000000}, @release], 0x0, 0x70f000, 0x0}) 16:09:41 executing program 0: clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x2d8, 0x0, 0x0, 0x0, 0x120, 0x0, 0x238, 0x238, 0x238, 0x238, 0x238, 0x3, 0x0, {[{{@ipv6={@ipv4={[], [], @multicast2}, @loopback, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00'}, 0x0, 0xd0, 0xf0, 0x0, {}, [@common=@inet=@ecn={{0x28, 'ecn\x00'}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@ipv6header={{0x28, 'ipv6header\x00'}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x338) 16:09:41 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x1) write(r1, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r1, r0, 0x0) 16:09:42 executing program 0: clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x2d8, 0x0, 0x0, 0x0, 0x120, 0x0, 0x238, 0x238, 0x238, 0x238, 0x238, 0x3, 0x0, {[{{@ipv6={@ipv4={[], [], @multicast2}, @loopback, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00'}, 0x0, 0xd0, 0xf0, 0x0, {}, [@common=@inet=@ecn={{0x28, 'ecn\x00'}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@ipv6header={{0x28, 'ipv6header\x00'}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x338) 16:09:42 executing program 5: msgrcv(0x0, &(0x7f0000002a00)=ANY=[], 0x0, 0x0, 0x1000) msgsnd(0x0, &(0x7f0000000080)={0x2}, 0x8, 0x0) 16:09:42 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x1c, 0x0, &(0x7f00000011c0)=[@increfs_done={0x40106308, 0x0, 0x1000000}, @release], 0x0, 0x70f000, 0x0}) 16:09:42 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x1) write(r1, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r1, r0, 0x0) 16:09:42 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x10, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0xc11, &(0x7f0000000000)=[{&(0x7f0000000380)="2e00000014008505f00fc0ecdb4cb92e0a0a00e213000000160002008eb3d81fc77948f328995a017c7b58510600", 0x2e}], 0x1, 0x0, 0x0, 0xa00}, 0x0) 16:09:42 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0xc00, &(0x7f0000000000)=[{&(0x7f0000000380)="2e00000014008505f00fc0ecdb4cb92e0a0a00e213000000160002008eb3d81fc77948f328995a017c7b58510600", 0x2e}], 0x1, 0x0, 0x0, 0xa00}, 0x0) 16:09:42 executing program 5: r0 = socket$inet6(0xa, 0x3, 0xc8) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x4000000000000, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x2, 0x3, 0x2b0, 0x120, 0x0, 0x120, 0x120, 0x0, 0x218, 0x218, 0x218, 0x218, 0x218, 0x3, 0x0, {[{{@uncond, 0x0, 0x100, 0x120, 0x0, {}, [@common=@unspec=@rateest={{0x68, 'rateest\x00'}, {'ip6gre0\x00', 'erspan0\x00', 0x25, 0x1}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond, 0x0, 0x98, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@SET={0x60, 'SET\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x310) 16:09:42 executing program 1: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x1c, 0x0, &(0x7f00000011c0)=[@increfs_done={0x40106308, 0x0, 0x1000000}, @release], 0x0, 0x70f000, 0x0}) 16:09:42 executing program 0: clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x2e0, 0x0, 0x0, 0x0, 0x120, 0x0, 0x238, 0x238, 0x238, 0x238, 0x238, 0x3, 0x0, {[{{@ipv6={@ipv4={[], [], @multicast2}, @loopback, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00'}, 0x0, 0xd8, 0xf8, 0x0, {}, [@common=@srh={{0x30, 'srh\x00'}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@ipv6header={{0x28, 'ipv6header\x00'}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x340) 16:09:42 executing program 0: clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x2e0, 0x0, 0x0, 0x0, 0x120, 0x0, 0x238, 0x238, 0x238, 0x238, 0x238, 0x3, 0x0, {[{{@ipv6={@ipv4={[], [], @multicast2}, @loopback, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00'}, 0x0, 0xd8, 0xf8, 0x0, {}, [@common=@srh={{0x30, 'srh\x00'}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@ipv6header={{0x28, 'ipv6header\x00'}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x340) 16:09:42 executing program 3: r0 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nvme-fabrics\x00', 0x181401, 0x0) write$P9_RGETLOCK(r0, 0x0, 0x7a) 16:09:42 executing program 1: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x1c, 0x0, &(0x7f00000011c0)=[@increfs_done={0x40106308, 0x0, 0x1000000}, @release], 0x0, 0x70f000, 0x0}) 16:09:42 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x1) write(r1, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r1, r0, 0x0) 16:09:42 executing program 5: clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x0, 0x0, 0x120, 0x0, 0x238, 0x238, 0x238, 0x238, 0x238, 0x3, 0x0, {[{{@ipv6={@ipv4={[], [], @multicast2}, @loopback, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00'}, 0x0, 0x100, 0x120, 0x0, {}, [@common=@inet=@ecn={{0x28, 'ecn\x00'}}, @common=@srh={{0x30, 'srh\x00'}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3200}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@ipv6header={{0x28, 'ipv6header\x00'}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x368) 16:09:42 executing program 0: clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x2e0, 0x0, 0x0, 0x0, 0x120, 0x0, 0x238, 0x238, 0x238, 0x238, 0x238, 0x3, 0x0, {[{{@ipv6={@ipv4={[], [], @multicast2}, @loopback, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00'}, 0x0, 0xd8, 0xf8, 0x0, {}, [@common=@srh={{0x30, 'srh\x00'}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@ipv6header={{0x28, 'ipv6header\x00'}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x340) 16:09:42 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0xc00, &(0x7f0000000000)=[{&(0x7f0000000380)="2e00000014008505f00fc0ecdb4cb92e0a0a00e213000000160002008eb3d81fc77948f328995a017c7b58510600", 0x2e}], 0x1, 0x0, 0x0, 0xa00}, 0x0) [ 380.293492] xt_CT: netfilter: NOTRACK target is deprecated, use CT instead or upgrade iptables [ 380.347871] xt_CT: You must specify a L4 protocol and not use inversions on it 16:09:42 executing program 1: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x1c, 0x0, &(0x7f00000011c0)=[@increfs_done={0x40106308, 0x0, 0x1000000}, @release], 0x0, 0x70f000, 0x0}) 16:09:42 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x1) write(r1, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r1, r0, 0x0) 16:09:42 executing program 3: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_SCRNMAP(r2, 0x4b40, &(0x7f0000000000)=""/51) 16:09:42 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = perf_event_open(&(0x7f0000001200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setstatus(r2, 0x4, 0x2000) r3 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f00000000c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffd) r4 = add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000080)={'syz', 0x0}, 0x0, 0x0, r3) keyctl$KEYCTL_MOVE(0x1e, r4, r3, r4, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2000000000002) 16:09:42 executing program 0: creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x100000000000c333, &(0x7f0000000180)=0x0) ftruncate(0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_submit(r0, 0x0, 0x0) 16:09:42 executing program 1: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x1c, 0x0, &(0x7f00000011c0)=[@increfs_done={0x40106308, 0x0, 0x1000000}, @release], 0x0, 0x70f000, 0x0}) 16:09:42 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x1) write(r1, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r1, r0, 0x0) 16:09:42 executing program 5: mknod(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresgid(0x0, 0x0, 0x0) clone(0x180000105, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f000000a000)={0x4, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x2}, 0x8000000200000402, 0x800007f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000fb5ffc)='nfs\x00', 0x0, &(0x7f000000a000)) io_setup(0x1, &(0x7f0000000040)=0x0) io_destroy(r0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2be4da4e99b85947}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@alg={0x100, 0x10, 0x10, 0x0, 0x25dfdbfb, {{'gcm_base(ctr(aes-aesni),ghash-generic)\x00'}, [], [], 0x0, 0x2000}, [{0x8, 0x1, 0x2}, {0x8, 0x1, 0x9d}, {0x8, 0x1, 0x1ff}, {0x8, 0x1, 0x1000}]}, 0x100}}, 0x0) syz_open_procfs(0x0, &(0x7f0000000100)='net/udp\x00') dup(0xffffffffffffffff) bind$rxrpc(0xffffffffffffffff, 0x0, 0x0) 16:09:43 executing program 3: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x46802) io_setup(0x100000000000c333, &(0x7f0000000180)=0x0) r2 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0xb, 0x12, r2, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) ftruncate(r0, 0x48280) r3 = open(&(0x7f00000004c0)='./bus\x00', 0x2, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) write$P9_RATTACH(r3, &(0x7f0000000000)={0x14}, 0x14) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_submit(r1, 0x20000000000001cb, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x377140be6b5ef4c7}]) creat(0x0, 0x0) write$P9_RREMOVE(0xffffffffffffffff, &(0x7f0000000280)={0xfffffffffffffcd2}, 0xff7f) open(0x0, 0x141042, 0x0) dup(0xffffffffffffffff) 16:09:43 executing program 2: ptrace$getregset(0x4204, 0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=""/106, 0xfffffffffffffef2}) clone(0x49b96b00, 0x0, 0x0, 0x0, &(0x7f0000000300)) ioctl$KDFONTOP_SET_DEF(0xffffffffffffffff, 0x4b72, &(0x7f0000000040)={0x2, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)="0272aae16e010f05dfd5d71cc8bab91d6d936cf44cd317b97f2a55de2da11f6e18b9d00ffc2ffadbfb9717eba42e7fe4c05cb583ea3eda7784d6295485da75d990180231f59ebe181b0c1efb0834ccb53d1cec4a6f2a239e64b7933129033faecb9e1ba890153d6c7b44e714cda28b4f3fcba183aa4829e8639470759738801af931737681657f6decd5d726312531bc25ba09f691da22dfa2773bad6958f651438f5aec2b0a627181f982be1b312614ee1fb7ead43f88c89ac6fef1ea610820076a16019cc346d8884480141ebb4503000000c73822fd33b7f22ff104ad68db421422335d97ce336d513503de9d4a62d3d7b29b2f969add4af8c0b339ff750804c0a0f91011c34854d5e076ed7592bc914d44eee8e0080e510b224edcb1aacefd47a6eb51627a52fac53eed4cc9a20246a637eb5e95ce9028da700daf4089a89ca94c84c37738754288f1aa22eaa4ba6cdda04b3b1fb846c65802809bd2a65a6f7919847b65956fb34a9ee698c8057c7ee6f33c20e4b96ebdca22a4dc6d1a61df20edd8205cc448ed6b846ff0b6c35a4963e48427c098a542f36a05012161f74ad26a867740f64ed44aed19a4d5582b0a99f8c8a5781c91477302cf1e929bbec534eb4fc6b62b203bcc627913d817f57db502d57be3205727e2c6e47d2d201885eb6455273276e3a35a80d5aedbbac70a1b0a9173c797608479a7631eb8b63195efe23f354a7615900b191ed2e0053cebd06218df7fccf1717434a11c812057f083431a22cbacd089927d7c1509b0e94624b130b8aadd0af89eb4b6bfcc4cf67db95bd731892be3f1a2bf17917f4525f6e3463f331378f7ee7a872721adfea62c16bf0e4c4a25971c9e64ca3a55ef13eddc6d6557931f149a0929cb87b8371e354ef6f06b1abfb506d5b6c7d35b51dabd94a4d816fbd3491e17c0094a659053724b94da23e5d9b4d260ef723929d79f14361ddab19bde5a05677c161ce38324c9264288dde2d398d52f87cf72a9e2db8a67b79598ef9f8fb5ac41fab294f21026f12c843afb510d2dff09f709aee946d38fe1f5304a11185bdf08e92ea42cfd576508359bd538195a0737c29445cda5504ddab67ebd1310dc8efc0380db010da701d2ffdc26575535f289535d625debc3494a7b3c20ff63c3b984813d7de5f0fd69580ec787de4a5c2ea293530a2f1fce30558b6dcb6776dcb256f817078849e597dd5651f65bcccccff1749cb46a79f37005a8ef555976a33eec417ce523ec5a94c8bfc8d2e61adad9f7759529bb7dc46d3954853aabe78f77e365075c04ee83091967504f7116d10fc2e3f3ef1ffc311397cffadb2ca0fcd4e18b44e08346192dba9840470b92a5a44d15df225f020abc62636c97509063f8d3633d8c0bc1fc783fd8f15d388dfa391c31b176ee3c730b765345d3a19300980567196ba633"}) syz_open_dev$tty20(0xc, 0x4, 0x0) write$P9_RLERRORu(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="c65ac0589516f102000000c222ff63a1819220254d7c"], 0x16) recvmsg(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x8a1636a888c5dbc, 0x0, 0xffffffffffffff90, 0x0, 0x47931cccd02bdc31}, 0x0) 16:09:43 executing program 1: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x1c, 0x0, &(0x7f00000011c0)=[@increfs_done={0x40106308, 0x0, 0x1000000}, @release], 0x0, 0x70f000, 0x0}) 16:09:43 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x1) write(r1, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r1, r0, 0x0) 16:09:43 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @loopback}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$fou(&(0x7f0000000080)='fou\x00') setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000380)=0x1a, 0x4) sendmsg$inet(0xffffffffffffffff, &(0x7f0000008980)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@ip_retopts={{0x10}}], 0x10}, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x2, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) [ 380.818919] IPVS: ftp: loaded support on port[0] = 21 [ 380.830380] audit: type=1804 audit(1578672583.151:96): pid=21929 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir750286331/syzkaller.1tpX84/196/bus" dev="sda1" ino=16689 res=1 16:09:43 executing program 1: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x1c, 0x0, &(0x7f00000011c0)=[@increfs_done={0x40106308, 0x0, 0x1000000}, @release], 0x0, 0x70f000, 0x0}) [ 380.907469] audit: type=1804 audit(1578672583.191:97): pid=21921 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir750286331/syzkaller.1tpX84/196/bus" dev="sda1" ino=16689 res=1 16:09:43 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x1) write(r1, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r1, r0, 0x0) [ 381.074304] audit: type=1804 audit(1578672583.341:98): pid=21921 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir750286331/syzkaller.1tpX84/196/bus" dev="sda1" ino=16689 res=1 16:09:43 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x1c, 0x0, &(0x7f00000011c0)=[@increfs_done={0x40106308, 0x0, 0x1000000}, @release], 0x0, 0x70f000, 0x0}) 16:09:43 executing program 5: socket$inet_tcp(0x2, 0x1, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-vsock\x00', 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fd\x00') ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000280)=ANY=[@ANYBLOB="259f5d2ddec660cfb2c33136be80611804eca013349e639b26ac3c08671669f6e58021d8124173a8c2d2b18da93731a1ab0a2f92e5634817bc06d161bcd3d128c9e7bdfa815b32f6ecb3d42c71e4a23b5eca51e773c347ec543b60c8256d86258e5134125dc887f355ff94694f305688", @ANYRESDEC]) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-vsock\x00', 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fd\x00') ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000200)=ANY=[@ANYRES64, @ANYBLOB="4871413c773e314effa23960a4865ddbfb9bc2fb4498da109fc3bd3b70918787520e97329b130b567ab6d7d0ae25e2", @ANYRESDEC, @ANYRESHEX, @ANYRESDEC]) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-vsock\x00', 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='fd\x00') ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='fd\x00') ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000200)=ANY=[@ANYRES64=r1, @ANYRESHEX=r2, @ANYRESDEC, @ANYRESHEX, @ANYRESDEC]) [ 381.102995] audit: type=1804 audit(1578672583.361:99): pid=21929 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir750286331/syzkaller.1tpX84/196/bus" dev="sda1" ino=16689 res=1 16:09:43 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(0xffffffffffffffff, 0x1) write(r1, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r1, r0, 0x0) 16:09:43 executing program 3: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x46802) io_setup(0x100000000000c333, &(0x7f0000000180)=0x0) r2 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0xb, 0x12, r2, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) ftruncate(r0, 0x48280) r3 = open(&(0x7f00000004c0)='./bus\x00', 0x2, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) write$P9_RATTACH(r3, &(0x7f0000000000)={0x14}, 0x14) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_submit(r1, 0x20000000000001cb, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x377140be6b5ef4c7}]) creat(0x0, 0x0) write$P9_RREMOVE(0xffffffffffffffff, &(0x7f0000000280)={0xfffffffffffffcd2}, 0xff7f) open(0x0, 0x141042, 0x0) dup(0xffffffffffffffff) 16:09:43 executing program 0: ioctl$VFIO_SET_IOMMU(0xffffffffffffffff, 0x3b66, 0x0) r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x46802) io_setup(0x100000000000c333, &(0x7f0000000180)=0x0) r2 = open(&(0x7f0000000080)='./bus\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0xb, 0x12, r2, 0x0) ftruncate(r0, 0x48280) r3 = open(0x0, 0x2, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000040), 0x10) write$P9_RATTACH(r3, &(0x7f0000000000)={0x14}, 0x14) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_submit(r1, 0x20000000000001cb, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x377140be6b5ef4c7}]) r4 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) write$P9_RREMOVE(r4, &(0x7f0000000280)={0xfffffffffffffcd2}, 0xff7f) mount(&(0x7f0000000100)=ANY=[@ANYBLOB='@Wev/nUllb0\x00'], &(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='tracefs\x00', 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0xc028660f, &(0x7f0000000200)={0x0, r4, 0x9, 0xffffffe4}) 16:09:43 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x1c, 0x0, &(0x7f00000011c0)=[@increfs_done={0x40106308, 0x0, 0x1000000}, @release], 0x0, 0x70f000, 0x0}) 16:09:43 executing program 2: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000300)='/dev/null\x00', 0x200100, 0x0) ioctl$VFIO_SET_IOMMU(r0, 0x3b66, 0x0) r1 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x46802) io_setup(0x100000000000c333, &(0x7f0000000180)=0x0) r3 = open(&(0x7f0000000080)='./bus\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0xb, 0x12, r3, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) ftruncate(r1, 0x48280) r4 = open(&(0x7f00000004c0)='./bus\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000040), 0x10) write$P9_RATTACH(r4, &(0x7f0000000000)={0x14}, 0x14) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_submit(r2, 0x20000000000001cb, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) r5 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) write$P9_RREMOVE(r5, &(0x7f0000000280)={0xfffffffffffffcd2}, 0xff7f) open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mount(&(0x7f0000000100)=ANY=[], &(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='tracefs\x00', 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x0, 0x0, @ipv4={[0xe0ffffff, 0x5], [], @local}}, 0x1c) 16:09:43 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(0xffffffffffffffff, 0x1) write(r1, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r1, r0, 0x0) 16:09:43 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x1c, 0x0, &(0x7f00000011c0)=[@increfs_done={0x40106308, 0x0, 0x1000000}, @release], 0x0, 0x70f000, 0x0}) [ 381.474507] audit: type=1804 audit(1578672583.791:100): pid=22070 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir750286331/syzkaller.1tpX84/197/bus" dev="sda1" ino=16945 res=1 16:09:44 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(0xffffffffffffffff, 0x1) write(r1, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r1, r0, 0x0) [ 381.646657] audit: type=1804 audit(1578672583.821:101): pid=22082 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir236049892/syzkaller.gGFRYo/350/bus" dev="sda1" ino=16993 res=1 16:09:44 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x1c, 0x0, &(0x7f00000011c0)=[@increfs_done={0x40106308, 0x0, 0x1000000}, @release], 0x0, 0x70f000, 0x0}) 16:09:44 executing program 5: r0 = open(&(0x7f00009e1000)='./file0\x00', 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r1, &(0x7f0000000000)={{0x6, @rose}, [@rose, @rose, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @rose, @rose, @null]}, 0x48) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0)=0x1, 0x4) listen(r1, 0x0) unshare(0x40000000) accept(0xffffffffffffffff, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) [ 381.685981] audit: type=1804 audit(1578672583.871:102): pid=22070 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir750286331/syzkaller.1tpX84/197/bus" dev="sda1" ino=16945 res=1 16:09:44 executing program 3: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x46802) io_setup(0x100000000000c333, &(0x7f0000000180)=0x0) r2 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0xb, 0x12, r2, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) ftruncate(r0, 0x48280) r3 = open(&(0x7f00000004c0)='./bus\x00', 0x2, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) write$P9_RATTACH(r3, &(0x7f0000000000)={0x14}, 0x14) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_submit(r1, 0x20000000000001cb, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x377140be6b5ef4c7}]) creat(0x0, 0x0) write$P9_RREMOVE(0xffffffffffffffff, &(0x7f0000000280)={0xfffffffffffffcd2}, 0xff7f) open(0x0, 0x141042, 0x0) dup(0xffffffffffffffff) 16:09:44 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) write(r1, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r1, r0, 0x0) 16:09:44 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x1c, 0x0, &(0x7f00000011c0)=[@increfs_done={0x40106308, 0x0, 0x1000000}, @release], 0x0, 0x70f000, 0x0}) 16:09:44 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x1c, 0x0, &(0x7f00000011c0)=[@increfs_done={0x40106308, 0x0, 0x1000000}, @release], 0x0, 0x70f000, 0x0}) [ 382.179616] audit: type=1804 audit(1578672584.501:103): pid=22296 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir934736970/syzkaller.JwVWG1/315/bus" dev="sda1" ino=17089 res=1 [ 382.314485] audit: type=1804 audit(1578672584.501:104): pid=22298 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir750286331/syzkaller.1tpX84/198/bus" dev="sda1" ino=16945 res=1 16:09:44 executing program 0: ioctl$VFIO_SET_IOMMU(0xffffffffffffffff, 0x3b66, 0x0) r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x46802) io_setup(0x100000000000c333, &(0x7f0000000180)=0x0) r2 = open(&(0x7f0000000080)='./bus\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0xb, 0x12, r2, 0x0) ftruncate(r0, 0x48280) r3 = open(0x0, 0x2, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000040), 0x10) write$P9_RATTACH(r3, &(0x7f0000000000)={0x14}, 0x14) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_submit(r1, 0x20000000000001cb, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x377140be6b5ef4c7}]) r4 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) write$P9_RREMOVE(r4, &(0x7f0000000280)={0xfffffffffffffcd2}, 0xff7f) mount(&(0x7f0000000100)=ANY=[@ANYBLOB='@Wev/nUllb0\x00'], &(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='tracefs\x00', 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0xc028660f, &(0x7f0000000200)={0x0, r4, 0x9, 0xffffffe4}) 16:09:44 executing program 5: 16:09:44 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) write(r1, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r1, r0, 0x0) 16:09:44 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 16:09:44 executing program 3: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x46802) io_setup(0x100000000000c333, &(0x7f0000000180)=0x0) r2 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0xb, 0x12, r2, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) ftruncate(r0, 0x48280) r3 = open(&(0x7f00000004c0)='./bus\x00', 0x2, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) write$P9_RATTACH(r3, &(0x7f0000000000)={0x14}, 0x14) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_submit(r1, 0x20000000000001cb, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x377140be6b5ef4c7}]) creat(0x0, 0x0) write$P9_RREMOVE(0xffffffffffffffff, &(0x7f0000000280)={0xfffffffffffffcd2}, 0xff7f) open(0x0, 0x141042, 0x0) dup(0xffffffffffffffff) 16:09:44 executing program 2: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000300)='/dev/null\x00', 0x200100, 0x0) ioctl$VFIO_SET_IOMMU(r0, 0x3b66, 0x0) r1 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x46802) io_setup(0x100000000000c333, &(0x7f0000000180)=0x0) r3 = open(&(0x7f0000000080)='./bus\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0xb, 0x12, r3, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) ftruncate(r1, 0x48280) r4 = open(&(0x7f00000004c0)='./bus\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000040), 0x10) write$P9_RATTACH(r4, &(0x7f0000000000)={0x14}, 0x14) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_submit(r2, 0x20000000000001cb, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) r5 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) write$P9_RREMOVE(r5, &(0x7f0000000280)={0xfffffffffffffcd2}, 0xff7f) open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mount(&(0x7f0000000100)=ANY=[], &(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='tracefs\x00', 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x0, 0x0, @ipv4={[0xe0ffffff, 0x5], [], @local}}, 0x1c) 16:09:44 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) write(r1, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r1, r0, 0x0) 16:09:45 executing program 5: [ 382.613163] binder: 22317:22319 ioctl c0306201 0 returned -14 16:09:45 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 16:09:45 executing program 5: [ 382.797287] binder: 22331:22332 ioctl c0306201 0 returned -14 16:09:45 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x1) write(0xffffffffffffffff, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r1, r0, 0x0) 16:09:45 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 383.059576] binder: 22341:22342 ioctl c0306201 0 returned -14 16:09:45 executing program 0: 16:09:45 executing program 5: 16:09:45 executing program 3: 16:09:45 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x1) write(0xffffffffffffffff, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r1, r0, 0x0) 16:09:45 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x70f000, 0x0}) 16:09:45 executing program 2: 16:09:45 executing program 3: 16:09:45 executing program 5: 16:09:45 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x70f000, 0x0}) 16:09:45 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x1) write(0xffffffffffffffff, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r1, r0, 0x0) 16:09:45 executing program 0: 16:09:45 executing program 3: 16:09:45 executing program 5: 16:09:45 executing program 2: 16:09:45 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x1) write(r1, 0x0, 0x0) dup3(r1, r0, 0x0) 16:09:45 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x70f000, 0x0}) 16:09:45 executing program 0: 16:09:46 executing program 3: 16:09:46 executing program 5: 16:09:46 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x1) write(r1, 0x0, 0x0) dup3(r1, r0, 0x0) 16:09:46 executing program 0: 16:09:46 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x14, 0x0, &(0x7f00000011c0)=[@increfs_done={0x40106308, 0x0, 0x1000000}], 0x0, 0x70f000, 0x0}) 16:09:46 executing program 2: 16:09:46 executing program 3: 16:09:46 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x1) write(r1, 0x0, 0x0) dup3(r1, r0, 0x0) 16:09:46 executing program 0: 16:09:46 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000011c0), 0x0, 0x70f000, 0x0}) 16:09:46 executing program 5: 16:09:46 executing program 2: 16:09:46 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x1) write(r1, &(0x7f0000000000), 0x0) dup3(r1, r0, 0x0) 16:09:46 executing program 5: 16:09:46 executing program 3: 16:09:46 executing program 0: 16:09:46 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000011c0), 0x0, 0x70f000, 0x0}) 16:09:46 executing program 2: 16:09:46 executing program 0: 16:09:46 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000011c0), 0x0, 0x70f000, 0x0}) 16:09:46 executing program 3: 16:09:46 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x1) write(r1, &(0x7f0000000000), 0x0) dup3(r1, r0, 0x0) 16:09:46 executing program 5: 16:09:47 executing program 2: 16:09:47 executing program 5: 16:09:47 executing program 0: 16:09:47 executing program 3: 16:09:47 executing program 1: 16:09:47 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x1) write(r1, &(0x7f0000000000), 0x0) dup3(r1, r0, 0x0) 16:09:47 executing program 5: 16:09:47 executing program 2: 16:09:47 executing program 0: 16:09:47 executing program 3: 16:09:47 executing program 1: 16:09:47 executing program 5: 16:09:47 executing program 3: 16:09:47 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x1) write(r1, &(0x7f0000000000)="d5", 0xfffffedf) dup3(0xffffffffffffffff, r0, 0x0) 16:09:47 executing program 2: 16:09:47 executing program 0: 16:09:47 executing program 5: 16:09:47 executing program 3: 16:09:47 executing program 1: 16:09:47 executing program 2: 16:09:47 executing program 0: 16:09:47 executing program 5: 16:09:47 executing program 3: 16:09:47 executing program 1: 16:09:47 executing program 2: 16:09:48 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x1) write(r1, &(0x7f0000000000)="d5", 0xfffffedf) dup3(0xffffffffffffffff, r0, 0x0) 16:09:48 executing program 5: 16:09:48 executing program 3: 16:09:48 executing program 1: 16:09:48 executing program 2: 16:09:48 executing program 0: 16:09:48 executing program 2: 16:09:48 executing program 3: 16:09:48 executing program 1: 16:09:48 executing program 5: 16:09:48 executing program 0: 16:09:48 executing program 2: 16:09:49 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x1) write(r1, &(0x7f0000000000)="d5", 0xfffffedf) dup3(0xffffffffffffffff, r0, 0x0) 16:09:49 executing program 5: 16:09:49 executing program 3: 16:09:49 executing program 0: 16:09:49 executing program 1: 16:09:49 executing program 2: 16:09:49 executing program 5: 16:09:49 executing program 0: 16:09:49 executing program 3: 16:09:49 executing program 2: 16:09:49 executing program 1: perf_event_open(&(0x7f0000000300)={0x2, 0xdb, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x2b5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x15, &(0x7f0000000540)=@raw={'raw\x00', 0x2, 0x3, 0x1fc, 0x0, 0x1d4, 0x0, 0x0, 0x1d4, 0x2ac, 0x2ac, 0x2ac, 0x2ac, 0x2ac, 0x3, 0x0, {[{{@ip={@multicast1, @remote, 0x0, 0x0, 'syzkaller0\x00', 'netpci0\x00'}, 0x0, 0x70, 0x90}, @unspec=@TRACE={0x20, 'TRACE\x00'}}, {{@ip={@remote, @empty, 0x0, 0x0, '\x00', 'bridge_slave_0\x00'}, 0x0, 0x70, 0xd8}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'pptp\x00', 'syz1\x00'}}}], {{[], 0x0, 0x70, 0x94}, {0x24}}}}, 0x258) 16:09:49 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f00000050c0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1100000042000506000000366ab1001000ed623c087dcbffa241ee19776b159ada6676c7517f97b2d2add33b040000004c651514f99a98a2863c7c3935f1a55500000000000000000000010000000000009aa5db6becbf9abd5c2e059ff376546bea0ca054fb97b05be546de561172208235fcfd2dce9c50454c7012ba98d96188e72434f14ec61078bdf4fa2ae9d6b50b93e02cba4a9a319cddbe699cf8cd8fc982cd5a26cd6ae35453769cbb9113e1158ccc2bffa68a79b8fb95273ede90fae974d6917a88583f592797e0879b2a8377be70aaaf965929bb35796362e12aa3bc5217410e67ce6ca85b42511710e49c31277e7ed445c1eaa4ea6d13d65c2d47e34f9c8f36cb47ae408ffffca7d318993003dd57e4cb8d5e126217303d4568390a767fa79e6ef016696a196d39f18903238af9e17868cd9bb7299fa8470d561f1f8706c9106d8fbbd6000000000000bda82149707f836c39c41d63cac09ac76b36808bdb774cf50e2bfca9835fcd50d4f2249efc7026d259a166f71b0000000000000000000000000000002422e9c16798953eceddee32072a580fa7bb4b375543971407421ef268971c737e39ab37d931c9509ebc056bbfe155cec6cab0b547b513093b2675f8dfaa9d01643c97d1abc2be473818f1b9fa3ae5cddd50f86dea64c3ecd1cf42f8b26e0e9207676102b8c0478c1c7751599bc53fff264ccd83fcbc3799c10f3cf6cbcb5c2502440db98445670e749212cac95bea881a6a5c4bda39c9adf23bfe83e67ebf16a0e26c1a7a1864f79b8eef6f11788a19d6d97df846993b5642c8a2489c6fc096db3076004c2c83a3496e103a54d0588f7a809ac9cdad9348b6e64dac0882963e9f74836dba749d3920e7151bb440fa46847815d0d8baff627424ea2155e3752652f0a157a8756add13df86b46127e657b58af2435a0c985ab28c5a7828bff06b5a6b84d6e02b39e50589ed457ec3310ed0f72076e4c4778a42a3752e38dae5dee4b90b630586d75eb4c8341e85da222c872298b16e7fcc0d7c06a8a44841f9ddc0867fc5096b027d73f1042c824efadc754e2142b30b6f34e9b50fcdbcfe692192ee65a37813a8e2dd55765eff4efd7826a1d4d72d7a66d02c10ce0afddab4e7b2c2c76a0b207a4a485a8c890302abe95946a7cc6c87abdd939398c12d5ff9ee58d8c9fadff28d98d2ebd4d36d3c71a89c3eb9eff8069cb2cc98aea737b3aa"], 0x14}}, 0x0) 16:09:50 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x1) write(r1, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r1, 0xffffffffffffffff, 0x0) 16:09:50 executing program 0: openat$nvram(0xffffffffffffff9c, &(0x7f0000000100)='/dev/nvram\x00', 0x28080, 0x0) 16:09:50 executing program 3: clone(0x4000003102041ff5, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000100)=@mangle={'mangle\x00', 0x1f, 0x6, 0x5f0, 0x140, 0x2c4, 0xa0, 0x140, 0x200, 0x5ac, 0x5ac, 0x5ac, 0x5ac, 0x5ac, 0x6, 0x0, {[{{@ip={@remote, @remote, 0x0, 0x0, 'ip6_vti0\x00', 'syzkaller0\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @multicast2}}}, {{@uncond, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {{@uncond, 0x0, 0x70, 0x94}, @TTL={0x24, 'TTL\x00'}}, {{@ip={@remote, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 'ip6gre0\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @multicast2}}}, {{@ip={@rand_addr, @remote, 0x0, 0x0, '\x00', 'gretap0\x00'}, 0x0, 0x2c4, 0x2e8, 0x0, {}, [@common=@ttl={{0x24, 'ttl\x00'}}, @common=@unspec=@bpf0={{0x230, 'bpf\x00'}}]}, @ECN={0x24, 'ECN\x00'}}], {{[], 0x0, 0x70, 0x94}, {0x24}}}}, 0x64c) 16:09:50 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000140)={@local, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @rand_addr="fc5400000000000092c2fe4cbc2929db", 0x0, 0x0, 0x0, 0x0, 0x0, 0x400003}) 16:09:50 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup/syz0\x00', 0x200002, 0x0) fchdir(r0) open(&(0x7f0000000240)='./file0\x00', 0x41a003, 0x0) 16:09:50 executing program 5: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000000)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fffeffb}]}) close(r0) 16:09:50 executing program 3: perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x800002, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = gettid() clone(0x6e002100, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) 16:09:50 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f00000001c0)=[{&(0x7f0000000080)="580000001500add427323b472545b45602117fffffff81004e22000d00ff0028925aa80020007b00090080000efffeffe80900f000ff0000f03ac7100003ffffffffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) setxattr$security_capability(0x0, 0x0, 0x0, 0x0, 0x0) 16:09:50 executing program 1: syz_mount_image$iso9660(&(0x7f0000000040)='iso9660\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000001980)=ANY=[@ANYBLOB='block=0x0000000000000200']) 16:09:50 executing program 0: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mbind(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x4003, &(0x7f0000000100)=0x5, 0x3, 0x0) 16:09:50 executing program 2: mbind(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x4003, &(0x7f0000000100)=0x5, 0x3, 0x0) [ 388.259477] ISOFS: Unable to identify CD-ROM format. 16:09:50 executing program 2: r0 = bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f00000009c0)=ANY=[@ANYBLOB="85000000220000000700000012724c6395000001000000009c40758679c6aa6a3d5cb713643d0ad959ada62e32c7ae1370cc2441428225c613563500000000000000042b7129d75ffa51e515ff3e0a7559151c2fad9dc2e12b7b1c75a6a6231277729816bc13c563c3ae4bd922e5d7a1c5891f902efaed8c19db8c0a8dc1330990a3c3b1cc065bc101fc99824a2178f1b80a73de8a2fed1aeff533130bc05668fa7c4f9a89404d4fc30e651e2bad4712c230fffffffffffffff88fd5b346253cabe5b2e79fc5cb42d39782bd1c0a4490d7f408591bb363337e9b9c6db2b5c4ef7b3426e41216643fb342739c00748d1471366778e94400f4eb3421d73d8fb28303d451090b2b6262bb12bdf2b240b8bd0815c13032672c04883e5d048a6f6ae1f68603a1d19fad97d48d312d45d8e26bbf0e6457a1d1f0000000c573abd1913c9089d3633c61d90467bff1f0d1fff262973fcc9d31932de4df28d06746f59cd7219dbdbc561096cb3818597030833386bd3d97446c62867130669ab8fafcb8346ff45e9f6e46cd30cd5fd8197151bd33e9f7f0bf001746c7a681bdabdd2dd5c00700c2e1dc00ff1ff9e8063dd8c9b065e0ff214bd9d7be432e03a6000000000008000087398d8dc8ee9f767aee0600000019b42ced5ed693927e0092830fdf08aff4ad34c234b5a0455e76e608645e0bd13c2fa13447327d340dd25e3ef7096cc15d48c503ef2e703c81030613bc307a001c3b1f921d72c87682b763d7d0435589005409006a715d73a39a63fde15d5458796dab2d8b0976221266b9454dc000000000000000000000000000000058ec4aab4652cd9c444b61afc499540040a0a919641b69e2da2584f833f767b0333c5ca63f05ead3166f690487e595da12137c585a07006683815045fc28569a084aa3585224bee92bf43694f417deac9f44b96d732b4df11c94eea786205c6e26c459ef3758e637e5b5eecebc345485f66920f704483b23d03b6dbbd88b39888048d8e0fa710ee4acfd74dfe395ef30b1235fee2227948b143a4705f0df341d4e7ddb5047ec3553142293cdcaa7099cd69f1e2426e5d3e69f14cec253801f401f6f46447e8ddee6509a524105007135d7eeae99ae557217f48eb45308c967a7ea6af0707279eefe9d5e597c306de7570d90877b2f96bcbcde74034d6ee468f096e487bd0445cb381c957bb1626fb41a7f350137ffbd38e104aee916b6bfa6dc8d390bf31236a62a3b949505d1bc41bbda582a26ef9bccd8cafb148816fe130bbb792ad2d96101ad598965187d0fc77512bc30d486b73f0000198b6cb58c00a3c8626c28b0af2ef4951cb881a45dbaf6be8920c19065b3e859a2b0ce7b2a1c16d7883dcf5088732181956a5f303a107e63f47b88398a347308f56d77039bd8f8a50c1676401bb056a169bbfa7748f7aa61b941504a37377fbc32599ac00ef5cdb0837ce59c1bb5edc352530d335736ac7afd7976f7f04e955ba9803c4cca8941fbf38b57312ca3b368159f728e48942f335ffa6cf968a6ea8b219f413bfb532008a4c9866059fb549615d2de25f91f9d37c4ae9d96941471bbcfc8e2576e3e769b985db17315ea2cc17c664f49aad8c98fcc97698b8442c999574b650d1d21d6be76bebad154a58e119c2a71002761b378ef1b32"], &(0x7f0000014ff5)='GPL\x00', 0x2, 0x1000, &(0x7f0000014000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x194, 0x10, &(0x7f0000000000), 0x0, 0xffffffffffffffff}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000100)={r0, 0x30, 0x3a, 0x0, &(0x7f0000000080)="e460cdfbef24080000000a9386dd6a00000000072feb3014cd3ec8a755c1e138008109ad0000f0e8d5000000010000001400000500242c09880b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) [ 388.293962] IPVS: ftp: loaded support on port[0] = 21 [ 388.382693] ISOFS: Unable to identify CD-ROM format. 16:09:51 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x1) write(r1, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r1, 0xffffffffffffffff, 0x0) 16:09:51 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000340)={0xa, 0x0, 0x0, @rand_addr="172439e92c6d027b4e9e5fee08519ef1"}, 0x1c) r1 = socket(0x10, 0x80002, 0x0) ioctl(r1, 0x4000001000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000040), 0x4) 16:09:51 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f00000001c0)=[{&(0x7f0000000080)="580000001500add427323b472545b45602117fffffff81004e22000d00ff0028925aa80020007b00090080000efffeffe80900f000ff0000f03ac7100003ffffffffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) setxattr$security_capability(0x0, 0x0, 0x0, 0x0, 0x0) 16:09:51 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f00000001c0)=[{&(0x7f0000000080)="580000001500add427323b472545b45602117fffffff81004e22000d00ff0028925aa80020007b00090080000efffeffe80900f000ff0000f03ac7100003ffffffffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) setxattr$security_capability(0x0, 0x0, 0x0, 0x0, 0x0) 16:09:51 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x10) r1 = socket$inet6(0xa, 0x803, 0x20) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") r2 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_MAXSEG(r2, 0x84, 0xd, 0x0, 0x0) bind$netlink(r0, &(0x7f0000a0cff4)={0x4400000010, 0x0, 0x0, 0x70a0}, 0xc) socket$inet6(0xa, 0x803, 0x20) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(0xffffffffffffffff, 0x84, 0x1e, 0x0, 0x0) getsockopt$netlink(r0, 0x10e, 0x8000000009, &(0x7f0000019280)=""/102384, &(0x7f0000000000)=0x18ff0) [ 388.893678] kauditd_printk_skb: 14 callbacks suppressed [ 388.893696] audit: type=1400 audit(1578672591.211:119): avc: denied { bind } for pid=22801 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 16:09:51 executing program 2: r0 = socket$unix(0x1, 0x5, 0x0) bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) listen(r0, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) connect(r2, &(0x7f0000931ff4)=@un=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) sendmsg$unix(r2, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000100000001000000", @ANYRES64=r0], 0x18}, 0x0) r3 = socket(0x10, 0x80002, 0x0) ioctl(r3, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8696071") close(r0) close(r1) [ 389.011948] audit: type=1400 audit(1578672591.251:120): avc: denied { getopt } for pid=22801 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 389.104694] IPVS: ftp: loaded support on port[0] = 21 16:10:00 executing program 5: perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x12e, 0x0, 0x0, 0x1, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0xfd77, 0x10, 0x0}, 0x70) r0 = socket$kcm(0xa, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x890c, &(0x7f0000000000)) 16:10:00 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) r2 = socket$inet6(0xa, 0x803, 0x20) ioctl(r2, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000280)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x12, &(0x7f0000000140)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x509, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r3}, [@IFA_CACHEINFO={0x14, 0x9, {0xfffffffc}}, @IFA_LOCAL={0x14, 0x2, @local}]}, 0x40}}, 0x0) 16:10:00 executing program 2: r0 = socket$inet(0x10, 0x80002, 0x0) recvmsg(r0, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000001440)=[{&(0x7f0000000300)=""/4096, 0x1000}], 0x1}, 0x0) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)="4c0000001200ff09fffefd9567a283b724a600800000000000000068354046002c001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca63d89613b6aabf35d4c1cbc882b079881", 0x4c}], 0x1}, 0x0) 16:10:00 executing program 0: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8478071") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x1c, 0x19, 0xffffffffffffffff, 0x0, 0x0, {0x6}, [@typed={0x8, 0x3, 0x0, 0x0, @u32=0x6}]}, 0x1c}}, 0x0) sendmmsg(r1, &(0x7f0000000480), 0x731343b12712a0, 0x0) 16:10:00 executing program 3: perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x800002, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = gettid() clone(0x6e002100, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) 16:10:00 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x1) write(r1, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r1, 0xffffffffffffffff, 0x0) 16:10:00 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) r2 = socket$inet6(0xa, 0x803, 0x20) ioctl(r2, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000280)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x12, &(0x7f0000000140)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x509, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r3}, [@IFA_CACHEINFO={0x14, 0x9, {0xfffffffc}}, @IFA_LOCAL={0x14, 0x2, @local}]}, 0x40}}, 0x0) 16:10:00 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000002180)=0xfc, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000600)={'macvlan0\x00', 0x0}) bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @link_local}, 0x14) write$binfmt_misc(r0, &(0x7f00000000c0)={'syz0', "3561076839be01978a6b"}, 0xe) [ 398.144206] netlink: 'syz-executor.2': attribute type 29 has an invalid length. [ 398.161790] netlink: 'syz-executor.2': attribute type 29 has an invalid length. [ 398.184134] netlink: 'syz-executor.2': attribute type 29 has an invalid length. 16:10:00 executing program 5: mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x10, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000aa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x2, 0x132, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") r1 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r1, &(0x7f0000000140), 0xd3, 0x0) [ 398.253058] netlink: 'syz-executor.2': attribute type 29 has an invalid length. [ 398.305821] netlink: 'syz-executor.2': attribute type 29 has an invalid length. [ 398.310698] IPVS: ftp: loaded support on port[0] = 21 16:10:00 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) r2 = socket$inet6(0xa, 0x803, 0x20) ioctl(r2, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000280)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x12, &(0x7f0000000140)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x509, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r3}, [@IFA_CACHEINFO={0x14, 0x9, {0xfffffffc}}, @IFA_LOCAL={0x14, 0x2, @local}]}, 0x40}}, 0x0) 16:10:00 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8478071") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreq(r1, 0x0, 0x20, &(0x7f0000000040)={@remote, @remote}, 0x5) 16:10:00 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8478071") r1 = socket$inet_udplite(0x2, 0x2, 0x88) close(r1) pipe(&(0x7f0000000000)) ioctl$int_in(r1, 0x5452, &(0x7f0000004900)=0xfffffffffffffff9) 16:10:00 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000002180)=0xfc, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000600)={'macvlan0\x00', 0x0}) bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @link_local}, 0x14) write$binfmt_misc(r0, &(0x7f00000000c0)={'syz0', "3561076839be01978a6b"}, 0xe) 16:10:01 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) r2 = socket$inet6(0xa, 0x803, 0x20) ioctl(r2, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000280)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x12, &(0x7f0000000140)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x509, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r3}, [@IFA_CACHEINFO={0x14, 0x9, {0xfffffffc}}, @IFA_LOCAL={0x14, 0x2, @local}]}, 0x40}}, 0x0) 16:10:01 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setuid(r1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8914, &(0x7f0000001900)={'vcan0\x00'}) 16:10:01 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000002180)=0xfc, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000600)={'macvlan0\x00', 0x0}) bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @link_local}, 0x14) write$binfmt_misc(r0, &(0x7f00000000c0)={'syz0', "3561076839be01978a6b"}, 0xe) [ 399.048747] ================================================================== [ 399.056485] BUG: KASAN: slab-out-of-bounds in macvlan_broadcast+0x57c/0x660 [ 399.063620] Read of size 4 at addr ffff888095006a81 by task syz-executor.0/23180 [ 399.071169] [ 399.072823] CPU: 1 PID: 23180 Comm: syz-executor.0 Not tainted 4.19.94-syzkaller #0 [ 399.080633] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 399.090032] Call Trace: [ 399.092716] dump_stack+0x197/0x210 [ 399.096378] ? macvlan_broadcast+0x57c/0x660 [ 399.100833] print_address_description.cold+0x7c/0x20d [ 399.106124] ? macvlan_broadcast+0x57c/0x660 [ 399.106146] kasan_report.cold+0x8c/0x2ba [ 399.106169] __asan_report_load_n_noabort+0xf/0x20 [ 399.106186] macvlan_broadcast+0x57c/0x660 [ 399.106210] macvlan_start_xmit+0x408/0x785 [ 399.106264] dev_direct_xmit+0x34d/0x650 [ 399.106284] ? validate_xmit_skb_list+0x130/0x130 [ 399.106301] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 399.106359] ? skb_copy_datagram_from_iter+0x441/0x660 [ 399.106445] packet_direct_xmit+0xf9/0x170 [ 399.124370] packet_sendmsg+0x3bb2/0x6440 [ 399.124389] ? mark_held_locks+0x100/0x100 [ 399.124419] ? __might_sleep+0x95/0x190 [ 399.124451] ? __x32_compat_sys_getitimer+0x40/0x150 [ 399.124472] ? packet_notifier+0x840/0x840 [ 399.124558] ? selinux_socket_sendmsg+0x36/0x40 [ 399.124577] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 399.143339] ? security_socket_sendmsg+0x8d/0xc0 [ 399.143359] ? packet_notifier+0x840/0x840 [ 399.143444] sock_sendmsg+0xd7/0x130 [ 399.143464] sock_write_iter+0x2cb/0x400 [ 399.161373] ? sock_sendmsg+0x130/0x130 [ 399.161410] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 399.161513] ? iov_iter_init+0xc6/0x1f0 [ 399.161534] __vfs_write+0x587/0x810 [ 399.170638] ? kernel_read+0x120/0x120 [ 399.170715] ? selinux_file_permission+0x92/0x550 [ 399.170774] ? security_file_permission+0x89/0x230 [ 399.170797] ? rw_verify_area+0x118/0x360 [ 399.177858] kobject: 'queues' (00000000a6d9dc56): kobject_uevent_env: filter function caused the event to drop! [ 399.179700] vfs_write+0x20c/0x560 [ 399.179723] ksys_write+0x14f/0x2d0 [ 399.179742] ? __ia32_sys_read+0xb0/0xb0 [ 399.179760] ? do_syscall_64+0x26/0x620 [ 399.179850] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 399.179868] ? do_syscall_64+0x26/0x620 [ 399.190827] kobject: 'rx-0' (00000000773e414b): kobject_add_internal: parent: 'queues', set: 'queues' [ 399.194427] __x64_sys_write+0x73/0xb0 [ 399.194448] do_syscall_64+0xfd/0x620 [ 399.194471] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 399.194482] RIP: 0033:0x45af49 [ 399.194498] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 399.194506] RSP: 002b:00007f24b86e9c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 399.194520] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045af49 [ 399.194529] RDX: 000000000000000e RSI: 00000000200000c0 RDI: 0000000000000003 [ 399.194538] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 399.194547] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f24b86ea6d4 [ 399.194557] R13: 00000000004cce79 R14: 00000000004e82b8 R15: 00000000ffffffff [ 399.194578] [ 399.194586] Allocated by task 8097: [ 399.194601] save_stack+0x45/0xd0 [ 399.194618] kasan_kmalloc+0xce/0xf0 [ 399.201705] kobject: 'rx-0' (00000000773e414b): kobject_uevent_env [ 399.202388] kasan_slab_alloc+0xf/0x20 [ 399.202408] kmem_cache_alloc+0x12e/0x700 [ 399.202422] getname_flags+0xd6/0x5b0 [ 399.202433] user_path_at_empty+0x2f/0x50 [ 399.202446] vfs_statx+0x129/0x200 [ 399.202460] __do_sys_newlstat+0xa4/0x130 [ 399.202473] __x64_sys_newlstat+0x54/0x80 [ 399.202488] do_syscall_64+0xfd/0x620 [ 399.202502] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 399.202507] [ 399.202514] Freed by task 8097: [ 399.202527] save_stack+0x45/0xd0 [ 399.202540] __kasan_slab_free+0x102/0x150 [ 399.202554] kasan_slab_free+0xe/0x10 [ 399.202567] kmem_cache_free+0x86/0x260 [ 399.202578] putname+0xef/0x130 [ 399.202590] filename_lookup+0x28f/0x410 [ 399.202602] user_path_at_empty+0x43/0x50 [ 399.202614] vfs_statx+0x129/0x200 [ 399.202632] __do_sys_newlstat+0xa4/0x130 [ 399.211797] kobject: 'rx-0' (00000000773e414b): fill_kobj_path: path = '/devices/virtual/net/ip6gre0/queues/rx-0' [ 399.212154] __x64_sys_newlstat+0x54/0x80 [ 399.212172] do_syscall_64+0xfd/0x620 [ 399.212188] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 399.212193] [ 399.212204] The buggy address belongs to the object at ffff888095006ac0 [ 399.212204] which belongs to the cache names_cache of size 4096 [ 399.212217] The buggy address is located 63 bytes to the left of [ 399.212217] 4096-byte region [ffff888095006ac0, ffff888095007ac0) [ 399.212222] The buggy address belongs to the page: [ 399.212235] page:ffffea0002540180 count:1 mapcount:0 mapping:ffff88821bc47980 index:0x0 compound_mapcount: 0 [ 399.212251] flags: 0xfffe0000008100(slab|head) [ 399.212272] raw: 00fffe0000008100 ffffea00023b2c08 ffffea000262bb88 ffff88821bc47980 [ 399.212289] raw: 0000000000000000 ffff888095006ac0 0000000100000001 0000000000000000 [ 399.212296] page dumped because: kasan: bad access detected [ 399.212300] [ 399.212304] Memory state around the buggy address: [ 399.212317] ffff888095006980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 399.212328] ffff888095006a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 399.212340] >ffff888095006a80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 399.220853] kobject: 'tx-0' (0000000077c1de83): kobject_add_internal: parent: 'queues', set: 'queues' [ 399.223921] ^ [ 399.223936] ffff888095006b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 399.223948] ffff888095006b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 399.223954] ================================================================== [ 399.223960] Disabling lock debugging due to kernel taint [ 399.224015] Kernel panic - not syncing: panic_on_warn set ... [ 399.224015] [ 399.224033] CPU: 1 PID: 23180 Comm: syz-executor.0 Tainted: G B 4.19.94-syzkaller #0 [ 399.224047] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 399.233605] kobject: 'tx-0' (0000000077c1de83): kobject_uevent_env [ 399.233824] Call Trace: [ 399.233852] dump_stack+0x197/0x210 [ 399.239445] kobject: 'tx-0' (0000000077c1de83): fill_kobj_path: path = '/devices/virtual/net/ip6gre0/queues/tx-0' [ 399.248224] ? macvlan_broadcast+0x57c/0x660 [ 399.248238] panic+0x26a/0x50e [ 399.248249] ? __warn_printk+0xf3/0xf3 [ 399.248262] ? macvlan_broadcast+0x57c/0x660 [ 399.248279] ? trace_hardirqs_on+0x5e/0x220 [ 399.248293] ? trace_hardirqs_on+0x5e/0x220 [ 399.248308] ? macvlan_broadcast+0x57c/0x660 [ 399.248322] kasan_end_report+0x47/0x4f [ 399.248335] kasan_report.cold+0xa9/0x2ba [ 399.248351] __asan_report_load_n_noabort+0xf/0x20 [ 399.248365] macvlan_broadcast+0x57c/0x660 [ 399.248387] macvlan_start_xmit+0x408/0x785 [ 399.248404] dev_direct_xmit+0x34d/0x650 [ 399.248419] ? validate_xmit_skb_list+0x130/0x130 [ 399.248434] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 399.248448] ? skb_copy_datagram_from_iter+0x441/0x660 [ 399.248465] packet_direct_xmit+0xf9/0x170 [ 399.248481] packet_sendmsg+0x3bb2/0x6440 [ 399.248497] ? mark_held_locks+0x100/0x100 [ 399.248515] ? __might_sleep+0x95/0x190 [ 399.248549] ? __x32_compat_sys_getitimer+0x40/0x150 [ 399.303426] kobject: 'loop1' (00000000eee7a252): kobject_uevent_env [ 399.317541] ? packet_notifier+0x840/0x840 [ 399.317562] ? selinux_socket_sendmsg+0x36/0x40 [ 399.317577] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 399.317588] ? security_socket_sendmsg+0x8d/0xc0 [ 399.317601] ? packet_notifier+0x840/0x840 [ 399.317619] sock_sendmsg+0xd7/0x130 [ 399.317634] sock_write_iter+0x2cb/0x400 [ 399.317647] ? sock_sendmsg+0x130/0x130 [ 399.317667] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 399.328054] kobject: 'loop1' (00000000eee7a252): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 399.332678] ? iov_iter_init+0xc6/0x1f0 [ 399.332695] __vfs_write+0x587/0x810 [ 399.332708] ? kernel_read+0x120/0x120 [ 399.332726] ? selinux_file_permission+0x92/0x550 [ 399.332744] ? security_file_permission+0x89/0x230 [ 399.332756] ? rw_verify_area+0x118/0x360 [ 399.332773] vfs_write+0x20c/0x560 [ 399.341267] kobject: 'loop2' (00000000a44617a2): kobject_uevent_env [ 399.347346] ksys_write+0x14f/0x2d0 [ 399.347363] ? __ia32_sys_read+0xb0/0xb0 [ 399.347379] ? do_syscall_64+0x26/0x620 [ 399.347394] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 399.347405] ? do_syscall_64+0x26/0x620 [ 399.347418] __x64_sys_write+0x73/0xb0 [ 399.347432] do_syscall_64+0xfd/0x620 [ 399.347446] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 399.347456] RIP: 0033:0x45af49 [ 399.347471] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 399.347478] RSP: 002b:00007f24b86e9c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 399.347492] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045af49 [ 399.347498] RDX: 000000000000000e RSI: 00000000200000c0 RDI: 0000000000000003 [ 399.347511] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 399.347519] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f24b86ea6d4 [ 399.347527] R13: 00000000004cce79 R14: 00000000004e82b8 R15: 00000000ffffffff [ 399.356233] Kernel Offset: disabled [ 399.956064] Rebooting in 86400 seconds..