) ftruncate(0xffffffffffffffff, 0x2) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) pipe(&(0x7f0000000180)) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuseblk(0x0, 0x0, &(0x7f0000000240)='fuseblk\x00', 0x100800, &(0x7f0000000800)=ANY=[@ANYRESOCT, @ANYRESHEX, @ANYRESOCT, @ANYRESDEC, @ANYBLOB="2c67726f75020000004bdc0eb7ac10e541bb2d648b52620acc2ffa7ff8221d2d265aeb5f2d099b576b07a028e7746f6c0d312bab888fcbced88441318c028f30a9d552f9cb4eb52138ccac936d7c5e4b1c812ddf3e09eb20d8f5288f985b87451b450c7a716f5af821bd410887cac3a09371f6edb54ded44b8f2d5fa01bd368b6cfed3", @ANYRESOCT]) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:00:05 executing program 1: 09:00:05 executing program 0: 09:00:05 executing program 5: 09:00:06 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000440)='cpuset.cpus\x00\xaa\xef+e\xcb\x98\xe6xm\xbe\xf2F\x96%\x12G\xc8X`\xed\xbe\xce\xdea', 0x2, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x1000) 09:00:06 executing program 0: 09:00:06 executing program 1: 09:00:06 executing program 5: 09:00:06 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) bind$xdp(0xffffffffffffffff, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, r3}, 0x10) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r4, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_PIT2(r4, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) [ 401.009623][T13344] fuse: Bad value for 'fd' 09:00:06 executing program 0: 09:00:06 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000440)='cpuset.cpus\x00\xaa\xef+e\xcb\x98\xe6xm\xbe\xf2F\x96%\x12G\xc8X`\xed\xbe\xce\xdea', 0x2, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x1000) 09:00:06 executing program 1: 09:00:06 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ftruncate(0xffffffffffffffff, 0x2) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) pipe(&(0x7f0000000180)) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuseblk(0x0, 0x0, &(0x7f0000000240)='fuseblk\x00', 0x100800, &(0x7f0000000800)=ANY=[@ANYRESOCT, @ANYRESHEX, @ANYRESOCT, @ANYRESDEC, @ANYBLOB="2c67726f75020000004bdc0eb7ac10e541bb2d648b52620acc2ffa7ff8221d2d265aeb5f2d099b576b07a028e7746f6c0d312bab888fcbced88441318c028f30a9d552f9cb4eb52138ccac936d7c5e4b1c812ddf3e09eb20d8f5288f985b87451b450c7a716f5af821bd410887cac3a09371f6edb54ded44b8f2d5fa01bd368b6cfed3", @ANYRESOCT]) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:00:06 executing program 5: 09:00:06 executing program 5: 09:00:06 executing program 0: 09:00:06 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000440)='cpuset.cpus\x00\xaa\xef+e\xcb\x98\xe6xm\xbe\xf2F\x96%\x12G\xc8X`\xed\xbe\xce\xdea', 0x2, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x1000) 09:00:06 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) bind$xdp(0xffffffffffffffff, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, r3}, 0x10) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r4, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_PIT2(r4, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 09:00:06 executing program 1: 09:00:06 executing program 5: 09:00:06 executing program 0: 09:00:06 executing program 1: 09:00:06 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000440)='cpuset.cpus\x00\xaa\xef+e\xcb\x98\xe6xm\xbe\xf2F\x96%\x12G\xc8X`\xed\xbe\xce\xdea', 0x2, 0x0) r2 = openat$cgroup_ro(r0, 0x0, 0x0, 0x0) sendfile(r1, r2, 0x0, 0x1000) 09:00:06 executing program 5: 09:00:06 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ftruncate(0xffffffffffffffff, 0x2) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) pipe(&(0x7f0000000180)) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:00:06 executing program 0: 09:00:07 executing program 1: 09:00:07 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ftruncate(0xffffffffffffffff, 0x2) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) pipe(&(0x7f0000000180)) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:00:07 executing program 5: 09:00:07 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000440)='cpuset.cpus\x00\xaa\xef+e\xcb\x98\xe6xm\xbe\xf2F\x96%\x12G\xc8X`\xed\xbe\xce\xdea', 0x2, 0x0) r2 = openat$cgroup_ro(r0, 0x0, 0x0, 0x0) sendfile(r1, r2, 0x0, 0x1000) 09:00:07 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) bind$xdp(0xffffffffffffffff, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, r3}, 0x10) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r4, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 09:00:07 executing program 0: 09:00:07 executing program 5: 09:00:07 executing program 1: 09:00:07 executing program 0: 09:00:07 executing program 5: 09:00:07 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000440)='cpuset.cpus\x00\xaa\xef+e\xcb\x98\xe6xm\xbe\xf2F\x96%\x12G\xc8X`\xed\xbe\xce\xdea', 0x2, 0x0) r2 = openat$cgroup_ro(r0, 0x0, 0x0, 0x0) sendfile(r1, r2, 0x0, 0x1000) 09:00:07 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) bind$xdp(0xffffffffffffffff, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, r3}, 0x10) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r4, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 09:00:07 executing program 1: [ 403.432532][T12070] device bridge_slave_1 left promiscuous mode [ 403.438826][T12070] bridge0: port 2(bridge_slave_1) entered disabled state [ 403.482592][T12070] device bridge_slave_0 left promiscuous mode [ 403.488771][T12070] bridge0: port 1(bridge_slave_0) entered disabled state [ 404.182409][T12070] device hsr_slave_0 left promiscuous mode [ 404.231981][T12070] device hsr_slave_1 left promiscuous mode [ 404.308448][T12070] team0 (unregistering): Port device team_slave_1 removed [ 404.318710][T12070] team0 (unregistering): Port device team_slave_0 removed [ 404.328823][T12070] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 404.368716][T12070] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 404.442510][T12070] bond0 (unregistering): Released all slaves [ 404.598632][T13430] IPVS: ftp: loaded support on port[0] = 21 [ 404.648442][T13430] chnl_net:caif_netlink_parms(): no params data found [ 404.673009][T13430] bridge0: port 1(bridge_slave_0) entered blocking state [ 404.680191][T13430] bridge0: port 1(bridge_slave_0) entered disabled state [ 404.688083][T13430] device bridge_slave_0 entered promiscuous mode [ 404.695647][T13430] bridge0: port 2(bridge_slave_1) entered blocking state [ 404.702754][T13430] bridge0: port 2(bridge_slave_1) entered disabled state [ 404.710507][T13430] device bridge_slave_1 entered promiscuous mode [ 404.781454][T13430] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 404.795190][T13430] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 404.816963][T13430] team0: Port device team_slave_0 added [ 404.823892][T13430] team0: Port device team_slave_1 added [ 404.943887][T13430] device hsr_slave_0 entered promiscuous mode [ 405.012308][T13430] device hsr_slave_1 entered promiscuous mode [ 405.111993][T13430] debugfs: Directory 'hsr0' with parent '/' already present! [ 405.125817][T13430] bridge0: port 2(bridge_slave_1) entered blocking state [ 405.132902][T13430] bridge0: port 2(bridge_slave_1) entered forwarding state [ 405.140201][T13430] bridge0: port 1(bridge_slave_0) entered blocking state [ 405.147245][T13430] bridge0: port 1(bridge_slave_0) entered forwarding state [ 405.176365][T13430] 8021q: adding VLAN 0 to HW filter on device bond0 [ 405.188618][ T3012] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 405.197100][ T3012] bridge0: port 1(bridge_slave_0) entered disabled state [ 405.205245][ T3012] bridge0: port 2(bridge_slave_1) entered disabled state [ 405.221118][T13430] 8021q: adding VLAN 0 to HW filter on device team0 [ 405.232271][ T3012] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 405.240647][ T3012] bridge0: port 1(bridge_slave_0) entered blocking state [ 405.247787][ T3012] bridge0: port 1(bridge_slave_0) entered forwarding state [ 405.270651][T13430] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 405.281243][T13430] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 405.295294][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 405.304171][ T7639] bridge0: port 2(bridge_slave_1) entered blocking state [ 405.311272][ T7639] bridge0: port 2(bridge_slave_1) entered forwarding state [ 405.320159][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 405.329620][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 405.338459][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 405.346957][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 405.356153][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 405.364101][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 405.379668][ T7726] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 405.387438][ T7726] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 405.397598][T13430] 8021q: adding VLAN 0 to HW filter on device batadv0 09:00:10 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ftruncate(0xffffffffffffffff, 0x2) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) pipe(&(0x7f0000000180)) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:00:10 executing program 5: 09:00:10 executing program 0: 09:00:10 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu\x00', 0x200002, 0x0) openat$cgroup_int(r0, &(0x7f0000000440)='cpuset.cpus\x00\xaa\xef+e\xcb\x98\xe6xm\xbe\xf2F\x96%\x12G\xc8X`\xed\xbe\xce\xdea', 0x2, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x1000) 09:00:10 executing program 1: creat(&(0x7f0000000000)='./file0\x00', 0x0) r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) fchmodat(r0, &(0x7f0000000040)='./file0\x00', 0xa757510bff1343b) 09:00:10 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) bind$xdp(0xffffffffffffffff, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, r3}, 0x10) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r4, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 09:00:10 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x11, 0x800000003, 0x81) bind(r2, &(0x7f0000000100)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) write$binfmt_aout(r2, &(0x7f0000002340)={{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffa888}}, 0x20) 09:00:10 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu\x00', 0x200002, 0x0) openat$cgroup_int(r0, &(0x7f0000000440)='cpuset.cpus\x00\xaa\xef+e\xcb\x98\xe6xm\xbe\xf2F\x96%\x12G\xc8X`\xed\xbe\xce\xdea', 0x2, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x1000) [ 405.661205][ T26] audit: type=1804 audit(1575018010.736:39): pid=13451 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir949210370/syzkaller.461FP0/161/file0" dev="sda1" ino=17021 res=1 09:00:10 executing program 0: 09:00:10 executing program 1: [ 405.856484][T13466] fuse: Bad value for 'fd' 09:00:10 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) bind$xdp(0xffffffffffffffff, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, r3}, 0x10) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_CREATE_PIT2(r4, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r4, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 09:00:11 executing program 0: 09:00:11 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ftruncate(0xffffffffffffffff, 0x2) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) pipe(&(0x7f0000000180)) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:00:11 executing program 1: 09:00:11 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu\x00', 0x200002, 0x0) openat$cgroup_int(r0, &(0x7f0000000440)='cpuset.cpus\x00\xaa\xef+e\xcb\x98\xe6xm\xbe\xf2F\x96%\x12G\xc8X`\xed\xbe\xce\xdea', 0x2, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x1000) 09:00:11 executing program 5: mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000780)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0) syz_genetlink_get_family_id$ipvs(0x0) sendto(0xffffffffffffffff, 0x0, 0x0, 0x220000c0, &(0x7f0000000340)=@nl, 0x80) sendmsg$IPVS_CMD_DEL_SERVICE(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) unlink(&(0x7f0000000040)='./file0\x00') socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x3d, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) r0 = accept$inet(0xffffffffffffffff, &(0x7f00000003c0)={0x2, 0x0, @loopback}, 0x0) r1 = socket$bt_hidp(0x1f, 0x3, 0x6) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r1, 0x0, 0x8) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c) getpid() 09:00:11 executing program 0: r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f0000000040), 0x4) 09:00:11 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000200)='./file0\x00', &(0x7f0000000100)='system.posix_acl_default\x00', &(0x7f0000000480)=ANY=[@ANYBLOB="020000000100000000ff00000400000000000000100000000000000020000000000000001555f178aaa27d545090c10a85f61d685e2c926c96fecf5fcd3382fc74595a755e241b5dc3b3e7e17f348755c5c4ecb2b6c0782f900e411e95ea5316857d6009a8bbff9e76ea9822cfe3d5785f609e32a9668c3423c34f42b2b0f01395c46e7fa4cfc722fd3e5c986ab36fffa4fdbcb296053b60780e90a422b8b8bdde726247c5a565f23b84e7f4c564df438434c5492b9a77d2889d596c6458172a5b5b4ec01efc941fc40dc75bbb4c5b45b2c76e167253c73fc2ef40f5c8766ee35d7ed579d4e354988822c15bbb080d8cb2b2d0fa3781c843a1219a2443e466eb01c0f7377a994ff38a4ee3000000000000000000000000007970a0f880fc7e14e0e51b6b8cb082f94764c77ccc1ad66d0577464a83d13bc760a8597bd742d674da785b398f399ccf3f4f0d50c84fa4ebe35c5db1a4e6fca08c1d727553dbc28a66e77eefd8838f1c9fa9f7428c0eac2542d7e8701e2e734c2fd71d38bb65623a16f92730201e1268f1bc2ce11eb1c1f66ee73e7f4fa0f89b737c352c6f10ac1266ac1993db26d75c0816e1675cc0fb0d6e80d6fe4186f6fe9cf9546c7dcc87c9a540930b02ac47d981e4629398287b48e833b6fb04d54d7ac47c50e5385fef84ac4029e723a70bf1e01992cdb3e8f8855b946703f5555e7b9be6138bdd16bc"], 0x24, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000040)) rmdir(&(0x7f0000000000)='./file0\x00') 09:00:11 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) bind$xdp(0xffffffffffffffff, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, r3}, 0x10) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_CREATE_PIT2(r4, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r4, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 09:00:11 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000440)='cpuset.cpus\x00\xaa\xef+e\xcb\x98\xe6xm\xbe\xf2F\x96%\x12G\xc8X`\xed\xbe\xce\xdea', 0x2, 0x0) openat$cgroup_ro(r0, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) sendfile(r1, 0xffffffffffffffff, 0x0, 0x1000) 09:00:11 executing program 0: syz_emit_ethernet(0x36, &(0x7f0000000000)={@local, @dev, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x2f, 0x0, @dev, @remote={0xac, 0x14, 0x223}}, @icmp=@timestamp_reply={0x7, 0x2}}}}}, 0x0) 09:00:11 executing program 1: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r1, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:11 executing program 5: mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000780)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0) syz_genetlink_get_family_id$ipvs(0x0) sendto(0xffffffffffffffff, 0x0, 0x0, 0x220000c0, &(0x7f0000000340)=@nl, 0x80) sendmsg$IPVS_CMD_DEL_SERVICE(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) unlink(&(0x7f0000000040)='./file0\x00') socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x3d, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) r0 = accept$inet(0xffffffffffffffff, &(0x7f00000003c0)={0x2, 0x0, @loopback}, 0x0) r1 = socket$bt_hidp(0x1f, 0x3, 0x6) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r1, 0x0, 0x8) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c) getpid() 09:00:11 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ftruncate(0xffffffffffffffff, 0x2) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) pipe(&(0x7f0000000180)) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:00:11 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, 0xffffffffffffffff, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) io_setup(0x5, &(0x7f0000000140)) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000000)=0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) setsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000000c0)={r2, 0xffffffffffffffff, r3}, 0xc) fallocate(r0, 0x0, 0x0, 0x84003ff) 09:00:11 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000440)='cpuset.cpus\x00\xaa\xef+e\xcb\x98\xe6xm\xbe\xf2F\x96%\x12G\xc8X`\xed\xbe\xce\xdea', 0x2, 0x0) openat$cgroup_ro(r0, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) sendfile(r1, 0xffffffffffffffff, 0x0, 0x1000) 09:00:11 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ftruncate(0xffffffffffffffff, 0x2) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) pipe(&(0x7f0000000180)) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:00:11 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) bind$xdp(0xffffffffffffffff, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, r3}, 0x10) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_CREATE_PIT2(r4, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r4, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 09:00:11 executing program 1: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r1, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:12 executing program 5: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$inet(0x2, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x4000000000000016, &(0x7f0000000600)) ptrace(0x4206, r0) ptrace$peeksig(0x2, r0, &(0x7f00000000c0), &(0x7f00000002c0)) 09:00:12 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000440)='cpuset.cpus\x00\xaa\xef+e\xcb\x98\xe6xm\xbe\xf2F\x96%\x12G\xc8X`\xed\xbe\xce\xdea', 0x2, 0x0) openat$cgroup_ro(r0, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) sendfile(r1, 0xffffffffffffffff, 0x0, 0x1000) 09:00:12 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x7, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2}, [@alu={0x7, 0x1, 0x16db07dc61b7899b, 0x0, 0x0, 0x0, 0x4}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) 09:00:12 executing program 1: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r1, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:12 executing program 5: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$inet(0x2, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x4000000000000016, &(0x7f0000000600)) ptrace(0x4206, r0) ptrace$peeksig(0x2, r0, &(0x7f00000000c0), &(0x7f00000002c0)) 09:00:12 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) bind$xdp(0xffffffffffffffff, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, r3}, 0x10) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r4, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r4, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 09:00:12 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000440)='cpuset.cpus\x00\xaa\xef+e\xcb\x98\xe6xm\xbe\xf2F\x96%\x12G\xc8X`\xed\xbe\xce\xdea', 0x2, 0x0) r2 = openat$cgroup_ro(r0, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x0) 09:00:12 executing program 0: r0 = socket(0x11, 0x10000000000003, 0x0) getsockname(r0, 0x0, 0x0) 09:00:12 executing program 1: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r1, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) [ 408.192535][T12070] device bridge_slave_1 left promiscuous mode [ 408.198790][T12070] bridge0: port 2(bridge_slave_1) entered disabled state [ 408.252724][T12070] device bridge_slave_0 left promiscuous mode [ 408.258900][T12070] bridge0: port 1(bridge_slave_0) entered disabled state [ 408.932147][T12070] device hsr_slave_0 left promiscuous mode [ 408.982097][T12070] device hsr_slave_1 left promiscuous mode [ 409.028151][T12070] team0 (unregistering): Port device team_slave_1 removed [ 409.038506][T12070] team0 (unregistering): Port device team_slave_0 removed [ 409.048647][T12070] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 409.107758][T12070] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 409.172171][T12070] bond0 (unregistering): Released all slaves [ 409.427398][T13585] IPVS: ftp: loaded support on port[0] = 21 [ 409.494488][T13585] chnl_net:caif_netlink_parms(): no params data found [ 409.525230][T13585] bridge0: port 1(bridge_slave_0) entered blocking state [ 409.532399][T13585] bridge0: port 1(bridge_slave_0) entered disabled state [ 409.540365][T13585] device bridge_slave_0 entered promiscuous mode [ 409.552084][T13585] bridge0: port 2(bridge_slave_1) entered blocking state [ 409.559191][T13585] bridge0: port 2(bridge_slave_1) entered disabled state [ 409.570294][T13585] device bridge_slave_1 entered promiscuous mode [ 409.591115][T13585] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 409.601819][T13585] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 409.624240][T13585] team0: Port device team_slave_0 added [ 409.630996][T13585] team0: Port device team_slave_1 added [ 409.684152][T13585] device hsr_slave_0 entered promiscuous mode [ 409.732225][T13585] device hsr_slave_1 entered promiscuous mode [ 409.811949][T13585] debugfs: Directory 'hsr0' with parent '/' already present! [ 409.829907][T13585] bridge0: port 2(bridge_slave_1) entered blocking state [ 409.837101][T13585] bridge0: port 2(bridge_slave_1) entered forwarding state [ 409.844429][T13585] bridge0: port 1(bridge_slave_0) entered blocking state [ 409.851458][T13585] bridge0: port 1(bridge_slave_0) entered forwarding state [ 409.881290][T13585] 8021q: adding VLAN 0 to HW filter on device bond0 [ 409.892991][ T7726] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 409.901475][ T7726] bridge0: port 1(bridge_slave_0) entered disabled state [ 409.909785][ T7726] bridge0: port 2(bridge_slave_1) entered disabled state [ 409.922770][T13585] 8021q: adding VLAN 0 to HW filter on device team0 [ 409.934372][ T7726] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 409.943306][ T7726] bridge0: port 1(bridge_slave_0) entered blocking state [ 409.950355][ T7726] bridge0: port 1(bridge_slave_0) entered forwarding state [ 409.963578][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 409.972544][ T7613] bridge0: port 2(bridge_slave_1) entered blocking state [ 409.979596][ T7613] bridge0: port 2(bridge_slave_1) entered forwarding state [ 409.993698][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 410.002840][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 410.014465][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 410.031741][T13585] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 410.045600][T13585] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 410.057749][ T3012] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 410.067095][ T3012] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 410.076237][ T3012] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 410.093634][T13585] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 410.101067][ T3012] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 410.109211][ T3012] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 09:00:15 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x16}], 0xaaaaaaaaaaaae2f, 0x0, 0x0, 0xffa3) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x6b) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f0000000140)={[{0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:00:15 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000440)='cpuset.cpus\x00\xaa\xef+e\xcb\x98\xe6xm\xbe\xf2F\x96%\x12G\xc8X`\xed\xbe\xce\xdea', 0x2, 0x0) r2 = openat$cgroup_ro(r0, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x0) 09:00:15 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) bind$xdp(0xffffffffffffffff, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, r3}, 0x10) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r4, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r4, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 09:00:15 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f0000000240)) 09:00:15 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ftruncate(0xffffffffffffffff, 0x2) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) pipe(&(0x7f0000000180)) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:00:15 executing program 1: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={0xffffffffffffffff, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) [ 410.254939][T13595] fuse: Bad value for 'fd' 09:00:15 executing program 0: r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000040), 0x4) syz_emit_ethernet(0x36, &(0x7f0000000000)={@local, @dev, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x4, 0x0, @dev, @remote={0xac, 0x14, 0x223}}, @icmp=@timestamp_reply={0x7, 0x2}}}}}, 0x0) 09:00:15 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000440)='cpuset.cpus\x00\xaa\xef+e\xcb\x98\xe6xm\xbe\xf2F\x96%\x12G\xc8X`\xed\xbe\xce\xdea', 0x2, 0x0) r2 = openat$cgroup_ro(r0, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x0) 09:00:15 executing program 1: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={0xffffffffffffffff, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:15 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) bind$xdp(0xffffffffffffffff, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, r3}, 0x10) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r4, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r4, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 09:00:15 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ftruncate(0xffffffffffffffff, 0x2) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) pipe(&(0x7f0000000180)) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:00:15 executing program 3: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, 0x0, 0x0, 0x0, 0x0, 0xb2) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, &(0x7f0000000180), 0x4) getdents64(0xffffffffffffffff, 0x0, 0x12c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000b6dfc8)={0x500, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x2, 0x400000000000003, 0x0, 0x403, 0xf, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[0x300000000000000, 0x0, 0x0, 0x6000000, 0x0, 0x0, 0x6000000, 0x40030000000000], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @sadb_key={0x1, 0x9}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x7, 0xb}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @rand_addr="2d997e568b940344a40733b5e36b51d3"}}]}, 0x78}}, 0x0) bind$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x2, 0x0, @local}, 0x10) 09:00:16 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000134000)={0x2, 0x4e23, @broadcast}, 0x10) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @empty}, 0x10) 09:00:16 executing program 1: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={0xffffffffffffffff, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:16 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ftruncate(0xffffffffffffffff, 0x2) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) pipe(&(0x7f0000000180)) lstat(0x0, &(0x7f0000000600)) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:00:16 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x12, 0x706b, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97"}, 0x12a) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(0xffffffffffffffff, 0xc020660b, 0x20000001) write$eventfd(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000180)) renameat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0xffffffffffffffff, 0x0) lstat(0x0, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x0, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) ioctl$RTC_EPOCH_READ(0xffffffffffffffff, 0x8008700d, &(0x7f0000000080)) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuseblk(0x0, 0x0, &(0x7f0000000240)='fuseblk\x00', 0x100800, &(0x7f0000000800)=ANY=[@ANYRESOCT=r1, @ANYRESHEX, @ANYRESDEC, @ANYBLOB="2c67726f75020000004bdc0eb7ac10e541bb2d648b52620acc2ffa7ff8221d2d265aeb5f2d099b576b07a028e7746f6c0d312bab888fcbced88441318c028f30a9d552f9cb4eb52138ccac936d7c5e4b1c812ddf3e09eb20d8f5288f985b87451b450c", @ANYRESOCT]) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:00:16 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) bind$xdp(0xffffffffffffffff, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, r3}, 0x10) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r4, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r4, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 09:00:16 executing program 5: r0 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x9}, 0x1c) sendmsg(r0, &(0x7f00000000c0)={0x0, 0xffffffffffffffd5, 0x0}, 0xc100) sendmsg(r0, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000fc0)="119a", 0x2}], 0x1}, 0x0) 09:00:16 executing program 1: socket$inet6(0xa, 0x80003, 0x6b) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:16 executing program 3: sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f00000002c0)=ANY=[@ANYBLOB="e6e9030054"], 0x5}}, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 09:00:16 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x12, 0x706b, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97"}, 0x12a) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(0xffffffffffffffff, 0xc020660b, 0x20000001) write$eventfd(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000180)) renameat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0xffffffffffffffff, 0x0) lstat(0x0, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x0, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) ioctl$RTC_EPOCH_READ(0xffffffffffffffff, 0x8008700d, &(0x7f0000000080)) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuseblk(0x0, 0x0, &(0x7f0000000240)='fuseblk\x00', 0x100800, &(0x7f0000000800)=ANY=[@ANYRESOCT=r1, @ANYRESHEX, @ANYRESDEC, @ANYBLOB="2c67726f75020000004bdc0eb7ac10e541bb2d648b52620acc2ffa7ff8221d2d265aeb5f2d099b576b07a028e7746f6c0d312bab888fcbced88441318c028f30a9d552f9cb4eb52138ccac936d7c5e4b1c812ddf3e09eb20d8f5288f985b87451b450c", @ANYRESOCT]) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:00:16 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) bind$xdp(0xffffffffffffffff, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, r3}, 0x10) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r4, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r4, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 09:00:16 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x2, 0x4) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x2, &(0x7f00000000c0)=[{&(0x7f0000000000)="24000000140081563e060804000f000010ff0100000060003f03546fabca1b4e7906a6bd", 0x24}], 0x1}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, 0xffffffffffffffff) perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) 09:00:16 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) [ 411.797611][T13776] fuse: Bad value for 'fd' [ 411.846788][T13776] fuse: Bad value for 'fd' 09:00:17 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) bind$xdp(0xffffffffffffffff, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, r3}, 0x10) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r4, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r4, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 09:00:17 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, 0xffffffffffffffff, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x84003ff) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) bpf$MAP_DELETE_ELEM(0x3, 0x0, 0x0) [ 412.522839][ T7688] device bridge_slave_1 left promiscuous mode [ 412.529103][ T7688] bridge0: port 2(bridge_slave_1) entered disabled state [ 412.572568][ T7688] device bridge_slave_0 left promiscuous mode [ 412.578760][ T7688] bridge0: port 1(bridge_slave_0) entered disabled state [ 413.342204][ T7688] device hsr_slave_0 left promiscuous mode [ 413.382143][ T7688] device hsr_slave_1 left promiscuous mode [ 413.428838][ T7688] team0 (unregistering): Port device team_slave_1 removed [ 413.439076][ T7688] team0 (unregistering): Port device team_slave_0 removed [ 413.449331][ T7688] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 413.485276][ T7688] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 413.562234][ T7688] bond0 (unregistering): Released all slaves [ 413.881831][T13914] IPVS: ftp: loaded support on port[0] = 21 [ 413.950286][T13914] chnl_net:caif_netlink_parms(): no params data found [ 413.982203][T13914] bridge0: port 1(bridge_slave_0) entered blocking state [ 413.989346][T13914] bridge0: port 1(bridge_slave_0) entered disabled state [ 414.001171][T13914] device bridge_slave_0 entered promiscuous mode [ 414.009288][T13914] bridge0: port 2(bridge_slave_1) entered blocking state [ 414.019578][T13914] bridge0: port 2(bridge_slave_1) entered disabled state [ 414.028099][T13914] device bridge_slave_1 entered promiscuous mode [ 414.048217][T13914] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 414.061614][T13914] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 414.081236][T13914] team0: Port device team_slave_0 added [ 414.090976][T13914] team0: Port device team_slave_1 added [ 414.164554][T13914] device hsr_slave_0 entered promiscuous mode [ 414.202380][T13914] device hsr_slave_1 entered promiscuous mode [ 414.242037][T13914] debugfs: Directory 'hsr0' with parent '/' already present! [ 414.257095][T13914] bridge0: port 2(bridge_slave_1) entered blocking state [ 414.264212][T13914] bridge0: port 2(bridge_slave_1) entered forwarding state [ 414.271670][T13914] bridge0: port 1(bridge_slave_0) entered blocking state [ 414.278734][T13914] bridge0: port 1(bridge_slave_0) entered forwarding state [ 414.307977][T13914] 8021q: adding VLAN 0 to HW filter on device bond0 [ 414.319665][ T7726] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 414.328346][ T7726] bridge0: port 1(bridge_slave_0) entered disabled state [ 414.336654][ T7726] bridge0: port 2(bridge_slave_1) entered disabled state [ 414.349996][T13914] 8021q: adding VLAN 0 to HW filter on device team0 [ 414.361172][ T7726] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 414.370399][ T7726] bridge0: port 1(bridge_slave_0) entered blocking state [ 414.377462][ T7726] bridge0: port 1(bridge_slave_0) entered forwarding state [ 414.400910][T13914] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 414.411841][T13914] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 414.426738][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 414.435633][ T7704] bridge0: port 2(bridge_slave_1) entered blocking state [ 414.442747][ T7704] bridge0: port 2(bridge_slave_1) entered forwarding state [ 414.451803][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 414.461545][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 414.470260][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 414.478712][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 414.495195][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 414.502942][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 414.517029][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 414.524920][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 414.537616][T13914] 8021q: adding VLAN 0 to HW filter on device batadv0 09:00:19 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ftruncate(0xffffffffffffffff, 0x2) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) pipe(&(0x7f0000000180)) lstat(0x0, &(0x7f0000000600)) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:00:19 executing program 1: r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:19 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, 0xffffffffffffffff, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x84003ff) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) bpf$MAP_DELETE_ELEM(0x3, 0x0, 0x0) 09:00:19 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(aes-aesni)\x00'}, 0x58) r5 = accept4(r4, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) sendmsg$IPVS_CMD_SET_CONFIG(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x60, 0x0, 0x0, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_SERVICE={0x44, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'sed\x00'}, @IPVS_SVC_ATTR_PROTOCOL={0x8}, @IPVS_SVC_ATTR_NETMASK={0x8}, @IPVS_SVC_ATTR_PORT={0x8}, @IPVS_SVC_ATTR_PORT={0x8}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'rr\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8}]}]}, 0x60}}, 0x0) recvfrom(r5, &(0x7f00000002c0)=""/4096, 0x1000, 0x0, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r3, 0x1000000000016) 09:00:19 executing program 0: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) close(r4) socket(0x10, 0x80002, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe0, 0x0) 09:00:19 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) bind$xdp(0xffffffffffffffff, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, r3}, 0x10) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r4, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r4, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 09:00:19 executing program 1: r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) [ 415.013622][T14046] fuse: Bad value for 'fd' 09:00:20 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) bind$xdp(0xffffffffffffffff, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, r3}, 0x10) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r4, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r4, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 09:00:20 executing program 1: r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:20 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ftruncate(0xffffffffffffffff, 0x2) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) pipe(&(0x7f0000000180)) lstat(0x0, &(0x7f0000000600)) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:00:20 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, 0xffffffffffffffff, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x84003ff) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) bpf$MAP_DELETE_ELEM(0x3, 0x0, 0x0) 09:00:20 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, 0xffffffffffffffff, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x84003ff) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) bpf$MAP_DELETE_ELEM(0x3, 0x0, 0x0) 09:00:20 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:20 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) bind$xdp(0xffffffffffffffff, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, r3}, 0x10) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r4, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r4, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 09:00:20 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, 0xffffffffffffffff, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x84003ff) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) bpf$MAP_DELETE_ELEM(0x3, 0x0, 0x0) [ 416.663235][ T7688] device bridge_slave_1 left promiscuous mode [ 416.669515][ T7688] bridge0: port 2(bridge_slave_1) entered disabled state [ 416.722776][ T7688] device bridge_slave_0 left promiscuous mode [ 416.728999][ T7688] bridge0: port 1(bridge_slave_0) entered disabled state [ 417.402275][ T7688] device hsr_slave_0 left promiscuous mode [ 417.472103][ T7688] device hsr_slave_1 left promiscuous mode [ 417.518721][ T7688] team0 (unregistering): Port device team_slave_1 removed [ 417.529690][ T7688] team0 (unregistering): Port device team_slave_0 removed [ 417.543445][ T7688] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 417.615608][ T7688] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 417.701837][ T7688] bond0 (unregistering): Released all slaves [ 417.789247][T14182] IPVS: ftp: loaded support on port[0] = 21 [ 417.848609][T14182] chnl_net:caif_netlink_parms(): no params data found [ 417.874327][T14182] bridge0: port 1(bridge_slave_0) entered blocking state [ 417.881436][T14182] bridge0: port 1(bridge_slave_0) entered disabled state [ 417.889279][T14182] device bridge_slave_0 entered promiscuous mode [ 417.896836][T14182] bridge0: port 2(bridge_slave_1) entered blocking state [ 417.904059][T14182] bridge0: port 2(bridge_slave_1) entered disabled state [ 417.911776][T14182] device bridge_slave_1 entered promiscuous mode [ 417.928661][T14182] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 418.005288][T14182] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 418.027418][T14182] team0: Port device team_slave_0 added [ 418.035486][T14182] team0: Port device team_slave_1 added [ 418.106202][T14182] device hsr_slave_0 entered promiscuous mode [ 418.164291][T14182] device hsr_slave_1 entered promiscuous mode [ 418.210765][T14182] bridge0: port 2(bridge_slave_1) entered blocking state [ 418.217860][T14182] bridge0: port 2(bridge_slave_1) entered forwarding state [ 418.225216][T14182] bridge0: port 1(bridge_slave_0) entered blocking state [ 418.232258][T14182] bridge0: port 1(bridge_slave_0) entered forwarding state [ 418.278522][T14182] 8021q: adding VLAN 0 to HW filter on device bond0 [ 418.292445][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 418.302617][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 418.310446][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 418.326999][T14182] 8021q: adding VLAN 0 to HW filter on device team0 [ 418.339863][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 418.350782][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 418.357872][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 418.372259][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 418.381412][ T7613] bridge0: port 2(bridge_slave_1) entered blocking state [ 418.388511][ T7613] bridge0: port 2(bridge_slave_1) entered forwarding state [ 418.404629][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 418.413302][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 418.426143][ T3012] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 418.440114][T14182] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 418.453369][T14182] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 418.467561][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 418.476655][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 418.485050][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 418.501180][T14182] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 418.508726][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 418.516483][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 09:00:24 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, 0xffffffffffffffff, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x84003ff) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) bpf$MAP_DELETE_ELEM(0x3, 0x0, 0x0) 09:00:24 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, 0xffffffffffffffff, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x84003ff) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) bpf$MAP_DELETE_ELEM(0x3, 0x0, 0x0) 09:00:24 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:24 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, 0xffffffffffffffff, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x84003ff) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) bpf$MAP_DELETE_ELEM(0x3, 0x0, 0x0) 09:00:24 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ftruncate(0xffffffffffffffff, 0x2) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) pipe(&(0x7f0000000180)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:00:24 executing program 4: openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) bind$xdp(0xffffffffffffffff, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, r2}, 0x10) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(0xffffffffffffffff, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 09:00:24 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:24 executing program 4: openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) bind$xdp(0xffffffffffffffff, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, r2}, 0x10) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(0xffffffffffffffff, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 09:00:24 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x9}, 0x0) socket$inet6(0xa, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) write(r2, &(0x7f0000000340), 0x41395527) vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=@newsa={0x13c, 0x10, 0x963ddcda599079f3, 0x0, 0x0, {{@in, @in=@loopback}, {@in6=@loopback, 0x0, 0x33}, @in=@remote={0xac, 0x14, 0xffffffffffffffff}, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth_trunc={0x4c, 0x14, {{'cmac(aes)\x00'}}}]}, 0x13c}}, 0x20000010) 09:00:24 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x0, 0x0, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:25 executing program 0: syz_emit_ethernet(0x22, &(0x7f0000000000)={@local, @dev, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x32, 0x0, @dev, @remote={0xac, 0x14, 0x223}}, @icmp=@timestamp_reply={0x7, 0x2}}}}}, 0x0) 09:00:25 executing program 4: openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) bind$xdp(0xffffffffffffffff, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, r2}, 0x10) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(0xffffffffffffffff, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 09:00:25 executing program 3: mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) prctl$PR_SVE_GET_VL(0x33, 0x1ca23) mount(0x0, &(0x7f0000000480)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000780)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) sendto(0xffffffffffffffff, 0x0, 0x0, 0x220000c0, &(0x7f0000000340)=@nl, 0x80) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000640)=0x14b) unlink(&(0x7f0000000040)='./file0\x00') r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_SET_UNIQUE(r1, 0x40106410, 0x0) getsockopt$sock_buf(r0, 0x1, 0x3d, 0x0, &(0x7f00000000c0)=0x20b) socket$inet6(0xa, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) accept$inet(0xffffffffffffffff, 0x0, 0x0) socket$bt_hidp(0x1f, 0x3, 0x6) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x8) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c) setxattr$trusted_overlay_nlink(&(0x7f0000000700)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f0000000280)='trusted.overlay.nlink\x00', &(0x7f0000000300)={'U+', 0x80}, 0x28, 0x0) getpid() vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 09:00:25 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x0, 0x0, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:25 executing program 0: 09:00:25 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) [ 420.392417][ T7688] device bridge_slave_1 left promiscuous mode [ 420.399991][ T7688] bridge0: port 2(bridge_slave_1) entered disabled state [ 420.486181][ T7688] device bridge_slave_0 left promiscuous mode [ 420.495930][ T7688] bridge0: port 1(bridge_slave_0) entered disabled state [ 420.635085][T14448] pit: kvm: requested 127390 ns i8254 timer period limited to 200000 ns [ 420.679364][T14448] pit: kvm: requested 31847 ns i8254 timer period limited to 200000 ns [ 421.722197][ T7688] device hsr_slave_0 left promiscuous mode [ 421.761966][ T7688] device hsr_slave_1 left promiscuous mode [ 421.807560][ T7688] team0 (unregistering): Port device team_slave_1 removed [ 421.818008][ T7688] team0 (unregistering): Port device team_slave_0 removed [ 421.828641][ T7688] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 421.895683][ T7688] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 421.981849][ T7688] bond0 (unregistering): Released all slaves [ 422.400713][T14457] IPVS: ftp: loaded support on port[0] = 21 [ 422.477856][T14457] chnl_net:caif_netlink_parms(): no params data found [ 422.510841][T14457] bridge0: port 1(bridge_slave_0) entered blocking state [ 422.517992][T14457] bridge0: port 1(bridge_slave_0) entered disabled state [ 422.528785][T14457] device bridge_slave_0 entered promiscuous mode [ 422.536792][T14457] bridge0: port 2(bridge_slave_1) entered blocking state [ 422.546910][T14457] bridge0: port 2(bridge_slave_1) entered disabled state [ 422.555044][T14457] device bridge_slave_1 entered promiscuous mode [ 422.576501][T14457] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 422.587334][T14457] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 422.609229][T14457] team0: Port device team_slave_0 added [ 422.618632][T14457] team0: Port device team_slave_1 added [ 422.683777][T14457] device hsr_slave_0 entered promiscuous mode [ 422.734802][T14457] device hsr_slave_1 entered promiscuous mode [ 422.801977][T14457] debugfs: Directory 'hsr0' with parent '/' already present! [ 422.819680][T14457] bridge0: port 2(bridge_slave_1) entered blocking state [ 422.826768][T14457] bridge0: port 2(bridge_slave_1) entered forwarding state [ 422.834039][T14457] bridge0: port 1(bridge_slave_0) entered blocking state [ 422.841075][T14457] bridge0: port 1(bridge_slave_0) entered forwarding state [ 422.875681][T14457] 8021q: adding VLAN 0 to HW filter on device bond0 [ 422.887235][ T3012] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 422.895595][ T3012] bridge0: port 1(bridge_slave_0) entered disabled state [ 422.903487][ T3012] bridge0: port 2(bridge_slave_1) entered disabled state [ 422.915948][T14457] 8021q: adding VLAN 0 to HW filter on device team0 [ 422.927403][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 422.936259][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 422.943318][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 422.963824][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 422.972652][ T7613] bridge0: port 2(bridge_slave_1) entered blocking state [ 422.979740][ T7613] bridge0: port 2(bridge_slave_1) entered forwarding state [ 422.988722][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 422.997527][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 423.007987][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 423.016126][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 423.028095][T14457] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 423.039449][T14457] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 423.048275][ T3012] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 423.065510][T14457] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 423.073501][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 423.080990][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 09:00:28 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ftruncate(0xffffffffffffffff, 0x2) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) pipe(&(0x7f0000000180)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:00:28 executing program 5: 09:00:28 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x0, 0x0, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:28 executing program 0: 09:00:28 executing program 3: 09:00:28 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:00:28 executing program 5: 09:00:28 executing program 3: 09:00:28 executing program 0: [ 423.414104][T14476] pit: kvm: requested 41904 ns i8254 timer period limited to 200000 ns 09:00:28 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x0, &(0x7f0000000000)=ANY=[], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) [ 423.509615][T14491] fuse: Bad value for 'fd' [ 423.523842][T14476] pit: kvm: requested 119847 ns i8254 timer period limited to 200000 ns 09:00:28 executing program 5: [ 423.585693][T14476] pit: kvm: requested 137447 ns i8254 timer period limited to 200000 ns [ 423.622661][T14476] pit: kvm: requested 93866 ns i8254 timer period limited to 200000 ns 09:00:28 executing program 0: 09:00:28 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ftruncate(0xffffffffffffffff, 0x2) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) pipe(&(0x7f0000000180)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) [ 423.633480][T14476] pit: kvm: requested 95542 ns i8254 timer period limited to 200000 ns 09:00:28 executing program 3: 09:00:28 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x0, &(0x7f0000000000)=ANY=[], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:28 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:00:28 executing program 0: 09:00:29 executing program 5: 09:00:29 executing program 3: socket(0x0, 0x0, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(0xffffffffffffffff, 0x10e, 0x8, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000300)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = epoll_create(0x0) ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(r0, 0x8982, 0x0) 09:00:29 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:00:29 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x0, &(0x7f0000000000)=ANY=[], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:29 executing program 5: open(&(0x7f0000000040)='.\x00', 0x0, 0x1) [ 424.089781][T14512] pit: kvm: requested 12571 ns i8254 timer period limited to 200000 ns 09:00:29 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ftruncate(0xffffffffffffffff, 0x2) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:00:29 executing program 5: r0 = socket$kcm(0x2b, 0x1, 0x0) r1 = socket$kcm(0x29, 0x5, 0x0) sendmsg$kcm(r1, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000180)="fb", 0x1}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) recvmsg$kcm(r1, &(0x7f0000013500)={0x0, 0x0, 0x0}, 0x0) write$cgroup_subtree(r1, 0x0, 0x0) 09:00:29 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:29 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:00:29 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ftruncate(0xffffffffffffffff, 0x2) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:00:29 executing program 3: ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000040)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000400)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000f5d000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x106], 0x1a000}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) r4 = fcntl$dupfd(0xffffffffffffffff, 0x0, r3) ioctl$IOC_PR_RELEASE(0xffffffffffffffff, 0x401070ca, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f00000001c0)={@multicast1, @multicast2}, 0x0) ioctl$KDGKBTYPE(0xffffffffffffffff, 0x4b33, &(0x7f0000000180)) sendmsg$nl_route_sched(r4, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x4) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) rmdir(&(0x7f00000002c0)='\x00') r5 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r5, 0x29, 0x2e, &(0x7f0000000400)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x8000, @remote}}}, 0x104) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_open_procfs(0x0, 0x0) 09:00:29 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) [ 424.580397][T14643] pit: kvm: requested 8380 ns i8254 timer period limited to 200000 ns [ 424.633125][T14643] pit: kvm: requested 108952 ns i8254 timer period limited to 200000 ns 09:00:29 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:29 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) [ 425.592538][ T7688] device bridge_slave_1 left promiscuous mode [ 425.598760][ T7688] bridge0: port 2(bridge_slave_1) entered disabled state [ 425.643032][ T7688] device bridge_slave_0 left promiscuous mode [ 425.649311][ T7688] bridge0: port 1(bridge_slave_0) entered disabled state [ 426.352312][ T7688] device hsr_slave_0 left promiscuous mode [ 426.412071][ T7688] device hsr_slave_1 left promiscuous mode [ 426.458292][ T7688] team0 (unregistering): Port device team_slave_1 removed [ 426.468730][ T7688] team0 (unregistering): Port device team_slave_0 removed [ 426.478717][ T7688] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 426.525341][ T7688] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 426.608203][ T7688] bond0 (unregistering): Released all slaves [ 426.729233][T14766] IPVS: ftp: loaded support on port[0] = 21 [ 426.779450][T14766] chnl_net:caif_netlink_parms(): no params data found [ 426.806086][T14766] bridge0: port 1(bridge_slave_0) entered blocking state [ 426.813247][T14766] bridge0: port 1(bridge_slave_0) entered disabled state [ 426.820944][T14766] device bridge_slave_0 entered promiscuous mode [ 426.874769][T14766] bridge0: port 2(bridge_slave_1) entered blocking state [ 426.882381][T14766] bridge0: port 2(bridge_slave_1) entered disabled state [ 426.890163][T14766] device bridge_slave_1 entered promiscuous mode [ 426.910678][T14766] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 426.924411][T14766] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 426.947389][T14766] team0: Port device team_slave_0 added [ 426.956012][T14766] team0: Port device team_slave_1 added [ 427.027265][T14766] device hsr_slave_0 entered promiscuous mode [ 427.075267][T14766] device hsr_slave_1 entered promiscuous mode 09:00:32 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x2, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef00"/16], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:32 executing program 3: ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000040)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000400)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000f5d000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x106], 0x1a000}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) r4 = fcntl$dupfd(0xffffffffffffffff, 0x0, r3) ioctl$IOC_PR_RELEASE(0xffffffffffffffff, 0x401070ca, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f00000001c0)={@multicast1, @multicast2}, 0x0) ioctl$KDGKBTYPE(0xffffffffffffffff, 0x4b33, &(0x7f0000000180)) sendmsg$nl_route_sched(r4, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x4) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) rmdir(&(0x7f00000002c0)='\x00') r5 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r5, 0x29, 0x2e, &(0x7f0000000400)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x8000, @remote}}}, 0x104) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_open_procfs(0x0, 0x0) 09:00:32 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:00:32 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:00:32 executing program 5: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000040)={'rose0\x00', &(0x7f0000000000)=@ethtool_channels={0x7a, 0x40, 0x0, 0x40}}) socket$inet(0x2, 0x0, 0x0) r0 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000080)='/dev/video0\x00', 0x2, 0x0) sendfile(r0, 0xffffffffffffffff, &(0x7f0000000180)=0x1, 0x8) r1 = getpid() r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3c) ptrace$cont(0x18, r2, 0x0, 0x0) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r2, 0x0, 0x0) syz_open_dev$adsp(0x0, 0x0, 0x0) r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$TIOCGSID(r3, 0x5429, &(0x7f00000002c0)) getpgrp(0x0) getpgid(0x0) memfd_create(&(0x7f0000000980)='lotrusted\x1a\x00\xee\xee\x91\xdc\x04>R\xba0Qe\x80\xe3}U\x01\xd0\xa9\xc9\xf1\xc9\x8d&\x90\xf6\x1a\x86\xd8\x02\xda6E\x17\xa9d\xcfcK\xfe\xf4\x99\xb7o\xff\at\xb6C\xef\x068\xcf\xd3\xb6\xbe\x98\x02\xa0\x90\xc8[\v\x93A\x7f\xc6\xa7\xcaEB\xb9\xaeS\x99\x86RI;\x0e\xf0\xcf\x9b\xff\x01\x00\x00\x00\x00\x00\x00\xc9\x85\xe2\xc9\x8bM\x1f\xcd%\x98\x16H\x9f\xbc\xb8\xd4\v', 0x5) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) ptrace(0x4206, r1) [ 427.131924][T14766] debugfs: Directory 'hsr0' with parent '/' already present! 09:00:32 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x2, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef00"/16], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) [ 427.225891][T14766] bridge0: port 2(bridge_slave_1) entered blocking state [ 427.233073][T14766] bridge0: port 2(bridge_slave_1) entered forwarding state [ 427.240412][T14766] bridge0: port 1(bridge_slave_0) entered blocking state [ 427.247490][T14766] bridge0: port 1(bridge_slave_0) entered forwarding state [ 427.328621][T14766] 8021q: adding VLAN 0 to HW filter on device bond0 [ 427.352362][T14775] create_pit_timer: 2 callbacks suppressed [ 427.352373][T14775] pit: kvm: requested 120685 ns i8254 timer period limited to 200000 ns [ 427.387301][T14775] pit: kvm: requested 120685 ns i8254 timer period limited to 200000 ns [ 427.415795][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 09:00:32 executing program 5: r0 = socket$kcm(0x2, 0x1, 0x84) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) setsockopt$sock_attach_bpf(r0, 0x84, 0x10, &(0x7f0000000ac0)=r1, 0x8) [ 427.432099][ T7613] bridge0: port 1(bridge_slave_0) entered disabled state [ 427.447724][ T7613] bridge0: port 2(bridge_slave_1) entered disabled state [ 427.504392][T14766] 8021q: adding VLAN 0 to HW filter on device team0 [ 427.541031][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 427.557121][ T7613] bridge0: port 1(bridge_slave_0) entered blocking state [ 427.564274][ T7613] bridge0: port 1(bridge_slave_0) entered forwarding state [ 427.571001][T14886] sctp: [Deprecated]: syz-executor.5 (pid 14886) Use of struct sctp_assoc_value in delayed_ack socket option. [ 427.571001][T14886] Use struct sctp_sack_info instead [ 427.628770][T14899] sctp: [Deprecated]: syz-executor.5 (pid 14899) Use of struct sctp_assoc_value in delayed_ack socket option. [ 427.628770][T14899] Use struct sctp_sack_info instead [ 427.661123][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 427.683640][ T7639] bridge0: port 2(bridge_slave_1) entered blocking state [ 427.690698][ T7639] bridge0: port 2(bridge_slave_1) entered forwarding state [ 427.741756][T14766] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 427.753167][T14766] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 427.766981][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 427.777375][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 427.786323][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 427.794954][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 427.806021][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 427.817308][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 427.831366][ T3012] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 427.852166][ T3012] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 427.862538][T14766] 8021q: adding VLAN 0 to HW filter on device batadv0 09:00:33 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ftruncate(0xffffffffffffffff, 0x2) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:00:33 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x2, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef00"/16], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:33 executing program 5: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) r0 = socket$inet(0x2, 0x0, 0x0) sendto$inet(r0, 0x0, 0x0, 0x0, 0x0, 0xb2) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) open(0x0, 0x0, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000b6dfc8)={0x500, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x2, 0x400000000000003, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[0x300000000000000, 0x0, 0x0, 0x6000000, 0x0, 0x0, 0x6000000, 0x40030000000000], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x7, 0xb}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @rand_addr="2d997e568b940344a40733b5e36b51d3"}}]}, 0x70}}, 0x0) pipe(0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) 09:00:33 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:00:33 executing program 3: ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000040)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000400)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000f5d000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x106], 0x1a000}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) r4 = fcntl$dupfd(0xffffffffffffffff, 0x0, r3) ioctl$IOC_PR_RELEASE(0xffffffffffffffff, 0x401070ca, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f00000001c0)={@multicast1, @multicast2}, 0x0) ioctl$KDGKBTYPE(0xffffffffffffffff, 0x4b33, &(0x7f0000000180)) sendmsg$nl_route_sched(r4, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x4) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) rmdir(&(0x7f00000002c0)='\x00') r5 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r5, 0x29, 0x2e, &(0x7f0000000400)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x8000, @remote}}}, 0x104) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_open_procfs(0x0, 0x0) 09:00:33 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef000000000000000000008500000017000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:33 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x2}]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) dup(0xffffffffffffffff) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 428.292746][T15037] fuse: Bad value for 'fd' [ 429.543588][ T7649] device bridge_slave_1 left promiscuous mode [ 429.549850][ T7649] bridge0: port 2(bridge_slave_1) entered disabled state [ 429.593601][ T7649] device bridge_slave_0 left promiscuous mode [ 429.599808][ T7649] bridge0: port 1(bridge_slave_0) entered disabled state 09:00:35 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:00:35 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r1, 0x0, r1) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r2, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 09:00:35 executing program 3: ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000040)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000400)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000f5d000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x106], 0x1a000}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) r4 = fcntl$dupfd(0xffffffffffffffff, 0x0, r3) ioctl$IOC_PR_RELEASE(0xffffffffffffffff, 0x401070ca, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f00000001c0)={@multicast1, @multicast2}, 0x0) ioctl$KDGKBTYPE(0xffffffffffffffff, 0x4b33, &(0x7f0000000180)) sendmsg$nl_route_sched(r4, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x4) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) rmdir(&(0x7f00000002c0)='\x00') r5 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r5, 0x29, 0x2e, &(0x7f0000000400)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x8000, @remote}}}, 0x104) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_open_procfs(0x0, 0x0) 09:00:35 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ftruncate(0xffffffffffffffff, 0x2) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:00:35 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef000000000000000000008500000017000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:35 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x2}]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) dup(0xffffffffffffffff) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:00:35 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef000000000000000000008500000017000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) [ 430.292208][ T7649] device hsr_slave_0 left promiscuous mode [ 430.331981][ T7649] device hsr_slave_1 left promiscuous mode [ 430.415884][ T7649] team0 (unregistering): Port device team_slave_1 removed [ 430.446919][ T7649] team0 (unregistering): Port device team_slave_0 removed 09:00:35 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r1, 0x0, r1) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r2, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) [ 430.494940][ T7649] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface 09:00:35 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x2}]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) dup(0xffffffffffffffff) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:00:35 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef00000000000000000000850000001700000095000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) [ 430.563500][ T7649] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface 09:00:35 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x2}]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) dup(0xffffffffffffffff) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 430.752884][ T7649] bond0 (unregistering): Released all slaves 09:00:36 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r1, 0x0, r1) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r2, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) [ 432.795416][T15208] IPVS: ftp: loaded support on port[0] = 21 [ 432.848095][T15208] chnl_net:caif_netlink_parms(): no params data found [ 432.873915][T15208] bridge0: port 1(bridge_slave_0) entered blocking state [ 432.881048][T15208] bridge0: port 1(bridge_slave_0) entered disabled state [ 432.888715][T15208] device bridge_slave_0 entered promiscuous mode [ 432.896118][T15208] bridge0: port 2(bridge_slave_1) entered blocking state [ 432.903226][T15208] bridge0: port 2(bridge_slave_1) entered disabled state [ 432.910741][T15208] device bridge_slave_1 entered promiscuous mode [ 432.926983][T15208] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 432.937850][T15208] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 432.955525][T15208] team0: Port device team_slave_0 added [ 432.962145][T15208] team0: Port device team_slave_1 added [ 433.014082][T15208] device hsr_slave_0 entered promiscuous mode [ 433.062294][T15208] device hsr_slave_1 entered promiscuous mode [ 433.101957][T15208] debugfs: Directory 'hsr0' with parent '/' already present! [ 433.115815][T15208] bridge0: port 2(bridge_slave_1) entered blocking state [ 433.122869][T15208] bridge0: port 2(bridge_slave_1) entered forwarding state [ 433.130129][T15208] bridge0: port 1(bridge_slave_0) entered blocking state [ 433.137274][T15208] bridge0: port 1(bridge_slave_0) entered forwarding state [ 433.166194][T15208] 8021q: adding VLAN 0 to HW filter on device bond0 [ 433.177733][ T3012] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 433.186003][ T3012] bridge0: port 1(bridge_slave_0) entered disabled state [ 433.193918][ T3012] bridge0: port 2(bridge_slave_1) entered disabled state [ 433.202464][ T3012] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 433.214668][T15208] 8021q: adding VLAN 0 to HW filter on device team0 [ 433.225072][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 433.233618][ T7704] bridge0: port 1(bridge_slave_0) entered blocking state [ 433.240631][ T7704] bridge0: port 1(bridge_slave_0) entered forwarding state [ 433.251296][ T3012] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 433.260047][ T3012] bridge0: port 2(bridge_slave_1) entered blocking state [ 433.267147][ T3012] bridge0: port 2(bridge_slave_1) entered forwarding state [ 433.283392][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 433.292605][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 433.303259][ T3012] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 433.317398][T15208] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 433.328227][T15208] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 433.340268][ T3012] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 433.348987][ T3012] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 433.357520][ T3012] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready 09:00:38 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:00:38 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef00000000000000000000850000001700000095000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:38 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x2}]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) dup(0xffffffffffffffff) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 433.379411][ T3012] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 433.404599][ T3012] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 433.420346][T15208] 8021q: adding VLAN 0 to HW filter on device batadv0 09:00:38 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ftruncate(0xffffffffffffffff, 0x2) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:00:38 executing program 3: r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) write(r0, 0x0, 0x0) 09:00:38 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:00:38 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef00000000000000000000850000001700000095000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:38 executing program 5: socketpair$unix(0x1, 0x40000000000001, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f00000002c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0xa, [@struct={0x8, 0x1, 0x0, 0xf, 0x0, 0x7, [{0xc, 0x0, 0x2}]}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2e]}}, &(0x7f0000000300)=""/250, 0x3a, 0xfa, 0x8}, 0x20) 09:00:38 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:00:38 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef000000000000000000008500000017000000950000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:38 executing program 3: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r1, 0x0, 0x0, 0x0, 0x0, 0xb2) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, &(0x7f0000000180), 0x4) open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents64(0xffffffffffffffff, 0x0, 0x12c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000b6dfc8)={0x500, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x2, 0x400000000000003, 0x0, 0x403, 0xf, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[0x300000000000000, 0x0, 0x0, 0x6000000, 0x0, 0x0, 0x6000000, 0x40030000000000], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @sadb_key={0x1, 0x9}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x7, 0xb}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @rand_addr="2d997e568b940344a40733b5e36b51d3"}}]}, 0x78}}, 0x0) bind$inet(r0, &(0x7f00000002c0)={0x2, 0x0, @local}, 0x10) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000600)={'filter\x00', 0x7, 0x4, 0x4a0, 0x118, 0x258, 0x258, 0x3b8, 0x3b8, 0x3b8, 0x4, &(0x7f00000001c0), {[{{@arp={@broadcast, @local, 0xffffff00, 0x0, @empty, {[0x0, 0xff, 0xff, 0x181]}, @mac=@local, {[0x0, 0x0, 0x0, 0x0, 0x0, 0xff]}, 0x4, 0x455, 0x3ff, 0x2960, 0x4, 0x0, 'veth1\x00', 'bridge0\x00', {}, {0xff}, 0x0, 0x29a}, 0xf0, 0x118}, @unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x7fff, 0x80000000}}}, {{@arp={@loopback, @dev={0xac, 0x14, 0x14, 0x23}, 0xff000000, 0x0, @mac=@remote, {[0x0, 0x0, 0x1fe]}, @empty, {[0xff, 0x0, 0x7f, 0xff, 0x0, 0x17e]}, 0x4, 0x20, 0x0, 0x6, 0xf44, 0x0, 'bridge_slave_0\x00', 'syz_tun\x00', {}, {}, 0x0, 0x80}, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@local, @mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @remote, @multicast1, 0x0, 0x80000000}}}, {{@uncond, 0xf0, 0x160}, @unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x800, 0x1800, 0x0, 0x0, 0x0, "46aee200d130d9b93ef6ea1ed7218a126eecf6c077e4ce0bd86dc591d1c3d9d12495a8da7069284647df1faaeb9cbaa89ea741772f8832240ee74967c0c487b7"}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x4f0) [ 433.923077][T15242] pit: kvm: requested 53638 ns i8254 timer period limited to 200000 ns [ 433.931824][T15242] pit: kvm: requested 103923 ns i8254 timer period limited to 200000 ns 09:00:39 executing program 3: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r1, 0x0, 0x0, 0x0, 0x0, 0xb2) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, &(0x7f0000000180), 0x4) open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents64(0xffffffffffffffff, 0x0, 0x12c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000b6dfc8)={0x500, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x2, 0x400000000000003, 0x0, 0x403, 0xf, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[0x300000000000000, 0x0, 0x0, 0x6000000, 0x0, 0x0, 0x6000000, 0x40030000000000], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @sadb_key={0x1, 0x9}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x7, 0xb}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @rand_addr="2d997e568b940344a40733b5e36b51d3"}}]}, 0x78}}, 0x0) bind$inet(r0, &(0x7f00000002c0)={0x2, 0x0, @local}, 0x10) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000600)={'filter\x00', 0x7, 0x4, 0x4a0, 0x118, 0x258, 0x258, 0x3b8, 0x3b8, 0x3b8, 0x4, &(0x7f00000001c0), {[{{@arp={@broadcast, @local, 0xffffff00, 0x0, @empty, {[0x0, 0xff, 0xff, 0x181]}, @mac=@local, {[0x0, 0x0, 0x0, 0x0, 0x0, 0xff]}, 0x4, 0x455, 0x3ff, 0x2960, 0x4, 0x0, 'veth1\x00', 'bridge0\x00', {}, {0xff}, 0x0, 0x29a}, 0xf0, 0x118}, @unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x7fff, 0x80000000}}}, {{@arp={@loopback, @dev={0xac, 0x14, 0x14, 0x23}, 0xff000000, 0x0, @mac=@remote, {[0x0, 0x0, 0x1fe]}, @empty, {[0xff, 0x0, 0x7f, 0xff, 0x0, 0x17e]}, 0x4, 0x20, 0x0, 0x6, 0xf44, 0x0, 'bridge_slave_0\x00', 'syz_tun\x00', {}, {}, 0x0, 0x80}, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@local, @mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @remote, @multicast1, 0x0, 0x80000000}}}, {{@uncond, 0xf0, 0x160}, @unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x800, 0x1800, 0x0, 0x0, 0x0, "46aee200d130d9b93ef6ea1ed7218a126eecf6c077e4ce0bd86dc591d1c3d9d12495a8da7069284647df1faaeb9cbaa89ea741772f8832240ee74967c0c487b7"}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x4f0) [ 434.050285][T15247] fuse: Bad value for 'fd' [ 435.272652][T12066] device bridge_slave_1 left promiscuous mode [ 435.278855][T12066] bridge0: port 2(bridge_slave_1) entered disabled state [ 435.322572][T12066] device bridge_slave_0 left promiscuous mode [ 435.328865][T12066] bridge0: port 1(bridge_slave_0) entered disabled state [ 436.022219][T12066] device hsr_slave_0 left promiscuous mode [ 436.061970][T12066] device hsr_slave_1 left promiscuous mode [ 436.108302][T12066] team0 (unregistering): Port device team_slave_1 removed [ 436.118906][T12066] team0 (unregistering): Port device team_slave_0 removed [ 436.129294][T12066] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 436.175557][T12066] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 436.254753][T12066] bond0 (unregistering): Released all slaves 09:00:41 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x20, r0, 0x0, 0x0) 09:00:41 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef000000000000000000008500000017000000950000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:41 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ftruncate(0xffffffffffffffff, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:00:41 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:00:41 executing program 3: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r1, 0x0, 0x0, 0x0, 0x0, 0xb2) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, &(0x7f0000000180), 0x4) open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents64(0xffffffffffffffff, 0x0, 0x12c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000b6dfc8)={0x500, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x2, 0x400000000000003, 0x0, 0x403, 0xf, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[0x300000000000000, 0x0, 0x0, 0x6000000, 0x0, 0x0, 0x6000000, 0x40030000000000], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @sadb_key={0x1, 0x9}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x7, 0xb}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @rand_addr="2d997e568b940344a40733b5e36b51d3"}}]}, 0x78}}, 0x0) bind$inet(r0, &(0x7f00000002c0)={0x2, 0x0, @local}, 0x10) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000600)={'filter\x00', 0x7, 0x4, 0x4a0, 0x118, 0x258, 0x258, 0x3b8, 0x3b8, 0x3b8, 0x4, &(0x7f00000001c0), {[{{@arp={@broadcast, @local, 0xffffff00, 0x0, @empty, {[0x0, 0xff, 0xff, 0x181]}, @mac=@local, {[0x0, 0x0, 0x0, 0x0, 0x0, 0xff]}, 0x4, 0x455, 0x3ff, 0x2960, 0x4, 0x0, 'veth1\x00', 'bridge0\x00', {}, {0xff}, 0x0, 0x29a}, 0xf0, 0x118}, @unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x7fff, 0x80000000}}}, {{@arp={@loopback, @dev={0xac, 0x14, 0x14, 0x23}, 0xff000000, 0x0, @mac=@remote, {[0x0, 0x0, 0x1fe]}, @empty, {[0xff, 0x0, 0x7f, 0xff, 0x0, 0x17e]}, 0x4, 0x20, 0x0, 0x6, 0xf44, 0x0, 'bridge_slave_0\x00', 'syz_tun\x00', {}, {}, 0x0, 0x80}, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@local, @mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @remote, @multicast1, 0x0, 0x80000000}}}, {{@uncond, 0xf0, 0x160}, @unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x800, 0x1800, 0x0, 0x0, 0x0, "46aee200d130d9b93ef6ea1ed7218a126eecf6c077e4ce0bd86dc591d1c3d9d12495a8da7069284647df1faaeb9cbaa89ea741772f8832240ee74967c0c487b7"}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x4f0) 09:00:41 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef000000000000000000008500000017000000950000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) [ 436.651675][T15276] pit: kvm: requested 25142 ns i8254 timer period limited to 200000 ns 09:00:41 executing program 3: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(r0, 0x8983, 0x0) [ 436.704791][T15276] pit: kvm: requested 140800 ns i8254 timer period limited to 200000 ns 09:00:41 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x20, r0, 0x0, 0x0) 09:00:42 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:00:42 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:00:42 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef00000000000000000000850000001700000095000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:42 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef00000000000000000000850000001700000095000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:42 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_int(r0, 0x11, 0x0, 0x0, 0x0) 09:00:42 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r2, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) [ 439.187978][T15425] IPVS: ftp: loaded support on port[0] = 21 [ 439.238329][T15425] chnl_net:caif_netlink_parms(): no params data found [ 439.263176][T15425] bridge0: port 1(bridge_slave_0) entered blocking state [ 439.270357][T15425] bridge0: port 1(bridge_slave_0) entered disabled state [ 439.278114][T15425] device bridge_slave_0 entered promiscuous mode [ 439.285985][T15425] bridge0: port 2(bridge_slave_1) entered blocking state [ 439.293084][T15425] bridge0: port 2(bridge_slave_1) entered disabled state [ 439.300987][T15425] device bridge_slave_1 entered promiscuous mode [ 439.317150][T15425] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 439.327715][T15425] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 439.346223][T15425] team0: Port device team_slave_0 added [ 439.353028][T15425] team0: Port device team_slave_1 added [ 439.404353][T15425] device hsr_slave_0 entered promiscuous mode [ 439.452273][T15425] device hsr_slave_1 entered promiscuous mode [ 439.502279][T15425] debugfs: Directory 'hsr0' with parent '/' already present! [ 439.516146][T15425] bridge0: port 2(bridge_slave_1) entered blocking state [ 439.523449][T15425] bridge0: port 2(bridge_slave_1) entered forwarding state [ 439.530699][T15425] bridge0: port 1(bridge_slave_0) entered blocking state [ 439.537822][T15425] bridge0: port 1(bridge_slave_0) entered forwarding state [ 439.567946][T15425] 8021q: adding VLAN 0 to HW filter on device bond0 [ 439.579025][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 439.587586][ T7704] bridge0: port 1(bridge_slave_0) entered disabled state [ 439.595920][ T7704] bridge0: port 2(bridge_slave_1) entered disabled state [ 439.605109][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 439.616370][T15425] 8021q: adding VLAN 0 to HW filter on device team0 [ 439.627385][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 439.635832][ T7639] bridge0: port 1(bridge_slave_0) entered blocking state [ 439.642934][ T7639] bridge0: port 1(bridge_slave_0) entered forwarding state [ 439.653240][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 439.661745][ T7704] bridge0: port 2(bridge_slave_1) entered blocking state [ 439.668805][ T7704] bridge0: port 2(bridge_slave_1) entered forwarding state [ 439.686726][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 439.695650][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 439.706987][ T7726] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 439.720466][T15425] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 439.731109][T15425] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 439.743489][ T7726] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 439.752292][ T7726] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 439.760553][ T7726] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 439.775175][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 439.782764][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 439.794191][T15425] 8021q: adding VLAN 0 to HW filter on device batadv0 09:00:45 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ftruncate(0xffffffffffffffff, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:00:45 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef00000000000000000000850000001700000095000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:45 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r2, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 09:00:45 executing program 3: fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) gettid() prctl$PR_TASK_PERF_EVENTS_DISABLE(0x1f) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPGRP(r0, 0x5410, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$EXT4_IOC_PRECACHE_EXTENTS(0xffffffffffffffff, 0x6612) timer_settime(0x0, 0x0, 0x0, 0x0) 09:00:45 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x20, r0, 0x0, 0x0) 09:00:45 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], 0x0, 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) [ 440.118712][T15441] pit: kvm: requested 119009 ns i8254 timer period limited to 200000 ns [ 440.133356][T15441] pit: kvm: requested 93028 ns i8254 timer period limited to 200000 ns [ 440.152639][T15441] pit: kvm: requested 8380 ns i8254 timer period limited to 200000 ns [ 440.163360][T15477] fuse: Bad value for 'fd' 09:00:45 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:00:45 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ftruncate(0xffffffffffffffff, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:00:45 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000000)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f00000002c0)={0x0, {{0xa, 0x0, 0x0, @mcast2}}}, 0x88) getsockopt$inet6_buf(r0, 0x29, 0x30, &(0x7f0000000000)=""/40, &(0x7f0000001000)=0xfffffffffffffff9) 09:00:45 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r2, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 09:00:45 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], 0x0, 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:45 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], 0x0, 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:45 executing program 3: semctl$SEM_STAT(0x0, 0x0, 0x12, &(0x7f0000000000)=""/129) 09:00:45 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:00:45 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:00:45 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) [ 441.512658][T12070] device bridge_slave_1 left promiscuous mode [ 441.518971][T12070] bridge0: port 2(bridge_slave_1) entered disabled state [ 441.572559][T12070] device bridge_slave_0 left promiscuous mode [ 441.578779][T12070] bridge0: port 1(bridge_slave_0) entered disabled state [ 442.232254][T12070] device hsr_slave_0 left promiscuous mode [ 442.312023][T12070] device hsr_slave_1 left promiscuous mode [ 442.357944][T12070] team0 (unregistering): Port device team_slave_1 removed [ 442.368076][T12070] team0 (unregistering): Port device team_slave_0 removed [ 442.378225][T12070] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 442.414802][T12070] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 442.492474][T12070] bond0 (unregistering): Released all slaves 09:00:48 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:00:48 executing program 3: 09:00:48 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:00:48 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:00:48 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:00:48 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:48 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:00:48 executing program 3: 09:00:48 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:48 executing program 3: 09:00:48 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:00:48 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:00:48 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:48 executing program 3: [ 445.591700][T15737] IPVS: ftp: loaded support on port[0] = 21 [ 445.641255][T15737] chnl_net:caif_netlink_parms(): no params data found [ 445.667383][T15737] bridge0: port 1(bridge_slave_0) entered blocking state [ 445.674676][T15737] bridge0: port 1(bridge_slave_0) entered disabled state [ 445.683089][T15737] device bridge_slave_0 entered promiscuous mode [ 445.690472][T15737] bridge0: port 2(bridge_slave_1) entered blocking state [ 445.697654][T15737] bridge0: port 2(bridge_slave_1) entered disabled state [ 445.705323][T15737] device bridge_slave_1 entered promiscuous mode [ 445.722541][T15737] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 445.733398][T15737] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 445.751086][T15737] team0: Port device team_slave_0 added [ 445.757698][T15737] team0: Port device team_slave_1 added [ 445.814027][T15737] device hsr_slave_0 entered promiscuous mode [ 445.852388][T15737] device hsr_slave_1 entered promiscuous mode [ 445.891982][T15737] debugfs: Directory 'hsr0' with parent '/' already present! [ 445.905792][T15737] bridge0: port 2(bridge_slave_1) entered blocking state [ 445.912871][T15737] bridge0: port 2(bridge_slave_1) entered forwarding state [ 445.920257][T15737] bridge0: port 1(bridge_slave_0) entered blocking state [ 445.927382][T15737] bridge0: port 1(bridge_slave_0) entered forwarding state [ 445.956308][T15737] 8021q: adding VLAN 0 to HW filter on device bond0 [ 445.967687][ T7726] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 445.975986][ T7726] bridge0: port 1(bridge_slave_0) entered disabled state [ 445.984402][ T7726] bridge0: port 2(bridge_slave_1) entered disabled state [ 445.993543][ T7726] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 446.005170][T15737] 8021q: adding VLAN 0 to HW filter on device team0 [ 446.016396][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 446.024806][ T7613] bridge0: port 1(bridge_slave_0) entered blocking state [ 446.031837][ T7613] bridge0: port 1(bridge_slave_0) entered forwarding state [ 446.042565][ T7726] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 446.051398][ T7726] bridge0: port 2(bridge_slave_1) entered blocking state [ 446.058475][ T7726] bridge0: port 2(bridge_slave_1) entered forwarding state [ 446.077497][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 446.086413][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 446.097548][ T7726] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 446.111617][T15737] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 446.122603][T15737] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 446.134989][ T7726] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 446.143595][ T7726] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 446.151748][ T7726] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 446.166490][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 446.173932][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 446.187671][T15737] 8021q: adding VLAN 0 to HW filter on device batadv0 09:00:51 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x20, r0, 0x0, 0x0) 09:00:51 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:51 executing program 4: mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r2, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 09:00:51 executing program 3: 09:00:51 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:00:51 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x20, r0, 0x0, 0x0) 09:00:51 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:51 executing program 3: [ 446.613656][T15764] fuse: Bad value for 'fd' 09:00:51 executing program 4: mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r2, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 09:00:51 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:00:51 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:00:51 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) 09:00:51 executing program 3: 09:00:52 executing program 4: mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r2, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 09:00:52 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) 09:00:52 executing program 3: 09:00:52 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) [ 447.942605][ T7688] device bridge_slave_1 left promiscuous mode [ 447.948876][ T7688] bridge0: port 2(bridge_slave_1) entered disabled state [ 447.992506][ T7688] device bridge_slave_0 left promiscuous mode [ 447.998901][ T7688] bridge0: port 1(bridge_slave_0) entered disabled state [ 448.692291][ T7688] device hsr_slave_0 left promiscuous mode [ 448.731991][ T7688] device hsr_slave_1 left promiscuous mode [ 448.798524][ T7688] team0 (unregistering): Port device team_slave_1 removed [ 448.808824][ T7688] team0 (unregistering): Port device team_slave_0 removed [ 448.819532][ T7688] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 448.855154][ T7688] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 448.941988][ T7688] bond0 (unregistering): Released all slaves 09:00:54 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x20, r0, 0x0, 0x0) 09:00:54 executing program 3: 09:00:54 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:00:54 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:00:55 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:00:55 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={0xffffffffffffffff, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:55 executing program 3: 09:00:55 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:00:55 executing program 3: 09:00:55 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={0xffffffffffffffff, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) 09:00:55 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:00:55 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={0xffffffffffffffff, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39}, 0x28) [ 451.873759][T15835] IPVS: ftp: loaded support on port[0] = 21 [ 451.925749][T15835] chnl_net:caif_netlink_parms(): no params data found [ 451.951449][T15835] bridge0: port 1(bridge_slave_0) entered blocking state [ 451.958742][T15835] bridge0: port 1(bridge_slave_0) entered disabled state [ 451.966628][T15835] device bridge_slave_0 entered promiscuous mode [ 451.974315][T15835] bridge0: port 2(bridge_slave_1) entered blocking state [ 451.981356][T15835] bridge0: port 2(bridge_slave_1) entered disabled state [ 451.989344][T15835] device bridge_slave_1 entered promiscuous mode [ 452.006097][T15835] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 452.016461][T15835] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 452.035090][T15835] team0: Port device team_slave_0 added [ 452.041624][T15835] team0: Port device team_slave_1 added [ 452.094268][T15835] device hsr_slave_0 entered promiscuous mode [ 452.132203][T15835] device hsr_slave_1 entered promiscuous mode [ 452.181992][T15835] debugfs: Directory 'hsr0' with parent '/' already present! [ 452.195936][T15835] bridge0: port 2(bridge_slave_1) entered blocking state [ 452.203014][T15835] bridge0: port 2(bridge_slave_1) entered forwarding state [ 452.210301][T15835] bridge0: port 1(bridge_slave_0) entered blocking state [ 452.217373][T15835] bridge0: port 1(bridge_slave_0) entered forwarding state [ 452.246774][T15835] 8021q: adding VLAN 0 to HW filter on device bond0 [ 452.258164][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 452.266692][ T7613] bridge0: port 1(bridge_slave_0) entered disabled state [ 452.274731][ T7613] bridge0: port 2(bridge_slave_1) entered disabled state [ 452.283780][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 452.295476][T15835] 8021q: adding VLAN 0 to HW filter on device team0 [ 452.306652][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 452.315112][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 452.322245][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 452.333326][ T3012] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 452.341669][ T3012] bridge0: port 2(bridge_slave_1) entered blocking state [ 452.348753][ T3012] bridge0: port 2(bridge_slave_1) entered forwarding state [ 452.366010][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 452.375062][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 452.386575][ T3012] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 452.398935][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 452.409587][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 452.419981][T15835] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 452.435009][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 452.442708][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 452.454043][T15835] 8021q: adding VLAN 0 to HW filter on device batadv0 09:00:57 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:00:57 executing program 3: 09:00:57 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:00:57 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd39}, 0x40) 09:00:58 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:00:58 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, 0xffffffffffffffff, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:00:58 executing program 3: mkdir(&(0x7f0000000140)='./file0\x00', 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) chdir(&(0x7f0000000180)='./file0\x00') r2 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f0000000180)='threaded\x00', 0x2d1ee37) unlink(&(0x7f0000000100)='./file0\x00') clone(0x20001000104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() prctl$PR_SET_PTRACER(0x59616d61, r3) mount(0x0, &(0x7f0000000300)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x82, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) creat(&(0x7f0000000040)='./file0\x00', 0x0) 09:00:58 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd39}, 0x40) 09:00:58 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:00:58 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) [ 453.106549][T15873] fuse: Bad value for 'fd' 09:00:58 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd39}, 0x40) 09:00:58 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, 0xffffffffffffffff, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:00:58 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:00:58 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:00:58 executing program 3: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)) chdir(0x0) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) write$cgroup_type(r0, &(0x7f0000000180)='threaded\x00', 0x2d1ee37) unlink(&(0x7f0000000100)='./file0\x00') clone(0x20001000104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() prctl$PR_SET_PTRACER(0x59616d61, r1) mount(0x0, &(0x7f0000000300)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) creat(&(0x7f0000000040)='./file0\x00', 0x0) 09:00:58 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0x0, 0x0, &(0x7f0000000140), 0x0, 0xd39}, 0x40) 09:00:58 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:00:58 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, 0xffffffffffffffff, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:00:58 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:00:58 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0x0, 0x0, &(0x7f0000000140), 0x0, 0xd39}, 0x40) [ 454.432332][ T7688] device bridge_slave_1 left promiscuous mode [ 454.438766][ T7688] bridge0: port 2(bridge_slave_1) entered disabled state [ 454.492391][ T7688] device bridge_slave_0 left promiscuous mode [ 454.498579][ T7688] bridge0: port 1(bridge_slave_0) entered disabled state [ 455.212247][ T7688] device hsr_slave_0 left promiscuous mode [ 455.261989][ T7688] device hsr_slave_1 left promiscuous mode [ 455.318492][ T7688] team0 (unregistering): Port device team_slave_1 removed [ 455.329023][ T7688] team0 (unregistering): Port device team_slave_0 removed [ 455.340554][ T7688] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 455.395714][ T7688] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 455.492551][ T7688] bond0 (unregistering): Released all slaves 09:01:01 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:01 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:01 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:01 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) r1 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:01 executing program 3: r0 = socket$unix(0x1, 0x5, 0x0) close(r0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0xe6) r2 = socket(0x11, 0x800000003, 0x0) bind(r2, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c58110308d9123127ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r2, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) bind$packet(r1, &(0x7f0000000140)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @broadcast}, 0x14) sendmmsg$inet(r0, &(0x7f0000001380)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000880)=[@ip_tos_int={{0x14}}], 0x18}}], 0x1, 0x0) 09:01:01 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0x0, 0x0, &(0x7f0000000140), 0x0, 0xd39}, 0x40) 09:01:01 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0x7, 0x0, &(0x7f0000000140)="54a2e72c79ee0e", 0x0, 0xd39}, 0x40) 09:01:01 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:01 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0x7, 0x0, &(0x7f0000000140)="54a2e72c79ee0e", 0x0, 0xd39}, 0x40) 09:01:01 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r1) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:01 executing program 3: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x800000000050000}]}) mount(&(0x7f0000000080)=ANY=[], 0x0, &(0x7f0000000100)='configfs\x00', 0x100000, 0x0) 09:01:01 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0x7, 0x0, &(0x7f0000000140)="54a2e72c79ee0e", 0x0, 0xd39}, 0x40) 09:01:01 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) [ 456.889490][T16254] pit: kvm: requested 77104 ns i8254 timer period limited to 200000 ns [ 456.917418][T16254] pit: kvm: requested 19276 ns i8254 timer period limited to 200000 ns [ 458.358661][T16262] IPVS: ftp: loaded support on port[0] = 21 [ 458.407599][T16262] chnl_net:caif_netlink_parms(): no params data found [ 458.431799][T16262] bridge0: port 1(bridge_slave_0) entered blocking state [ 458.439475][T16262] bridge0: port 1(bridge_slave_0) entered disabled state [ 458.447257][T16262] device bridge_slave_0 entered promiscuous mode [ 458.454846][T16262] bridge0: port 2(bridge_slave_1) entered blocking state [ 458.462162][T16262] bridge0: port 2(bridge_slave_1) entered disabled state [ 458.469988][T16262] device bridge_slave_1 entered promiscuous mode [ 458.487067][T16262] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 458.497628][T16262] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 458.516481][T16262] team0: Port device team_slave_0 added [ 458.523163][T16262] team0: Port device team_slave_1 added [ 458.584113][T16262] device hsr_slave_0 entered promiscuous mode [ 458.652325][T16262] device hsr_slave_1 entered promiscuous mode [ 458.691988][T16262] debugfs: Directory 'hsr0' with parent '/' already present! [ 458.705892][T16262] bridge0: port 2(bridge_slave_1) entered blocking state [ 458.712957][T16262] bridge0: port 2(bridge_slave_1) entered forwarding state [ 458.720254][T16262] bridge0: port 1(bridge_slave_0) entered blocking state [ 458.727299][T16262] bridge0: port 1(bridge_slave_0) entered forwarding state [ 458.757849][T16262] 8021q: adding VLAN 0 to HW filter on device bond0 [ 458.768735][ T3012] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 458.776960][ T3012] bridge0: port 1(bridge_slave_0) entered disabled state [ 458.784887][ T3012] bridge0: port 2(bridge_slave_1) entered disabled state [ 458.793968][ T3012] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 458.805323][T16262] 8021q: adding VLAN 0 to HW filter on device team0 [ 458.815958][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 458.824691][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 458.831710][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 458.842754][ T3012] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 458.851184][ T3012] bridge0: port 2(bridge_slave_1) entered blocking state [ 458.858272][ T3012] bridge0: port 2(bridge_slave_1) entered forwarding state [ 458.874854][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 458.883895][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 458.895348][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 458.907840][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 458.918547][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 458.928675][T16262] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 458.942612][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 458.950103][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 458.960736][T16262] 8021q: adding VLAN 0 to HW filter on device batadv0 09:01:04 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:04 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xb, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdf", 0x0, 0xd39}, 0x40) 09:01:04 executing program 3: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x800000000050000}]}) mount(&(0x7f0000000080)=ANY=[], &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) 09:01:04 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:04 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) r1 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:04 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xb, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdf", 0x0, 0xd39}, 0x40) [ 459.325662][T16284] pit: kvm: requested 184381 ns i8254 timer period limited to 200000 ns [ 459.346269][T16284] pit: kvm: requested 46095 ns i8254 timer period limited to 200000 ns 09:01:04 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xb, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdf", 0x0, 0xd39}, 0x40) [ 459.431417][T16292] fuse: Bad value for 'fd' 09:01:04 executing program 3: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x800000000050000}]}) mount(0x0, 0x0, &(0x7f0000000100)='configfs\x00', 0x100000, &(0x7f0000000140)='\x00') 09:01:04 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r1) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:04 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:04 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) r1 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:04 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xd, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36d", 0x0, 0xd39}, 0x40) [ 460.642620][ T7649] device bridge_slave_1 left promiscuous mode [ 460.648937][ T7649] bridge0: port 2(bridge_slave_1) entered disabled state [ 460.702608][ T7649] device bridge_slave_0 left promiscuous mode [ 460.708821][ T7649] bridge0: port 1(bridge_slave_0) entered disabled state [ 461.402475][ T7649] device hsr_slave_0 left promiscuous mode [ 461.452008][ T7649] device hsr_slave_1 left promiscuous mode [ 461.499409][ T7649] team0 (unregistering): Port device team_slave_1 removed [ 461.509941][ T7649] team0 (unregistering): Port device team_slave_0 removed [ 461.519961][ T7649] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 461.585762][ T7649] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 461.662767][ T7649] bond0 (unregistering): Released all slaves 09:01:07 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:07 executing program 3: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x800000000050000}]}) mount(0x0, 0x0, &(0x7f0000000100)='configfs\x00', 0x100000, &(0x7f0000000140)='\x00') 09:01:07 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r1) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:07 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xd, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36d", 0x0, 0xd39}, 0x40) 09:01:07 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:07 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:07 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xd, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36d", 0x0, 0xd39}, 0x40) 09:01:07 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:07 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r2, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 09:01:07 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000000)=@ipx, 0x80, 0x0, 0x0, 0x0, 0xfffffec5}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000280)='mountstats\x00') preadv(r0, &(0x7f00000017c0), 0x1b4, 0x0) 09:01:07 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0}, 0x40) 09:01:07 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r2, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 09:01:07 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0}, 0x40) 09:01:08 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000000)=@ipx, 0x80, 0x0, 0x0, 0x0, 0xfffffec5}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000280)='mountstats\x00') preadv(r0, &(0x7f00000017c0), 0x1b4, 0x0) [ 463.024533][T16454] pit: kvm: requested 35200 ns i8254 timer period limited to 200000 ns [ 463.051967][T16454] pit: kvm: requested 158400 ns i8254 timer period limited to 200000 ns [ 463.092397][T16454] pit: kvm: requested 107276 ns i8254 timer period limited to 200000 ns [ 463.130654][T16454] pit: kvm: requested 152533 ns i8254 timer period limited to 200000 ns [ 464.648401][T16467] IPVS: ftp: loaded support on port[0] = 21 [ 464.698442][T16467] chnl_net:caif_netlink_parms(): no params data found [ 464.723416][T16467] bridge0: port 1(bridge_slave_0) entered blocking state [ 464.730508][T16467] bridge0: port 1(bridge_slave_0) entered disabled state [ 464.738352][T16467] device bridge_slave_0 entered promiscuous mode [ 464.748594][T16467] bridge0: port 2(bridge_slave_1) entered blocking state [ 464.755733][T16467] bridge0: port 2(bridge_slave_1) entered disabled state [ 464.763519][T16467] device bridge_slave_1 entered promiscuous mode [ 464.780246][T16467] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 464.790810][T16467] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 464.808556][T16467] team0: Port device team_slave_0 added [ 464.815127][T16467] team0: Port device team_slave_1 added [ 464.873721][T16467] device hsr_slave_0 entered promiscuous mode [ 464.912402][T16467] device hsr_slave_1 entered promiscuous mode [ 464.951969][T16467] debugfs: Directory 'hsr0' with parent '/' already present! [ 464.965308][T16467] bridge0: port 2(bridge_slave_1) entered blocking state [ 464.972367][T16467] bridge0: port 2(bridge_slave_1) entered forwarding state [ 464.979580][T16467] bridge0: port 1(bridge_slave_0) entered blocking state [ 464.986734][T16467] bridge0: port 1(bridge_slave_0) entered forwarding state [ 465.015535][T16467] 8021q: adding VLAN 0 to HW filter on device bond0 [ 465.026230][ T3012] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 465.034598][ T3012] bridge0: port 1(bridge_slave_0) entered disabled state [ 465.042733][ T3012] bridge0: port 2(bridge_slave_1) entered disabled state [ 465.051571][ T3012] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 465.063484][T16467] 8021q: adding VLAN 0 to HW filter on device team0 [ 465.073655][ T7726] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 465.081976][ T7726] bridge0: port 1(bridge_slave_0) entered blocking state [ 465.089028][ T7726] bridge0: port 1(bridge_slave_0) entered forwarding state [ 465.099545][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 465.108142][ T7639] bridge0: port 2(bridge_slave_1) entered blocking state [ 465.115255][ T7639] bridge0: port 2(bridge_slave_1) entered forwarding state [ 465.134925][ T7726] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 465.143689][ T7726] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 465.152745][ T7726] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 465.162677][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 465.174237][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 465.184080][T16467] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 465.198393][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 465.205777][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 09:01:10 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:10 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0}, 0x40) 09:01:10 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r2, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) [ 465.216195][T16467] 8021q: adding VLAN 0 to HW filter on device batadv0 09:01:10 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39, 0x0, 0x0, 0x0, 0x0}, 0x40) 09:01:10 executing program 3: socket$inet(0x2, 0x80a, 0x0) perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r0, &(0x7f0000000040)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @loopback}}, 0x24) sendmmsg(r0, &(0x7f0000005c00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000001001000001000000770000f200000000a6e217b91c3b0d873722b41a118fd58fa1f0a39ad9582203daa32c9831699acc52f141eeca2bd12d2f6fb54e5bff40e062a43f80b1babfd076d2502892250deee2728316e63e589ddf142e89365bd48cf76602c6f6aa76bc37284732bd1e191ddd3c9f310f827c195f3c4957c67a08466517ba136c8c9e01000000f8ffffffffffffff3e26b5ca26bb434dbd0e5085c294e577bb081876e63e7c2834533925db8b54b33da7b947aefca1f9c49c648d58d4f944264fcace71d5c798cd3c13d7083a7eb4c526e072a23bd24cccb38e4eff542520858c940fbb95979a564d73a7af107fd5ddaa491838873914a467c3ce28056833eb4559864317c0a1dac92d090f4f9093679791a2840f2851324acdf44a807e69a1bc25d265303004e8ead128a3d61c0063233501cfdf76d99dbc46b9c00203a9161b8a444001c386475c432c7a6e898885429063954ea0bdf9abc7b9322f3485d99ab38a3231ea08584795647ddb75c593933ef3e588824acdab292482735cd91572d0bc3f95b61e039183f5ed7cb75f2ba79296f73ca6f00a0f6ce5c2bc03957a77dbd229921124580fc4ddd4aa3f3752c7f2dca3da2ba7b772e01215f05dc1cf74ddf51af1a4ebba443374e09d5ff96db1a1a60368493ff3"], 0x18}}], 0x1, 0x4048000) close(r0) [ 465.612946][T16499] syz-executor.3 uses obsolete (PF_INET,SOCK_PACKET) 09:01:10 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:10 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39, 0x0, 0x0, 0x0, 0x0}, 0x40) 09:01:10 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:10 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:10 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:10 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39, 0x0, 0x0, 0x0, 0x0}, 0x40) 09:01:10 executing program 3: socket$inet(0x2, 0x80a, 0x0) perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r0, &(0x7f0000000040)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @loopback}}, 0x24) sendmmsg(r0, &(0x7f0000005c00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000001001000001000000770000f200000000a6e217b91c3b0d873722b41a118fd58fa1f0a39ad9582203daa32c9831699acc52f141eeca2bd12d2f6fb54e5bff40e062a43f80b1babfd076d2502892250deee2728316e63e589ddf142e89365bd48cf76602c6f6aa76bc37284732bd1e191ddd3c9f310f827c195f3c4957c67a08466517ba136c8c9e01000000f8ffffffffffffff3e26b5ca26bb434dbd0e5085c294e577bb081876e63e7c2834533925db8b54b33da7b947aefca1f9c49c648d58d4f944264fcace71d5c798cd3c13d7083a7eb4c526e072a23bd24cccb38e4eff542520858c940fbb95979a564d73a7af107fd5ddaa491838873914a467c3ce28056833eb4559864317c0a1dac92d090f4f9093679791a2840f2851324acdf44a807e69a1bc25d265303004e8ead128a3d61c0063233501cfdf76d99dbc46b9c00203a9161b8a444001c386475c432c7a6e898885429063954ea0bdf9abc7b9322f3485d99ab38a3231ea08584795647ddb75c593933ef3e588824acdab292482735cd91572d0bc3f95b61e039183f5ed7cb75f2ba79296f73ca6f00a0f6ce5c2bc03957a77dbd229921124580fc4ddd4aa3f3752c7f2dca3da2ba7b772e01215f05dc1cf74ddf51af1a4ebba443374e09d5ff96db1a1a60368493ff3"], 0x18}}], 0x1, 0x4048000) close(r0) [ 465.817357][T16616] fuse: Bad value for 'fd' 09:01:11 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:11 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:11 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39, 0x0, 0x0, 0x0, &(0x7f0000000000), 0x0}, 0x40) 09:01:11 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) pipe(&(0x7f00000006c0)) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:11 executing program 3: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 09:01:11 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39, 0x0, 0x0, 0x0, &(0x7f0000000000), 0x0}, 0x40) [ 466.243047][T16639] pit: kvm: requested 103923 ns i8254 timer period limited to 200000 ns 09:01:11 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000ef0000000000000000000085000000170000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="54a2e72c79ee0e93fdacdfc36de4", 0x0, 0xd39, 0x0, 0x0, 0x0, &(0x7f0000000000), 0x0}, 0x40) 09:01:11 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:11 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) [ 466.587717][T16752] pit: kvm: requested 117333 ns i8254 timer period limited to 200000 ns [ 466.605579][T16752] pit: kvm: requested 119847 ns i8254 timer period limited to 200000 ns [ 466.616613][T16752] pit: kvm: requested 67885 ns i8254 timer period limited to 200000 ns [ 466.628616][T16752] pit: kvm: requested 142476 ns i8254 timer period limited to 200000 ns [ 467.232504][T12070] device bridge_slave_1 left promiscuous mode [ 467.238713][T12070] bridge0: port 2(bridge_slave_1) entered disabled state [ 467.282682][T12070] device bridge_slave_0 left promiscuous mode [ 467.289007][T12070] bridge0: port 1(bridge_slave_0) entered disabled state [ 467.952276][T12070] device hsr_slave_0 left promiscuous mode [ 467.991991][T12070] device hsr_slave_1 left promiscuous mode [ 468.058768][T12070] team0 (unregistering): Port device team_slave_1 removed [ 468.068979][T12070] team0 (unregistering): Port device team_slave_0 removed [ 468.079712][T12070] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 468.125169][T12070] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 468.214343][T12070] bond0 (unregistering): Released all slaves 09:01:13 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:13 executing program 1: r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000011700)='./file0\x00', 0xf7412864b454e274) 09:01:13 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:14 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:14 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=@ipv4_newrule={0x34, 0x20, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, [@FRA_GENERIC_POLICY=@FRA_IIFNAME={0x14, 0x3, 'lapb0\x00'}]}, 0x34}}, 0x0) 09:01:14 executing program 4: openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r2, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 09:01:14 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x4d}]}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 09:01:14 executing program 4: openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r2, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 09:01:14 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) open(0x0, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r2, r2, &(0x7f0000000180)=0x74000000, 0x5) 09:01:14 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:14 executing program 4: openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r2, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 09:01:14 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x3}) [ 471.023401][T16903] IPVS: ftp: loaded support on port[0] = 21 [ 471.076441][T16903] chnl_net:caif_netlink_parms(): no params data found [ 471.103227][T16903] bridge0: port 1(bridge_slave_0) entered blocking state [ 471.110586][T16903] bridge0: port 1(bridge_slave_0) entered disabled state [ 471.118471][T16903] device bridge_slave_0 entered promiscuous mode [ 471.126098][T16903] bridge0: port 2(bridge_slave_1) entered blocking state [ 471.133360][T16903] bridge0: port 2(bridge_slave_1) entered disabled state [ 471.141402][T16903] device bridge_slave_1 entered promiscuous mode [ 471.158721][T16903] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 471.170010][T16903] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 471.188466][T16903] team0: Port device team_slave_0 added [ 471.195169][T16903] team0: Port device team_slave_1 added [ 471.274051][T16903] device hsr_slave_0 entered promiscuous mode [ 471.312402][T16903] device hsr_slave_1 entered promiscuous mode [ 471.352004][T16903] debugfs: Directory 'hsr0' with parent '/' already present! [ 471.366583][T16903] bridge0: port 2(bridge_slave_1) entered blocking state [ 471.373899][T16903] bridge0: port 2(bridge_slave_1) entered forwarding state [ 471.381503][T16903] bridge0: port 1(bridge_slave_0) entered blocking state [ 471.388573][T16903] bridge0: port 1(bridge_slave_0) entered forwarding state [ 471.418892][T16903] 8021q: adding VLAN 0 to HW filter on device bond0 [ 471.430157][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 471.439250][ T7639] bridge0: port 1(bridge_slave_0) entered disabled state [ 471.447487][ T7639] bridge0: port 2(bridge_slave_1) entered disabled state [ 471.456792][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 471.468916][T16903] 8021q: adding VLAN 0 to HW filter on device team0 [ 471.479629][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 471.488257][ T7704] bridge0: port 1(bridge_slave_0) entered blocking state [ 471.495472][ T7704] bridge0: port 1(bridge_slave_0) entered forwarding state [ 471.506905][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 471.515545][ T7639] bridge0: port 2(bridge_slave_1) entered blocking state [ 471.522614][ T7639] bridge0: port 2(bridge_slave_1) entered forwarding state [ 471.544003][ T7726] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 471.553067][ T7726] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 471.562048][ T7726] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 471.570448][ T7726] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 471.581556][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 471.591524][T16903] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 471.606671][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 471.614798][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 471.627109][T16903] 8021q: adding VLAN 0 to HW filter on device batadv0 09:01:16 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) r1 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:16 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x16}], 0xaaaaaaaaaaaae2f, 0x0, 0x0, 0xffa3) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:01:16 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:16 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:16 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10, 0x0}}], 0x1, 0x0) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:16 executing program 1: r0 = syz_open_dev$dspn(&(0x7f0000000100)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000040)=0x10000000006) r1 = perf_event_open(&(0x7f0000000980)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$UHID_INPUT(r0, &(0x7f00000002c0)={0x8, "b13e1c20d1764d052a4289a71186ca1abfa7f39eb694f4602948f6585c3542ac42cb2f94b098e98f2bcd6128dab4a71d544e96e01e3a9a3548ee5f554c06d963346edb9d133e86fdd31c21e9aaffeb52f7cd63297b1fd0db1845e12bda3ce00f0cca0e6ac9c42a61e687c24c0553b408359c86c7bfd7a30944ac327f982b011258e85ee00f050c38e73199d07b72b225a96ab0fb5a9ea944a233e46cd4c25aaa0fe04bd9b3203f61a06c8f094563ffa0078e50248ce1acebc03c75069eb1cb20ebbe30ec063f9ebc45290dc4f8b56ebb08d32e4df04785fd385029f766a0b96db6a1b6615de63393fe97082c076a7170d2b1c06ce0627d6acae850c2b95f38b079a352f27bf6f5460078b8e597c1d3bdb5cf9e73f42eec5aea224ab44b94e18e812864faeaf770ba7471f99b07d41d573d1d4c3833fb4410ea36d710bfa66ccdb14a1927a678f873b023e82c341a43704adb37242a67b2a46d02ab7aee23cf3030a2f3dd58eece667b6e9393ee8d36649e37e83b1c73c0ef65b4df6173c1c25324fbb9afa1361dc4275f152deb03d7138a688eb9dc66e7845ce1be5647bf740b0e1dd038120ef1e3e1cf420cf8b723bef771376e433935e4f9096a10c4a969aceaac4791c41f365b274dab49bddf51b22a24c05ceaedcbf45febc927e98f410d38247d7679cee7b0d3041eaebd7821924ad31e7c5137bf87ce1ec537a981779f0a4c57bbbb5c641cfd02e1e3904f48b0be96fc9851b6bc8c4260168eea9d9d111e2777f78a9021d5eb0166e39410bf279656770263ca2fb7ac0e30d5e168f8cf4bc5665d057da939b770568e41d0fcec5d6aac0bf4ae66fb099b786cdce7f6a9bc00b83d8ed72440a9724d4ef8af71c7efbc31397930cdcb99d30502ecbcc7ddb9161ade16a1badbd7ea3c6c65b387b46234c4660c816506a2f76264bba07ecb685532116bd971464b58e3ea0a29c2fa1d49d9c6308806db01326e9a1b6bbb556f6479b29f48718e211d75f08d0fb477ad8dae5aeaad7e176b2c5ae331ef78212e9dd7e506549dc74ffd940dc91d74aee2fa7f28855919c163f443804e2a072ad8add2be84df87e414afcab0f8e6f67d3ebb1778a6798d50233da09d29b95c0da97304b7a025e50a7c89e614c63bc69477bfe0e5ae2c468332d134f9e22b19eb2f01c8e8d5148b9b980f8b9aa0cab9ba89aafe16d6a8cf9cb5ae659d8fba88e2841f3d6ac0c44dd9f03787d357fe31a4f551e247bfb73b1f2aa1e208c36aa90dcfc4da8877967c05fe951716ec2293d79c6083e79061bbe18150e2af1d889bb4e87c7735b0e7b88a3109a906d1bd4bf9b98c2462420ecc4e9f3a274a6678bc56e9aa7f3d64677141f874f35d00d04a1dc83126ccd69a0221305a3a5418ec24e163b165c1e4533c38f3d213de4012aece68ed11e2f42325d6da5eef78ee985f81a7991e3d1ff69188059c292779579418ef81177fa94b43cdd0fbf92d31f0fb592a864ddc98ddd5b49ece865e7c7a6c873169d0eea46c1a44f645b1cfa40849ffb9f5355ab396dc1a875180f17103be63be4e7d1920949c59ba5d47341c176ac307e165b9733ac5cd9e9691f5ecd76b467881b78f217d50903a06c57270f4104fd26d496dd7e08c27209185761882923f6447c73d53a74e28132e6bf97ee4f2df9d03be88653a9a7251d8df247f1a75f91f95886ce317e3c125aa7686eec86708fa72c9b33a664e76c0ed891ff9d840ac121ae3f96d32330a14fd76df19c7ae0434e2103d6e9175da0b6cc7a007a0a18615271771434959de305636cf7fbfdd16239bff7dbc656a702ebd48f9a2b1937cca80604ec525d292bb7337459235ad047c6933b6c81bd966ea60ec863de568a9e6d8e0378916f441e0f8b2b74df49b9b24094fd643413469428a537aed19b72bf9381ebab4cd57400ecad1cf1b792e9610910d02f9a779b009840e3f1a1395a87f1e590c33018be80a3f34bbaf49e415ba7d3858b40788cd19211b8cad3789870fb252f8991d64bff9558a67a2316ec2402c2f9c52de42e6389fc90bc4379f7b899b1a943035d64f20b7766edf08fdfa185d00493031f0d3f9ad7dce841f725c5adcba896a76857918a2f54c8aa2e50f71eda35b8fea3732a02c146201ad9f4b65b7caa09e2a73f72aee1ce428a35489038d5cc859fbd48be8da5d088ccab897a248fe418b89b409ab5507af725f077d264abec5b53667ca06aed03815dd537535a3360a50ca3d09c025b5057362c7cb5a4b99c58ac64fe813f4d7f2cafbc3048835ec43fa68170ec7310342134c9b5ec417763db145555cdd37f24b27b0911d172710b74d3c754aac02b24030166cbf2eccfaf1e909b629b7919db1351cd0167e8b6bddc5ce4b7e13cbf0c095f636427d440d058e7637eb117947fc6a60942d10bd455030ee38fc447fd3e6232efba65def558dcff60274e6b2ad62464b4f767bcfec22c681c12bdabf1fedc3946f45c9a34a9169f79ea60a9d190dcf1ce14957382af602dd134b610b269247f38c3d4e233f2fda399dc4cf09139cff9e9c731f8bf940df3cbdf9355f604bd0f3d3b20a6cfc39a7d9ff74f734750187b30c1a970a432bf7e9417cc87d8dea00c4e1885845e1a59bc6a5487687c5bca514e9dcf372bcdc0fe4a47f3e4ac456b1a812e69f88b2a8a964d946cc102ba6f3a7c965df24653c6384d810cf157c8581d4b40e874aded8d227a25fab9889f02698bf52980f048408de4a96226949eba5d1b7f41fce61ae1ff9388e096646ddda4c222f7b9bffc1d3e5b645b6e248637698f6a5be1dc03ff7aa9f418153beeef9b9d67ac5b6fc888e5adf0db41a6d5cac2b600af3b428a1294f4fdb4cf64ccc254c1c7ef71b9be3afceb797fc9504bc3f3dde217687d47cd445c44bea2b16eacae76f16d868b77065b189bd7c4678f3a5fc99b4d020d42972d010b7a6b22de46b434f2d8ec4f567af2d531817ec81ffa36cc27d073a66d2152f1be2a8dce08e98a00f473f22e680cf0ebdcf37936cee60f99eec69503a15d8e36f8d599b535021693fb52f9dc93e315d6e849bd4bf9d05fb25f0b09de91b73ca4edfbfa04d9262d449eab2be542ea30f316384609efc52ed641a9e32d48e4a57c65e8bfa5c13e769d5402a0b125c17360800bf0da8592a75abe647f1d9b1072942947da82e701308b60ecdcfd40d7b6cf44b443493ef0466790547c0a8e5914484969e52cba3787c41df965f91ed7074cd62a63db7e1c35b8f9ac30521295ae7b9c81143926f1dd36aefdfbcd7056b0d4209cabe113a18c58ecc062df687666725707029a8be3ef5721484bd429bab33fceb76c6a0f079da8819d0d9565f5e4ed45eb531f9501b85b619b5323169b0297b7cedcf6f288225dd5e6a7f52c1b96cd38dd94b2f6b8cfc6dbd7862901a5295dca5ecbae72344f41c4a222bd6711831d265b910d547501116bcfbf3c9e104b446175c4c8a4e56445ca22f9363f0f54858a8eb4a1c43103bca578c5b0ee372efd705a950510dbbfa4f74c8ddb4bbc1f07dd410ebb39c01f4da8a0bad2d3d35df3a12a9fa2daf44c8163d59aba8a7351ecc9fe4cd25b987dba700e73d7174307161adf70db0e7a802d7c9ec1b912ee58b0a35c2c6f40f112d70ab5aa708071379280c9ffbceaf0a4ec45c89ac0bf3ef40538302b685e24574da8bde8654e99eff66c9ad5e6beafa0e48e1c293c53d955980346cbc052d15e5d1f3baed388dfaa72ca089af06ae757466a704b93a0ff13cb5c722f0b872432a4fd4513ed56825b13ddd4d8c02eb624c8358199f52679421ab0e1792869f6b4aea523a1079b3138f1ef761c6df102096eff43ddb23ee668b9cc5161433feb318903b58387c3dae2833a8c770e7c6e27c31a1fca07377fbb07f11911be6192f7518a8d089b89826e48b28f5c8a00784bef9b2f68c90838eb2c9fcaeda4bb76782510082c977a7ecdd5743e9da8f088a3b67a25cfb25db4a709b6cbf5425e7efa8c2e472464606d9ccd2fc0f73cd1d51a5aa19d9caba10be2147f8e1ad763ba45693f9f078b0716cf588142be847ca67dc132c5782fed12b7d95c55a9bcfdfb85cb48698a45621cc2f1c85559617ece7def71486290b0cf8e987e8788e1a13f17e3f24b93ed2009ebe42e3bea9571f98b39b787c107dcada3a36fa1fe93736e74ec34af80a182cf0adf2846577f1d474c9ff1b4b8a2cfe6a2d445029ca77088b9c84be63655d48cbc5f61b18d7cda0d141f2db6bc3c479aa6ca19638e2c37da38768eb8820e5679345d2abe8033318eb952e297e17dacaaee3df7ef1d6cd554e9b1b453c44e3d4e030e25c5f9ed094100f6d9b1dc5dab371436ab252cc4d7fdf8fe4b7f36ab71f2bbe3878217b151664c3b9ae970e473ae164d77f294ca8ad58634ea446880e8327fc7af2a088e39508443a601eaa00742a7d0ad459dcac24a60edcfa6ac9f72f428c2b8dd30b8278e28f25a1a129d23cacd765de4c4aa52819578951bb8e311e8621f627e3463e2562b6dbc8d1c431c240f1424599438b9c94723f79ffd1fa1bc94104e4598bd43244302f86ddbe47ad8671e25f406aa507ba45bdba09841827a697cece002f79ec7cf14488789d754f84818d180bd04a11cb2115441a402bea2be749ef233bcd26ca27df828ada877a893e54ea3e6ea29e62d6e7693af7cbee59ccdb4045d0e6eeec3d8f59205f324a5f7cf5f871929c83ada04bc5d3990288dca5eb312339933ffb1031e05866e1b2d0aad0ca940795458b7d6c8a3750a76e1e6c8ccd48ca542d6c51164431d70c9d35f0f828cdec404a175a44bc2a9651ec5281c0f3aee9e4375f0eb139f58fa4419fddf9ebe2f8f37121a57397e7e830ac097ed375521a68f7cdc471621b769fef40cd19d8d55a82e27bf5b0cc4182359db7c9066e2ee10df279a89e96fcfea225995f065f7f286b8c8ef9b6c82a34df14dda2f737f557578ce5b15944e3149110102d80465c1b436b6bbb16fdc64a9d130ec7644bc162f0e2c5669a9254970a062561e269d85b72b4748d71d88ca20778287bc3b9613043166862f133f366f6361b9e1d040bbcd9728a70fcf3be7ea8fe0f55980ed03f336ec49f7cb6899813acf47d3b2413e7b637b764fcb9003ece75f8a255b9cdc71f80dbbaa7eaa2111b5551feeb7ea31620a2c88897538915abedcd184d57c79d81505985f561820449c330bc3412bffb68c4c743c5a5a3acafcf00d7561a66f70e5835da530ba62f221211e1fefdc1fbc8c05b1b68b7eb2afac6ebbbc0b961b8ef8b27b555ce7641f6601ac19d5f4adb06b40155a2085ff32de5b2c5edd96a01a14d1bb49b58f1fd718bec428043819b8070e46f0215d2153318320754638d9b40a5214784e7c1f80dde05500cfe8e4dff855504e099634fb3d44829453cf4ac8db7e5a4144f96d4508de90ada04240637fd5b261cfbb80c8d9ccdea6c1d3485a85663cff9749133002c7f9c6ea4de1b50fe90dae397f6b5833e943e6c5f60e10d805e97e6869488b857b44d8c94276f668257c223e2e26dff75222d3f304f8a040ce058e1b7b3bc5f0b69c310beea64212ef0a54bc9fb858c25681cee574c532b64d4f8241e0b855f7f79d0a1ea22fc3d9ad5a1658b5c4d9d417e9eae47c81628341172609a8ef8c72fb6e4e48da6a10207e56b727f65c82d49e2dbb44b492e1265c2b28f98980334ccc3abb0cfd15d73c2f38f4c824022aa7a0ac0b7d35eea934d3455d21e8c710474e54bdf29be107ebc00", 0xa943708f26830065}, 0x1006) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) dup3(r1, r0, 0x0) 09:01:17 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:17 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x3c) ptrace$cont(0x18, 0x0, 0x0, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, 0x0, 0x0, 0x0) [ 472.085736][T16942] fuse: Bad value for 'fd' 09:01:17 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x3c) ptrace$cont(0x18, 0x0, 0x0, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, 0x0, 0x0, 0x0) 09:01:17 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x16}], 0xaaaaaaaaaaaae2f, 0x0, 0x0, 0xffa3) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:01:17 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:17 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) [ 473.382861][T10721] device bridge_slave_1 left promiscuous mode [ 473.389427][T10721] bridge0: port 2(bridge_slave_1) entered disabled state [ 473.442710][T10721] device bridge_slave_0 left promiscuous mode [ 473.449319][T10721] bridge0: port 1(bridge_slave_0) entered disabled state [ 474.132590][T10721] device hsr_slave_0 left promiscuous mode [ 474.172158][T10721] device hsr_slave_1 left promiscuous mode [ 474.218841][T10721] team0 (unregistering): Port device team_slave_1 removed [ 474.230017][T10721] team0 (unregistering): Port device team_slave_0 removed [ 474.241589][T10721] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 474.295173][T10721] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 474.352679][T10721] bond0 (unregistering): Released all slaves 09:01:20 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) r1 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:20 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x3c) ptrace$cont(0x18, 0x0, 0x0, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, 0x0, 0x0, 0x0) 09:01:20 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x16}], 0xaaaaaaaaaaaae2f, 0x0, 0x0, 0xffa3) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:01:20 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:20 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:20 executing program 1: r0 = syz_open_dev$dspn(&(0x7f0000000100)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000040)=0x10000000006) r1 = perf_event_open(&(0x7f0000000980)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$UHID_INPUT(r0, &(0x7f00000002c0)={0x8, "b13e1c20d1764d052a4289a71186ca1abfa7f39eb694f4602948f6585c3542ac42cb2f94b098e98f2bcd6128dab4a71d544e96e01e3a9a3548ee5f554c06d963346edb9d133e86fdd31c21e9aaffeb52f7cd63297b1fd0db1845e12bda3ce00f0cca0e6ac9c42a61e687c24c0553b408359c86c7bfd7a30944ac327f982b011258e85ee00f050c38e73199d07b72b225a96ab0fb5a9ea944a233e46cd4c25aaa0fe04bd9b3203f61a06c8f094563ffa0078e50248ce1acebc03c75069eb1cb20ebbe30ec063f9ebc45290dc4f8b56ebb08d32e4df04785fd385029f766a0b96db6a1b6615de63393fe97082c076a7170d2b1c06ce0627d6acae850c2b95f38b079a352f27bf6f5460078b8e597c1d3bdb5cf9e73f42eec5aea224ab44b94e18e812864faeaf770ba7471f99b07d41d573d1d4c3833fb4410ea36d710bfa66ccdb14a1927a678f873b023e82c341a43704adb37242a67b2a46d02ab7aee23cf3030a2f3dd58eece667b6e9393ee8d36649e37e83b1c73c0ef65b4df6173c1c25324fbb9afa1361dc4275f152deb03d7138a688eb9dc66e7845ce1be5647bf740b0e1dd038120ef1e3e1cf420cf8b723bef771376e433935e4f9096a10c4a969aceaac4791c41f365b274dab49bddf51b22a24c05ceaedcbf45febc927e98f410d38247d7679cee7b0d3041eaebd7821924ad31e7c5137bf87ce1ec537a981779f0a4c57bbbb5c641cfd02e1e3904f48b0be96fc9851b6bc8c4260168eea9d9d111e2777f78a9021d5eb0166e39410bf279656770263ca2fb7ac0e30d5e168f8cf4bc5665d057da939b770568e41d0fcec5d6aac0bf4ae66fb099b786cdce7f6a9bc00b83d8ed72440a9724d4ef8af71c7efbc31397930cdcb99d30502ecbcc7ddb9161ade16a1badbd7ea3c6c65b387b46234c4660c816506a2f76264bba07ecb685532116bd971464b58e3ea0a29c2fa1d49d9c6308806db01326e9a1b6bbb556f6479b29f48718e211d75f08d0fb477ad8dae5aeaad7e176b2c5ae331ef78212e9dd7e506549dc74ffd940dc91d74aee2fa7f28855919c163f443804e2a072ad8add2be84df87e414afcab0f8e6f67d3ebb1778a6798d50233da09d29b95c0da97304b7a025e50a7c89e614c63bc69477bfe0e5ae2c468332d134f9e22b19eb2f01c8e8d5148b9b980f8b9aa0cab9ba89aafe16d6a8cf9cb5ae659d8fba88e2841f3d6ac0c44dd9f03787d357fe31a4f551e247bfb73b1f2aa1e208c36aa90dcfc4da8877967c05fe951716ec2293d79c6083e79061bbe18150e2af1d889bb4e87c7735b0e7b88a3109a906d1bd4bf9b98c2462420ecc4e9f3a274a6678bc56e9aa7f3d64677141f874f35d00d04a1dc83126ccd69a0221305a3a5418ec24e163b165c1e4533c38f3d213de4012aece68ed11e2f42325d6da5eef78ee985f81a7991e3d1ff69188059c292779579418ef81177fa94b43cdd0fbf92d31f0fb592a864ddc98ddd5b49ece865e7c7a6c873169d0eea46c1a44f645b1cfa40849ffb9f5355ab396dc1a875180f17103be63be4e7d1920949c59ba5d47341c176ac307e165b9733ac5cd9e9691f5ecd76b467881b78f217d50903a06c57270f4104fd26d496dd7e08c27209185761882923f6447c73d53a74e28132e6bf97ee4f2df9d03be88653a9a7251d8df247f1a75f91f95886ce317e3c125aa7686eec86708fa72c9b33a664e76c0ed891ff9d840ac121ae3f96d32330a14fd76df19c7ae0434e2103d6e9175da0b6cc7a007a0a18615271771434959de305636cf7fbfdd16239bff7dbc656a702ebd48f9a2b1937cca80604ec525d292bb7337459235ad047c6933b6c81bd966ea60ec863de568a9e6d8e0378916f441e0f8b2b74df49b9b24094fd643413469428a537aed19b72bf9381ebab4cd57400ecad1cf1b792e9610910d02f9a779b009840e3f1a1395a87f1e590c33018be80a3f34bbaf49e415ba7d3858b40788cd19211b8cad3789870fb252f8991d64bff9558a67a2316ec2402c2f9c52de42e6389fc90bc4379f7b899b1a943035d64f20b7766edf08fdfa185d00493031f0d3f9ad7dce841f725c5adcba896a76857918a2f54c8aa2e50f71eda35b8fea3732a02c146201ad9f4b65b7caa09e2a73f72aee1ce428a35489038d5cc859fbd48be8da5d088ccab897a248fe418b89b409ab5507af725f077d264abec5b53667ca06aed03815dd537535a3360a50ca3d09c025b5057362c7cb5a4b99c58ac64fe813f4d7f2cafbc3048835ec43fa68170ec7310342134c9b5ec417763db145555cdd37f24b27b0911d172710b74d3c754aac02b24030166cbf2eccfaf1e909b629b7919db1351cd0167e8b6bddc5ce4b7e13cbf0c095f636427d440d058e7637eb117947fc6a60942d10bd455030ee38fc447fd3e6232efba65def558dcff60274e6b2ad62464b4f767bcfec22c681c12bdabf1fedc3946f45c9a34a9169f79ea60a9d190dcf1ce14957382af602dd134b610b269247f38c3d4e233f2fda399dc4cf09139cff9e9c731f8bf940df3cbdf9355f604bd0f3d3b20a6cfc39a7d9ff74f734750187b30c1a970a432bf7e9417cc87d8dea00c4e1885845e1a59bc6a5487687c5bca514e9dcf372bcdc0fe4a47f3e4ac456b1a812e69f88b2a8a964d946cc102ba6f3a7c965df24653c6384d810cf157c8581d4b40e874aded8d227a25fab9889f02698bf52980f048408de4a96226949eba5d1b7f41fce61ae1ff9388e096646ddda4c222f7b9bffc1d3e5b645b6e248637698f6a5be1dc03ff7aa9f418153beeef9b9d67ac5b6fc888e5adf0db41a6d5cac2b600af3b428a1294f4fdb4cf64ccc254c1c7ef71b9be3afceb797fc9504bc3f3dde217687d47cd445c44bea2b16eacae76f16d868b77065b189bd7c4678f3a5fc99b4d020d42972d010b7a6b22de46b434f2d8ec4f567af2d531817ec81ffa36cc27d073a66d2152f1be2a8dce08e98a00f473f22e680cf0ebdcf37936cee60f99eec69503a15d8e36f8d599b535021693fb52f9dc93e315d6e849bd4bf9d05fb25f0b09de91b73ca4edfbfa04d9262d449eab2be542ea30f316384609efc52ed641a9e32d48e4a57c65e8bfa5c13e769d5402a0b125c17360800bf0da8592a75abe647f1d9b1072942947da82e701308b60ecdcfd40d7b6cf44b443493ef0466790547c0a8e5914484969e52cba3787c41df965f91ed7074cd62a63db7e1c35b8f9ac30521295ae7b9c81143926f1dd36aefdfbcd7056b0d4209cabe113a18c58ecc062df687666725707029a8be3ef5721484bd429bab33fceb76c6a0f079da8819d0d9565f5e4ed45eb531f9501b85b619b5323169b0297b7cedcf6f288225dd5e6a7f52c1b96cd38dd94b2f6b8cfc6dbd7862901a5295dca5ecbae72344f41c4a222bd6711831d265b910d547501116bcfbf3c9e104b446175c4c8a4e56445ca22f9363f0f54858a8eb4a1c43103bca578c5b0ee372efd705a950510dbbfa4f74c8ddb4bbc1f07dd410ebb39c01f4da8a0bad2d3d35df3a12a9fa2daf44c8163d59aba8a7351ecc9fe4cd25b987dba700e73d7174307161adf70db0e7a802d7c9ec1b912ee58b0a35c2c6f40f112d70ab5aa708071379280c9ffbceaf0a4ec45c89ac0bf3ef40538302b685e24574da8bde8654e99eff66c9ad5e6beafa0e48e1c293c53d955980346cbc052d15e5d1f3baed388dfaa72ca089af06ae757466a704b93a0ff13cb5c722f0b872432a4fd4513ed56825b13ddd4d8c02eb624c8358199f52679421ab0e1792869f6b4aea523a1079b3138f1ef761c6df102096eff43ddb23ee668b9cc5161433feb318903b58387c3dae2833a8c770e7c6e27c31a1fca07377fbb07f11911be6192f7518a8d089b89826e48b28f5c8a00784bef9b2f68c90838eb2c9fcaeda4bb76782510082c977a7ecdd5743e9da8f088a3b67a25cfb25db4a709b6cbf5425e7efa8c2e472464606d9ccd2fc0f73cd1d51a5aa19d9caba10be2147f8e1ad763ba45693f9f078b0716cf588142be847ca67dc132c5782fed12b7d95c55a9bcfdfb85cb48698a45621cc2f1c85559617ece7def71486290b0cf8e987e8788e1a13f17e3f24b93ed2009ebe42e3bea9571f98b39b787c107dcada3a36fa1fe93736e74ec34af80a182cf0adf2846577f1d474c9ff1b4b8a2cfe6a2d445029ca77088b9c84be63655d48cbc5f61b18d7cda0d141f2db6bc3c479aa6ca19638e2c37da38768eb8820e5679345d2abe8033318eb952e297e17dacaaee3df7ef1d6cd554e9b1b453c44e3d4e030e25c5f9ed094100f6d9b1dc5dab371436ab252cc4d7fdf8fe4b7f36ab71f2bbe3878217b151664c3b9ae970e473ae164d77f294ca8ad58634ea446880e8327fc7af2a088e39508443a601eaa00742a7d0ad459dcac24a60edcfa6ac9f72f428c2b8dd30b8278e28f25a1a129d23cacd765de4c4aa52819578951bb8e311e8621f627e3463e2562b6dbc8d1c431c240f1424599438b9c94723f79ffd1fa1bc94104e4598bd43244302f86ddbe47ad8671e25f406aa507ba45bdba09841827a697cece002f79ec7cf14488789d754f84818d180bd04a11cb2115441a402bea2be749ef233bcd26ca27df828ada877a893e54ea3e6ea29e62d6e7693af7cbee59ccdb4045d0e6eeec3d8f59205f324a5f7cf5f871929c83ada04bc5d3990288dca5eb312339933ffb1031e05866e1b2d0aad0ca940795458b7d6c8a3750a76e1e6c8ccd48ca542d6c51164431d70c9d35f0f828cdec404a175a44bc2a9651ec5281c0f3aee9e4375f0eb139f58fa4419fddf9ebe2f8f37121a57397e7e830ac097ed375521a68f7cdc471621b769fef40cd19d8d55a82e27bf5b0cc4182359db7c9066e2ee10df279a89e96fcfea225995f065f7f286b8c8ef9b6c82a34df14dda2f737f557578ce5b15944e3149110102d80465c1b436b6bbb16fdc64a9d130ec7644bc162f0e2c5669a9254970a062561e269d85b72b4748d71d88ca20778287bc3b9613043166862f133f366f6361b9e1d040bbcd9728a70fcf3be7ea8fe0f55980ed03f336ec49f7cb6899813acf47d3b2413e7b637b764fcb9003ece75f8a255b9cdc71f80dbbaa7eaa2111b5551feeb7ea31620a2c88897538915abedcd184d57c79d81505985f561820449c330bc3412bffb68c4c743c5a5a3acafcf00d7561a66f70e5835da530ba62f221211e1fefdc1fbc8c05b1b68b7eb2afac6ebbbc0b961b8ef8b27b555ce7641f6601ac19d5f4adb06b40155a2085ff32de5b2c5edd96a01a14d1bb49b58f1fd718bec428043819b8070e46f0215d2153318320754638d9b40a5214784e7c1f80dde05500cfe8e4dff855504e099634fb3d44829453cf4ac8db7e5a4144f96d4508de90ada04240637fd5b261cfbb80c8d9ccdea6c1d3485a85663cff9749133002c7f9c6ea4de1b50fe90dae397f6b5833e943e6c5f60e10d805e97e6869488b857b44d8c94276f668257c223e2e26dff75222d3f304f8a040ce058e1b7b3bc5f0b69c310beea64212ef0a54bc9fb858c25681cee574c532b64d4f8241e0b855f7f79d0a1ea22fc3d9ad5a1658b5c4d9d417e9eae47c81628341172609a8ef8c72fb6e4e48da6a10207e56b727f65c82d49e2dbb44b492e1265c2b28f98980334ccc3abb0cfd15d73c2f38f4c824022aa7a0ac0b7d35eea934d3455d21e8c710474e54bdf29be107ebc00", 0xa943708f26830065}, 0x1006) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) dup3(r1, r0, 0x0) 09:01:20 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:20 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) r1 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:20 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x16}], 0xaaaaaaaaaaaae2f, 0x0, 0x0, 0xffa3) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:01:20 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:20 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:20 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:20 executing program 3: r0 = syz_open_dev$dspn(&(0x7f0000000100)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000040)=0x10000000006) r1 = perf_event_open(&(0x7f0000000980)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$UHID_INPUT(r0, &(0x7f00000002c0)={0x8, "b13e1c20d1764d052a4289a71186ca1abfa7f39eb694f4602948f6585c3542ac42cb2f94b098e98f2bcd6128dab4a71d544e96e01e3a9a3548ee5f554c06d963346edb9d133e86fdd31c21e9aaffeb52f7cd63297b1fd0db1845e12bda3ce00f0cca0e6ac9c42a61e687c24c0553b408359c86c7bfd7a30944ac327f982b011258e85ee00f050c38e73199d07b72b225a96ab0fb5a9ea944a233e46cd4c25aaa0fe04bd9b3203f61a06c8f094563ffa0078e50248ce1acebc03c75069eb1cb20ebbe30ec063f9ebc45290dc4f8b56ebb08d32e4df04785fd385029f766a0b96db6a1b6615de63393fe97082c076a7170d2b1c06ce0627d6acae850c2b95f38b079a352f27bf6f5460078b8e597c1d3bdb5cf9e73f42eec5aea224ab44b94e18e812864faeaf770ba7471f99b07d41d573d1d4c3833fb4410ea36d710bfa66ccdb14a1927a678f873b023e82c341a43704adb37242a67b2a46d02ab7aee23cf3030a2f3dd58eece667b6e9393ee8d36649e37e83b1c73c0ef65b4df6173c1c25324fbb9afa1361dc4275f152deb03d7138a688eb9dc66e7845ce1be5647bf740b0e1dd038120ef1e3e1cf420cf8b723bef771376e433935e4f9096a10c4a969aceaac4791c41f365b274dab49bddf51b22a24c05ceaedcbf45febc927e98f410d38247d7679cee7b0d3041eaebd7821924ad31e7c5137bf87ce1ec537a981779f0a4c57bbbb5c641cfd02e1e3904f48b0be96fc9851b6bc8c4260168eea9d9d111e2777f78a9021d5eb0166e39410bf279656770263ca2fb7ac0e30d5e168f8cf4bc5665d057da939b770568e41d0fcec5d6aac0bf4ae66fb099b786cdce7f6a9bc00b83d8ed72440a9724d4ef8af71c7efbc31397930cdcb99d30502ecbcc7ddb9161ade16a1badbd7ea3c6c65b387b46234c4660c816506a2f76264bba07ecb685532116bd971464b58e3ea0a29c2fa1d49d9c6308806db01326e9a1b6bbb556f6479b29f48718e211d75f08d0fb477ad8dae5aeaad7e176b2c5ae331ef78212e9dd7e506549dc74ffd940dc91d74aee2fa7f28855919c163f443804e2a072ad8add2be84df87e414afcab0f8e6f67d3ebb1778a6798d50233da09d29b95c0da97304b7a025e50a7c89e614c63bc69477bfe0e5ae2c468332d134f9e22b19eb2f01c8e8d5148b9b980f8b9aa0cab9ba89aafe16d6a8cf9cb5ae659d8fba88e2841f3d6ac0c44dd9f03787d357fe31a4f551e247bfb73b1f2aa1e208c36aa90dcfc4da8877967c05fe951716ec2293d79c6083e79061bbe18150e2af1d889bb4e87c7735b0e7b88a3109a906d1bd4bf9b98c2462420ecc4e9f3a274a6678bc56e9aa7f3d64677141f874f35d00d04a1dc83126ccd69a0221305a3a5418ec24e163b165c1e4533c38f3d213de4012aece68ed11e2f42325d6da5eef78ee985f81a7991e3d1ff69188059c292779579418ef81177fa94b43cdd0fbf92d31f0fb592a864ddc98ddd5b49ece865e7c7a6c873169d0eea46c1a44f645b1cfa40849ffb9f5355ab396dc1a875180f17103be63be4e7d1920949c59ba5d47341c176ac307e165b9733ac5cd9e9691f5ecd76b467881b78f217d50903a06c57270f4104fd26d496dd7e08c27209185761882923f6447c73d53a74e28132e6bf97ee4f2df9d03be88653a9a7251d8df247f1a75f91f95886ce317e3c125aa7686eec86708fa72c9b33a664e76c0ed891ff9d840ac121ae3f96d32330a14fd76df19c7ae0434e2103d6e9175da0b6cc7a007a0a18615271771434959de305636cf7fbfdd16239bff7dbc656a702ebd48f9a2b1937cca80604ec525d292bb7337459235ad047c6933b6c81bd966ea60ec863de568a9e6d8e0378916f441e0f8b2b74df49b9b24094fd643413469428a537aed19b72bf9381ebab4cd57400ecad1cf1b792e9610910d02f9a779b009840e3f1a1395a87f1e590c33018be80a3f34bbaf49e415ba7d3858b40788cd19211b8cad3789870fb252f8991d64bff9558a67a2316ec2402c2f9c52de42e6389fc90bc4379f7b899b1a943035d64f20b7766edf08fdfa185d00493031f0d3f9ad7dce841f725c5adcba896a76857918a2f54c8aa2e50f71eda35b8fea3732a02c146201ad9f4b65b7caa09e2a73f72aee1ce428a35489038d5cc859fbd48be8da5d088ccab897a248fe418b89b409ab5507af725f077d264abec5b53667ca06aed03815dd537535a3360a50ca3d09c025b5057362c7cb5a4b99c58ac64fe813f4d7f2cafbc3048835ec43fa68170ec7310342134c9b5ec417763db145555cdd37f24b27b0911d172710b74d3c754aac02b24030166cbf2eccfaf1e909b629b7919db1351cd0167e8b6bddc5ce4b7e13cbf0c095f636427d440d058e7637eb117947fc6a60942d10bd455030ee38fc447fd3e6232efba65def558dcff60274e6b2ad62464b4f767bcfec22c681c12bdabf1fedc3946f45c9a34a9169f79ea60a9d190dcf1ce14957382af602dd134b610b269247f38c3d4e233f2fda399dc4cf09139cff9e9c731f8bf940df3cbdf9355f604bd0f3d3b20a6cfc39a7d9ff74f734750187b30c1a970a432bf7e9417cc87d8dea00c4e1885845e1a59bc6a5487687c5bca514e9dcf372bcdc0fe4a47f3e4ac456b1a812e69f88b2a8a964d946cc102ba6f3a7c965df24653c6384d810cf157c8581d4b40e874aded8d227a25fab9889f02698bf52980f048408de4a96226949eba5d1b7f41fce61ae1ff9388e096646ddda4c222f7b9bffc1d3e5b645b6e248637698f6a5be1dc03ff7aa9f418153beeef9b9d67ac5b6fc888e5adf0db41a6d5cac2b600af3b428a1294f4fdb4cf64ccc254c1c7ef71b9be3afceb797fc9504bc3f3dde217687d47cd445c44bea2b16eacae76f16d868b77065b189bd7c4678f3a5fc99b4d020d42972d010b7a6b22de46b434f2d8ec4f567af2d531817ec81ffa36cc27d073a66d2152f1be2a8dce08e98a00f473f22e680cf0ebdcf37936cee60f99eec69503a15d8e36f8d599b535021693fb52f9dc93e315d6e849bd4bf9d05fb25f0b09de91b73ca4edfbfa04d9262d449eab2be542ea30f316384609efc52ed641a9e32d48e4a57c65e8bfa5c13e769d5402a0b125c17360800bf0da8592a75abe647f1d9b1072942947da82e701308b60ecdcfd40d7b6cf44b443493ef0466790547c0a8e5914484969e52cba3787c41df965f91ed7074cd62a63db7e1c35b8f9ac30521295ae7b9c81143926f1dd36aefdfbcd7056b0d4209cabe113a18c58ecc062df687666725707029a8be3ef5721484bd429bab33fceb76c6a0f079da8819d0d9565f5e4ed45eb531f9501b85b619b5323169b0297b7cedcf6f288225dd5e6a7f52c1b96cd38dd94b2f6b8cfc6dbd7862901a5295dca5ecbae72344f41c4a222bd6711831d265b910d547501116bcfbf3c9e104b446175c4c8a4e56445ca22f9363f0f54858a8eb4a1c43103bca578c5b0ee372efd705a950510dbbfa4f74c8ddb4bbc1f07dd410ebb39c01f4da8a0bad2d3d35df3a12a9fa2daf44c8163d59aba8a7351ecc9fe4cd25b987dba700e73d7174307161adf70db0e7a802d7c9ec1b912ee58b0a35c2c6f40f112d70ab5aa708071379280c9ffbceaf0a4ec45c89ac0bf3ef40538302b685e24574da8bde8654e99eff66c9ad5e6beafa0e48e1c293c53d955980346cbc052d15e5d1f3baed388dfaa72ca089af06ae757466a704b93a0ff13cb5c722f0b872432a4fd4513ed56825b13ddd4d8c02eb624c8358199f52679421ab0e1792869f6b4aea523a1079b3138f1ef761c6df102096eff43ddb23ee668b9cc5161433feb318903b58387c3dae2833a8c770e7c6e27c31a1fca07377fbb07f11911be6192f7518a8d089b89826e48b28f5c8a00784bef9b2f68c90838eb2c9fcaeda4bb76782510082c977a7ecdd5743e9da8f088a3b67a25cfb25db4a709b6cbf5425e7efa8c2e472464606d9ccd2fc0f73cd1d51a5aa19d9caba10be2147f8e1ad763ba45693f9f078b0716cf588142be847ca67dc132c5782fed12b7d95c55a9bcfdfb85cb48698a45621cc2f1c85559617ece7def71486290b0cf8e987e8788e1a13f17e3f24b93ed2009ebe42e3bea9571f98b39b787c107dcada3a36fa1fe93736e74ec34af80a182cf0adf2846577f1d474c9ff1b4b8a2cfe6a2d445029ca77088b9c84be63655d48cbc5f61b18d7cda0d141f2db6bc3c479aa6ca19638e2c37da38768eb8820e5679345d2abe8033318eb952e297e17dacaaee3df7ef1d6cd554e9b1b453c44e3d4e030e25c5f9ed094100f6d9b1dc5dab371436ab252cc4d7fdf8fe4b7f36ab71f2bbe3878217b151664c3b9ae970e473ae164d77f294ca8ad58634ea446880e8327fc7af2a088e39508443a601eaa00742a7d0ad459dcac24a60edcfa6ac9f72f428c2b8dd30b8278e28f25a1a129d23cacd765de4c4aa52819578951bb8e311e8621f627e3463e2562b6dbc8d1c431c240f1424599438b9c94723f79ffd1fa1bc94104e4598bd43244302f86ddbe47ad8671e25f406aa507ba45bdba09841827a697cece002f79ec7cf14488789d754f84818d180bd04a11cb2115441a402bea2be749ef233bcd26ca27df828ada877a893e54ea3e6ea29e62d6e7693af7cbee59ccdb4045d0e6eeec3d8f59205f324a5f7cf5f871929c83ada04bc5d3990288dca5eb312339933ffb1031e05866e1b2d0aad0ca940795458b7d6c8a3750a76e1e6c8ccd48ca542d6c51164431d70c9d35f0f828cdec404a175a44bc2a9651ec5281c0f3aee9e4375f0eb139f58fa4419fddf9ebe2f8f37121a57397e7e830ac097ed375521a68f7cdc471621b769fef40cd19d8d55a82e27bf5b0cc4182359db7c9066e2ee10df279a89e96fcfea225995f065f7f286b8c8ef9b6c82a34df14dda2f737f557578ce5b15944e3149110102d80465c1b436b6bbb16fdc64a9d130ec7644bc162f0e2c5669a9254970a062561e269d85b72b4748d71d88ca20778287bc3b9613043166862f133f366f6361b9e1d040bbcd9728a70fcf3be7ea8fe0f55980ed03f336ec49f7cb6899813acf47d3b2413e7b637b764fcb9003ece75f8a255b9cdc71f80dbbaa7eaa2111b5551feeb7ea31620a2c88897538915abedcd184d57c79d81505985f561820449c330bc3412bffb68c4c743c5a5a3acafcf00d7561a66f70e5835da530ba62f221211e1fefdc1fbc8c05b1b68b7eb2afac6ebbbc0b961b8ef8b27b555ce7641f6601ac19d5f4adb06b40155a2085ff32de5b2c5edd96a01a14d1bb49b58f1fd718bec428043819b8070e46f0215d2153318320754638d9b40a5214784e7c1f80dde05500cfe8e4dff855504e099634fb3d44829453cf4ac8db7e5a4144f96d4508de90ada04240637fd5b261cfbb80c8d9ccdea6c1d3485a85663cff9749133002c7f9c6ea4de1b50fe90dae397f6b5833e943e6c5f60e10d805e97e6869488b857b44d8c94276f668257c223e2e26dff75222d3f304f8a040ce058e1b7b3bc5f0b69c310beea64212ef0a54bc9fb858c25681cee574c532b64d4f8241e0b855f7f79d0a1ea22fc3d9ad5a1658b5c4d9d417e9eae47c81628341172609a8ef8c72fb6e4e48da6a10207e56b727f65c82d49e2dbb44b492e1265c2b28f98980334ccc3abb0cfd15d73c2f38f4c824022aa7a0ac0b7d35eea934d3455d21e8c710474e54bdf29be107ebc00", 0xa943708f26830065}, 0x1006) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) dup3(r1, r0, 0x0) 09:01:20 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:20 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 477.393385][T17525] IPVS: ftp: loaded support on port[0] = 21 [ 477.444174][T17525] chnl_net:caif_netlink_parms(): no params data found [ 477.469764][T17525] bridge0: port 1(bridge_slave_0) entered blocking state [ 477.477153][T17525] bridge0: port 1(bridge_slave_0) entered disabled state [ 477.485155][T17525] device bridge_slave_0 entered promiscuous mode [ 477.492937][T17525] bridge0: port 2(bridge_slave_1) entered blocking state [ 477.500235][T17525] bridge0: port 2(bridge_slave_1) entered disabled state [ 477.508580][T17525] device bridge_slave_1 entered promiscuous mode [ 477.525256][T17525] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 477.536006][T17525] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 477.553827][T17525] team0: Port device team_slave_0 added [ 477.560799][T17525] team0: Port device team_slave_1 added [ 477.643840][T17525] device hsr_slave_0 entered promiscuous mode [ 477.682282][T17525] device hsr_slave_1 entered promiscuous mode [ 477.721964][T17525] debugfs: Directory 'hsr0' with parent '/' already present! [ 477.736211][T17525] bridge0: port 2(bridge_slave_1) entered blocking state [ 477.743500][T17525] bridge0: port 2(bridge_slave_1) entered forwarding state [ 477.750904][T17525] bridge0: port 1(bridge_slave_0) entered blocking state [ 477.758243][T17525] bridge0: port 1(bridge_slave_0) entered forwarding state [ 477.787594][T17525] 8021q: adding VLAN 0 to HW filter on device bond0 [ 477.799082][ T7726] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 477.807929][ T7726] bridge0: port 1(bridge_slave_0) entered disabled state [ 477.815966][ T7726] bridge0: port 2(bridge_slave_1) entered disabled state [ 477.825689][ T7726] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 477.837508][T17525] 8021q: adding VLAN 0 to HW filter on device team0 [ 477.848675][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 477.857162][ T7613] bridge0: port 1(bridge_slave_0) entered blocking state [ 477.864678][ T7613] bridge0: port 1(bridge_slave_0) entered forwarding state [ 477.875376][ T7726] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 477.884192][ T7726] bridge0: port 2(bridge_slave_1) entered blocking state [ 477.891525][ T7726] bridge0: port 2(bridge_slave_1) entered forwarding state [ 477.915626][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 477.924640][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 477.934283][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 477.943021][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 477.951399][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 477.961575][T17525] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 477.976788][ T7726] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 477.984534][ T7726] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 477.996824][T17525] 8021q: adding VLAN 0 to HW filter on device batadv0 09:01:23 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:23 executing program 3: r0 = openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/attr/exec\x00', 0x2, 0x0) write$binfmt_elf32(r0, 0x0, 0x0) 09:01:23 executing program 1: r0 = syz_open_dev$dspn(&(0x7f0000000100)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000040)=0x10000000006) r1 = perf_event_open(&(0x7f0000000980)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$UHID_INPUT(r0, &(0x7f00000002c0)={0x8, "b13e1c20d1764d052a4289a71186ca1abfa7f39eb694f4602948f6585c3542ac42cb2f94b098e98f2bcd6128dab4a71d544e96e01e3a9a3548ee5f554c06d963346edb9d133e86fdd31c21e9aaffeb52f7cd63297b1fd0db1845e12bda3ce00f0cca0e6ac9c42a61e687c24c0553b408359c86c7bfd7a30944ac327f982b011258e85ee00f050c38e73199d07b72b225a96ab0fb5a9ea944a233e46cd4c25aaa0fe04bd9b3203f61a06c8f094563ffa0078e50248ce1acebc03c75069eb1cb20ebbe30ec063f9ebc45290dc4f8b56ebb08d32e4df04785fd385029f766a0b96db6a1b6615de63393fe97082c076a7170d2b1c06ce0627d6acae850c2b95f38b079a352f27bf6f5460078b8e597c1d3bdb5cf9e73f42eec5aea224ab44b94e18e812864faeaf770ba7471f99b07d41d573d1d4c3833fb4410ea36d710bfa66ccdb14a1927a678f873b023e82c341a43704adb37242a67b2a46d02ab7aee23cf3030a2f3dd58eece667b6e9393ee8d36649e37e83b1c73c0ef65b4df6173c1c25324fbb9afa1361dc4275f152deb03d7138a688eb9dc66e7845ce1be5647bf740b0e1dd038120ef1e3e1cf420cf8b723bef771376e433935e4f9096a10c4a969aceaac4791c41f365b274dab49bddf51b22a24c05ceaedcbf45febc927e98f410d38247d7679cee7b0d3041eaebd7821924ad31e7c5137bf87ce1ec537a981779f0a4c57bbbb5c641cfd02e1e3904f48b0be96fc9851b6bc8c4260168eea9d9d111e2777f78a9021d5eb0166e39410bf279656770263ca2fb7ac0e30d5e168f8cf4bc5665d057da939b770568e41d0fcec5d6aac0bf4ae66fb099b786cdce7f6a9bc00b83d8ed72440a9724d4ef8af71c7efbc31397930cdcb99d30502ecbcc7ddb9161ade16a1badbd7ea3c6c65b387b46234c4660c816506a2f76264bba07ecb685532116bd971464b58e3ea0a29c2fa1d49d9c6308806db01326e9a1b6bbb556f6479b29f48718e211d75f08d0fb477ad8dae5aeaad7e176b2c5ae331ef78212e9dd7e506549dc74ffd940dc91d74aee2fa7f28855919c163f443804e2a072ad8add2be84df87e414afcab0f8e6f67d3ebb1778a6798d50233da09d29b95c0da97304b7a025e50a7c89e614c63bc69477bfe0e5ae2c468332d134f9e22b19eb2f01c8e8d5148b9b980f8b9aa0cab9ba89aafe16d6a8cf9cb5ae659d8fba88e2841f3d6ac0c44dd9f03787d357fe31a4f551e247bfb73b1f2aa1e208c36aa90dcfc4da8877967c05fe951716ec2293d79c6083e79061bbe18150e2af1d889bb4e87c7735b0e7b88a3109a906d1bd4bf9b98c2462420ecc4e9f3a274a6678bc56e9aa7f3d64677141f874f35d00d04a1dc83126ccd69a0221305a3a5418ec24e163b165c1e4533c38f3d213de4012aece68ed11e2f42325d6da5eef78ee985f81a7991e3d1ff69188059c292779579418ef81177fa94b43cdd0fbf92d31f0fb592a864ddc98ddd5b49ece865e7c7a6c873169d0eea46c1a44f645b1cfa40849ffb9f5355ab396dc1a875180f17103be63be4e7d1920949c59ba5d47341c176ac307e165b9733ac5cd9e9691f5ecd76b467881b78f217d50903a06c57270f4104fd26d496dd7e08c27209185761882923f6447c73d53a74e28132e6bf97ee4f2df9d03be88653a9a7251d8df247f1a75f91f95886ce317e3c125aa7686eec86708fa72c9b33a664e76c0ed891ff9d840ac121ae3f96d32330a14fd76df19c7ae0434e2103d6e9175da0b6cc7a007a0a18615271771434959de305636cf7fbfdd16239bff7dbc656a702ebd48f9a2b1937cca80604ec525d292bb7337459235ad047c6933b6c81bd966ea60ec863de568a9e6d8e0378916f441e0f8b2b74df49b9b24094fd643413469428a537aed19b72bf9381ebab4cd57400ecad1cf1b792e9610910d02f9a779b009840e3f1a1395a87f1e590c33018be80a3f34bbaf49e415ba7d3858b40788cd19211b8cad3789870fb252f8991d64bff9558a67a2316ec2402c2f9c52de42e6389fc90bc4379f7b899b1a943035d64f20b7766edf08fdfa185d00493031f0d3f9ad7dce841f725c5adcba896a76857918a2f54c8aa2e50f71eda35b8fea3732a02c146201ad9f4b65b7caa09e2a73f72aee1ce428a35489038d5cc859fbd48be8da5d088ccab897a248fe418b89b409ab5507af725f077d264abec5b53667ca06aed03815dd537535a3360a50ca3d09c025b5057362c7cb5a4b99c58ac64fe813f4d7f2cafbc3048835ec43fa68170ec7310342134c9b5ec417763db145555cdd37f24b27b0911d172710b74d3c754aac02b24030166cbf2eccfaf1e909b629b7919db1351cd0167e8b6bddc5ce4b7e13cbf0c095f636427d440d058e7637eb117947fc6a60942d10bd455030ee38fc447fd3e6232efba65def558dcff60274e6b2ad62464b4f767bcfec22c681c12bdabf1fedc3946f45c9a34a9169f79ea60a9d190dcf1ce14957382af602dd134b610b269247f38c3d4e233f2fda399dc4cf09139cff9e9c731f8bf940df3cbdf9355f604bd0f3d3b20a6cfc39a7d9ff74f734750187b30c1a970a432bf7e9417cc87d8dea00c4e1885845e1a59bc6a5487687c5bca514e9dcf372bcdc0fe4a47f3e4ac456b1a812e69f88b2a8a964d946cc102ba6f3a7c965df24653c6384d810cf157c8581d4b40e874aded8d227a25fab9889f02698bf52980f048408de4a96226949eba5d1b7f41fce61ae1ff9388e096646ddda4c222f7b9bffc1d3e5b645b6e248637698f6a5be1dc03ff7aa9f418153beeef9b9d67ac5b6fc888e5adf0db41a6d5cac2b600af3b428a1294f4fdb4cf64ccc254c1c7ef71b9be3afceb797fc9504bc3f3dde217687d47cd445c44bea2b16eacae76f16d868b77065b189bd7c4678f3a5fc99b4d020d42972d010b7a6b22de46b434f2d8ec4f567af2d531817ec81ffa36cc27d073a66d2152f1be2a8dce08e98a00f473f22e680cf0ebdcf37936cee60f99eec69503a15d8e36f8d599b535021693fb52f9dc93e315d6e849bd4bf9d05fb25f0b09de91b73ca4edfbfa04d9262d449eab2be542ea30f316384609efc52ed641a9e32d48e4a57c65e8bfa5c13e769d5402a0b125c17360800bf0da8592a75abe647f1d9b1072942947da82e701308b60ecdcfd40d7b6cf44b443493ef0466790547c0a8e5914484969e52cba3787c41df965f91ed7074cd62a63db7e1c35b8f9ac30521295ae7b9c81143926f1dd36aefdfbcd7056b0d4209cabe113a18c58ecc062df687666725707029a8be3ef5721484bd429bab33fceb76c6a0f079da8819d0d9565f5e4ed45eb531f9501b85b619b5323169b0297b7cedcf6f288225dd5e6a7f52c1b96cd38dd94b2f6b8cfc6dbd7862901a5295dca5ecbae72344f41c4a222bd6711831d265b910d547501116bcfbf3c9e104b446175c4c8a4e56445ca22f9363f0f54858a8eb4a1c43103bca578c5b0ee372efd705a950510dbbfa4f74c8ddb4bbc1f07dd410ebb39c01f4da8a0bad2d3d35df3a12a9fa2daf44c8163d59aba8a7351ecc9fe4cd25b987dba700e73d7174307161adf70db0e7a802d7c9ec1b912ee58b0a35c2c6f40f112d70ab5aa708071379280c9ffbceaf0a4ec45c89ac0bf3ef40538302b685e24574da8bde8654e99eff66c9ad5e6beafa0e48e1c293c53d955980346cbc052d15e5d1f3baed388dfaa72ca089af06ae757466a704b93a0ff13cb5c722f0b872432a4fd4513ed56825b13ddd4d8c02eb624c8358199f52679421ab0e1792869f6b4aea523a1079b3138f1ef761c6df102096eff43ddb23ee668b9cc5161433feb318903b58387c3dae2833a8c770e7c6e27c31a1fca07377fbb07f11911be6192f7518a8d089b89826e48b28f5c8a00784bef9b2f68c90838eb2c9fcaeda4bb76782510082c977a7ecdd5743e9da8f088a3b67a25cfb25db4a709b6cbf5425e7efa8c2e472464606d9ccd2fc0f73cd1d51a5aa19d9caba10be2147f8e1ad763ba45693f9f078b0716cf588142be847ca67dc132c5782fed12b7d95c55a9bcfdfb85cb48698a45621cc2f1c85559617ece7def71486290b0cf8e987e8788e1a13f17e3f24b93ed2009ebe42e3bea9571f98b39b787c107dcada3a36fa1fe93736e74ec34af80a182cf0adf2846577f1d474c9ff1b4b8a2cfe6a2d445029ca77088b9c84be63655d48cbc5f61b18d7cda0d141f2db6bc3c479aa6ca19638e2c37da38768eb8820e5679345d2abe8033318eb952e297e17dacaaee3df7ef1d6cd554e9b1b453c44e3d4e030e25c5f9ed094100f6d9b1dc5dab371436ab252cc4d7fdf8fe4b7f36ab71f2bbe3878217b151664c3b9ae970e473ae164d77f294ca8ad58634ea446880e8327fc7af2a088e39508443a601eaa00742a7d0ad459dcac24a60edcfa6ac9f72f428c2b8dd30b8278e28f25a1a129d23cacd765de4c4aa52819578951bb8e311e8621f627e3463e2562b6dbc8d1c431c240f1424599438b9c94723f79ffd1fa1bc94104e4598bd43244302f86ddbe47ad8671e25f406aa507ba45bdba09841827a697cece002f79ec7cf14488789d754f84818d180bd04a11cb2115441a402bea2be749ef233bcd26ca27df828ada877a893e54ea3e6ea29e62d6e7693af7cbee59ccdb4045d0e6eeec3d8f59205f324a5f7cf5f871929c83ada04bc5d3990288dca5eb312339933ffb1031e05866e1b2d0aad0ca940795458b7d6c8a3750a76e1e6c8ccd48ca542d6c51164431d70c9d35f0f828cdec404a175a44bc2a9651ec5281c0f3aee9e4375f0eb139f58fa4419fddf9ebe2f8f37121a57397e7e830ac097ed375521a68f7cdc471621b769fef40cd19d8d55a82e27bf5b0cc4182359db7c9066e2ee10df279a89e96fcfea225995f065f7f286b8c8ef9b6c82a34df14dda2f737f557578ce5b15944e3149110102d80465c1b436b6bbb16fdc64a9d130ec7644bc162f0e2c5669a9254970a062561e269d85b72b4748d71d88ca20778287bc3b9613043166862f133f366f6361b9e1d040bbcd9728a70fcf3be7ea8fe0f55980ed03f336ec49f7cb6899813acf47d3b2413e7b637b764fcb9003ece75f8a255b9cdc71f80dbbaa7eaa2111b5551feeb7ea31620a2c88897538915abedcd184d57c79d81505985f561820449c330bc3412bffb68c4c743c5a5a3acafcf00d7561a66f70e5835da530ba62f221211e1fefdc1fbc8c05b1b68b7eb2afac6ebbbc0b961b8ef8b27b555ce7641f6601ac19d5f4adb06b40155a2085ff32de5b2c5edd96a01a14d1bb49b58f1fd718bec428043819b8070e46f0215d2153318320754638d9b40a5214784e7c1f80dde05500cfe8e4dff855504e099634fb3d44829453cf4ac8db7e5a4144f96d4508de90ada04240637fd5b261cfbb80c8d9ccdea6c1d3485a85663cff9749133002c7f9c6ea4de1b50fe90dae397f6b5833e943e6c5f60e10d805e97e6869488b857b44d8c94276f668257c223e2e26dff75222d3f304f8a040ce058e1b7b3bc5f0b69c310beea64212ef0a54bc9fb858c25681cee574c532b64d4f8241e0b855f7f79d0a1ea22fc3d9ad5a1658b5c4d9d417e9eae47c81628341172609a8ef8c72fb6e4e48da6a10207e56b727f65c82d49e2dbb44b492e1265c2b28f98980334ccc3abb0cfd15d73c2f38f4c824022aa7a0ac0b7d35eea934d3455d21e8c710474e54bdf29be107ebc00", 0xa943708f26830065}, 0x1006) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) dup3(r1, r0, 0x0) 09:01:23 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 478.295542][T17552] fuse: Bad value for 'fd' 09:01:23 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:23 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:23 executing program 3: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) 09:01:23 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 478.391610][T17559] ptrace attach of "/root/syz-executor.0"[17558] was attempted by "/root/syz-executor.0"[17559] 09:01:23 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:23 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:23 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:23 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:23 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:23 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:24 executing program 1: r0 = syz_open_dev$dspn(&(0x7f0000000100)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000040)=0x10000000006) r1 = perf_event_open(&(0x7f0000000980)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$UHID_INPUT(r0, &(0x7f00000002c0)={0x8, "b13e1c20d1764d052a4289a71186ca1abfa7f39eb694f4602948f6585c3542ac42cb2f94b098e98f2bcd6128dab4a71d544e96e01e3a9a3548ee5f554c06d963346edb9d133e86fdd31c21e9aaffeb52f7cd63297b1fd0db1845e12bda3ce00f0cca0e6ac9c42a61e687c24c0553b408359c86c7bfd7a30944ac327f982b011258e85ee00f050c38e73199d07b72b225a96ab0fb5a9ea944a233e46cd4c25aaa0fe04bd9b3203f61a06c8f094563ffa0078e50248ce1acebc03c75069eb1cb20ebbe30ec063f9ebc45290dc4f8b56ebb08d32e4df04785fd385029f766a0b96db6a1b6615de63393fe97082c076a7170d2b1c06ce0627d6acae850c2b95f38b079a352f27bf6f5460078b8e597c1d3bdb5cf9e73f42eec5aea224ab44b94e18e812864faeaf770ba7471f99b07d41d573d1d4c3833fb4410ea36d710bfa66ccdb14a1927a678f873b023e82c341a43704adb37242a67b2a46d02ab7aee23cf3030a2f3dd58eece667b6e9393ee8d36649e37e83b1c73c0ef65b4df6173c1c25324fbb9afa1361dc4275f152deb03d7138a688eb9dc66e7845ce1be5647bf740b0e1dd038120ef1e3e1cf420cf8b723bef771376e433935e4f9096a10c4a969aceaac4791c41f365b274dab49bddf51b22a24c05ceaedcbf45febc927e98f410d38247d7679cee7b0d3041eaebd7821924ad31e7c5137bf87ce1ec537a981779f0a4c57bbbb5c641cfd02e1e3904f48b0be96fc9851b6bc8c4260168eea9d9d111e2777f78a9021d5eb0166e39410bf279656770263ca2fb7ac0e30d5e168f8cf4bc5665d057da939b770568e41d0fcec5d6aac0bf4ae66fb099b786cdce7f6a9bc00b83d8ed72440a9724d4ef8af71c7efbc31397930cdcb99d30502ecbcc7ddb9161ade16a1badbd7ea3c6c65b387b46234c4660c816506a2f76264bba07ecb685532116bd971464b58e3ea0a29c2fa1d49d9c6308806db01326e9a1b6bbb556f6479b29f48718e211d75f08d0fb477ad8dae5aeaad7e176b2c5ae331ef78212e9dd7e506549dc74ffd940dc91d74aee2fa7f28855919c163f443804e2a072ad8add2be84df87e414afcab0f8e6f67d3ebb1778a6798d50233da09d29b95c0da97304b7a025e50a7c89e614c63bc69477bfe0e5ae2c468332d134f9e22b19eb2f01c8e8d5148b9b980f8b9aa0cab9ba89aafe16d6a8cf9cb5ae659d8fba88e2841f3d6ac0c44dd9f03787d357fe31a4f551e247bfb73b1f2aa1e208c36aa90dcfc4da8877967c05fe951716ec2293d79c6083e79061bbe18150e2af1d889bb4e87c7735b0e7b88a3109a906d1bd4bf9b98c2462420ecc4e9f3a274a6678bc56e9aa7f3d64677141f874f35d00d04a1dc83126ccd69a0221305a3a5418ec24e163b165c1e4533c38f3d213de4012aece68ed11e2f42325d6da5eef78ee985f81a7991e3d1ff69188059c292779579418ef81177fa94b43cdd0fbf92d31f0fb592a864ddc98ddd5b49ece865e7c7a6c873169d0eea46c1a44f645b1cfa40849ffb9f5355ab396dc1a875180f17103be63be4e7d1920949c59ba5d47341c176ac307e165b9733ac5cd9e9691f5ecd76b467881b78f217d50903a06c57270f4104fd26d496dd7e08c27209185761882923f6447c73d53a74e28132e6bf97ee4f2df9d03be88653a9a7251d8df247f1a75f91f95886ce317e3c125aa7686eec86708fa72c9b33a664e76c0ed891ff9d840ac121ae3f96d32330a14fd76df19c7ae0434e2103d6e9175da0b6cc7a007a0a18615271771434959de305636cf7fbfdd16239bff7dbc656a702ebd48f9a2b1937cca80604ec525d292bb7337459235ad047c6933b6c81bd966ea60ec863de568a9e6d8e0378916f441e0f8b2b74df49b9b24094fd643413469428a537aed19b72bf9381ebab4cd57400ecad1cf1b792e9610910d02f9a779b009840e3f1a1395a87f1e590c33018be80a3f34bbaf49e415ba7d3858b40788cd19211b8cad3789870fb252f8991d64bff9558a67a2316ec2402c2f9c52de42e6389fc90bc4379f7b899b1a943035d64f20b7766edf08fdfa185d00493031f0d3f9ad7dce841f725c5adcba896a76857918a2f54c8aa2e50f71eda35b8fea3732a02c146201ad9f4b65b7caa09e2a73f72aee1ce428a35489038d5cc859fbd48be8da5d088ccab897a248fe418b89b409ab5507af725f077d264abec5b53667ca06aed03815dd537535a3360a50ca3d09c025b5057362c7cb5a4b99c58ac64fe813f4d7f2cafbc3048835ec43fa68170ec7310342134c9b5ec417763db145555cdd37f24b27b0911d172710b74d3c754aac02b24030166cbf2eccfaf1e909b629b7919db1351cd0167e8b6bddc5ce4b7e13cbf0c095f636427d440d058e7637eb117947fc6a60942d10bd455030ee38fc447fd3e6232efba65def558dcff60274e6b2ad62464b4f767bcfec22c681c12bdabf1fedc3946f45c9a34a9169f79ea60a9d190dcf1ce14957382af602dd134b610b269247f38c3d4e233f2fda399dc4cf09139cff9e9c731f8bf940df3cbdf9355f604bd0f3d3b20a6cfc39a7d9ff74f734750187b30c1a970a432bf7e9417cc87d8dea00c4e1885845e1a59bc6a5487687c5bca514e9dcf372bcdc0fe4a47f3e4ac456b1a812e69f88b2a8a964d946cc102ba6f3a7c965df24653c6384d810cf157c8581d4b40e874aded8d227a25fab9889f02698bf52980f048408de4a96226949eba5d1b7f41fce61ae1ff9388e096646ddda4c222f7b9bffc1d3e5b645b6e248637698f6a5be1dc03ff7aa9f418153beeef9b9d67ac5b6fc888e5adf0db41a6d5cac2b600af3b428a1294f4fdb4cf64ccc254c1c7ef71b9be3afceb797fc9504bc3f3dde217687d47cd445c44bea2b16eacae76f16d868b77065b189bd7c4678f3a5fc99b4d020d42972d010b7a6b22de46b434f2d8ec4f567af2d531817ec81ffa36cc27d073a66d2152f1be2a8dce08e98a00f473f22e680cf0ebdcf37936cee60f99eec69503a15d8e36f8d599b535021693fb52f9dc93e315d6e849bd4bf9d05fb25f0b09de91b73ca4edfbfa04d9262d449eab2be542ea30f316384609efc52ed641a9e32d48e4a57c65e8bfa5c13e769d5402a0b125c17360800bf0da8592a75abe647f1d9b1072942947da82e701308b60ecdcfd40d7b6cf44b443493ef0466790547c0a8e5914484969e52cba3787c41df965f91ed7074cd62a63db7e1c35b8f9ac30521295ae7b9c81143926f1dd36aefdfbcd7056b0d4209cabe113a18c58ecc062df687666725707029a8be3ef5721484bd429bab33fceb76c6a0f079da8819d0d9565f5e4ed45eb531f9501b85b619b5323169b0297b7cedcf6f288225dd5e6a7f52c1b96cd38dd94b2f6b8cfc6dbd7862901a5295dca5ecbae72344f41c4a222bd6711831d265b910d547501116bcfbf3c9e104b446175c4c8a4e56445ca22f9363f0f54858a8eb4a1c43103bca578c5b0ee372efd705a950510dbbfa4f74c8ddb4bbc1f07dd410ebb39c01f4da8a0bad2d3d35df3a12a9fa2daf44c8163d59aba8a7351ecc9fe4cd25b987dba700e73d7174307161adf70db0e7a802d7c9ec1b912ee58b0a35c2c6f40f112d70ab5aa708071379280c9ffbceaf0a4ec45c89ac0bf3ef40538302b685e24574da8bde8654e99eff66c9ad5e6beafa0e48e1c293c53d955980346cbc052d15e5d1f3baed388dfaa72ca089af06ae757466a704b93a0ff13cb5c722f0b872432a4fd4513ed56825b13ddd4d8c02eb624c8358199f52679421ab0e1792869f6b4aea523a1079b3138f1ef761c6df102096eff43ddb23ee668b9cc5161433feb318903b58387c3dae2833a8c770e7c6e27c31a1fca07377fbb07f11911be6192f7518a8d089b89826e48b28f5c8a00784bef9b2f68c90838eb2c9fcaeda4bb76782510082c977a7ecdd5743e9da8f088a3b67a25cfb25db4a709b6cbf5425e7efa8c2e472464606d9ccd2fc0f73cd1d51a5aa19d9caba10be2147f8e1ad763ba45693f9f078b0716cf588142be847ca67dc132c5782fed12b7d95c55a9bcfdfb85cb48698a45621cc2f1c85559617ece7def71486290b0cf8e987e8788e1a13f17e3f24b93ed2009ebe42e3bea9571f98b39b787c107dcada3a36fa1fe93736e74ec34af80a182cf0adf2846577f1d474c9ff1b4b8a2cfe6a2d445029ca77088b9c84be63655d48cbc5f61b18d7cda0d141f2db6bc3c479aa6ca19638e2c37da38768eb8820e5679345d2abe8033318eb952e297e17dacaaee3df7ef1d6cd554e9b1b453c44e3d4e030e25c5f9ed094100f6d9b1dc5dab371436ab252cc4d7fdf8fe4b7f36ab71f2bbe3878217b151664c3b9ae970e473ae164d77f294ca8ad58634ea446880e8327fc7af2a088e39508443a601eaa00742a7d0ad459dcac24a60edcfa6ac9f72f428c2b8dd30b8278e28f25a1a129d23cacd765de4c4aa52819578951bb8e311e8621f627e3463e2562b6dbc8d1c431c240f1424599438b9c94723f79ffd1fa1bc94104e4598bd43244302f86ddbe47ad8671e25f406aa507ba45bdba09841827a697cece002f79ec7cf14488789d754f84818d180bd04a11cb2115441a402bea2be749ef233bcd26ca27df828ada877a893e54ea3e6ea29e62d6e7693af7cbee59ccdb4045d0e6eeec3d8f59205f324a5f7cf5f871929c83ada04bc5d3990288dca5eb312339933ffb1031e05866e1b2d0aad0ca940795458b7d6c8a3750a76e1e6c8ccd48ca542d6c51164431d70c9d35f0f828cdec404a175a44bc2a9651ec5281c0f3aee9e4375f0eb139f58fa4419fddf9ebe2f8f37121a57397e7e830ac097ed375521a68f7cdc471621b769fef40cd19d8d55a82e27bf5b0cc4182359db7c9066e2ee10df279a89e96fcfea225995f065f7f286b8c8ef9b6c82a34df14dda2f737f557578ce5b15944e3149110102d80465c1b436b6bbb16fdc64a9d130ec7644bc162f0e2c5669a9254970a062561e269d85b72b4748d71d88ca20778287bc3b9613043166862f133f366f6361b9e1d040bbcd9728a70fcf3be7ea8fe0f55980ed03f336ec49f7cb6899813acf47d3b2413e7b637b764fcb9003ece75f8a255b9cdc71f80dbbaa7eaa2111b5551feeb7ea31620a2c88897538915abedcd184d57c79d81505985f561820449c330bc3412bffb68c4c743c5a5a3acafcf00d7561a66f70e5835da530ba62f221211e1fefdc1fbc8c05b1b68b7eb2afac6ebbbc0b961b8ef8b27b555ce7641f6601ac19d5f4adb06b40155a2085ff32de5b2c5edd96a01a14d1bb49b58f1fd718bec428043819b8070e46f0215d2153318320754638d9b40a5214784e7c1f80dde05500cfe8e4dff855504e099634fb3d44829453cf4ac8db7e5a4144f96d4508de90ada04240637fd5b261cfbb80c8d9ccdea6c1d3485a85663cff9749133002c7f9c6ea4de1b50fe90dae397f6b5833e943e6c5f60e10d805e97e6869488b857b44d8c94276f668257c223e2e26dff75222d3f304f8a040ce058e1b7b3bc5f0b69c310beea64212ef0a54bc9fb858c25681cee574c532b64d4f8241e0b855f7f79d0a1ea22fc3d9ad5a1658b5c4d9d417e9eae47c81628341172609a8ef8c72fb6e4e48da6a10207e56b727f65c82d49e2dbb44b492e1265c2b28f98980334ccc3abb0cfd15d73c2f38f4c824022aa7a0ac0b7d35eea934d3455d21e8c710474e54bdf29be107ebc00", 0xa943708f26830065}, 0x1006) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) dup3(r1, r0, 0x0) 09:01:24 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)=""/55, 0x37}, {0x0}], 0x2}, 0x0) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x1014a, 0x0, 0x0, 0x800e00515) shutdown(r1, 0x0) shutdown(0xffffffffffffffff, 0x0) recvfrom$inet(r2, 0x0, 0xfffffc95, 0x0, 0x0, 0x800e0051e) shutdown(r2, 0x0) 09:01:24 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:24 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:24 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:24 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:24 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:24 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) fcntl$addseals(0xffffffffffffffff, 0x409, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r0, 0x400442c8, &(0x7f0000000140)={0x4, 0x0}) [ 480.242691][ T7649] device bridge_slave_1 left promiscuous mode [ 480.248875][ T7649] bridge0: port 2(bridge_slave_1) entered disabled state [ 480.302601][ T7649] device bridge_slave_0 left promiscuous mode [ 480.308807][ T7649] bridge0: port 1(bridge_slave_0) entered disabled state [ 480.982198][ T7649] device hsr_slave_0 left promiscuous mode [ 481.022027][ T7649] device hsr_slave_1 left promiscuous mode [ 481.068440][ T7649] team0 (unregistering): Port device team_slave_1 removed [ 481.078668][ T7649] team0 (unregistering): Port device team_slave_0 removed [ 481.089203][ T7649] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 481.145951][ T7649] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 481.223549][ T7649] bond0 (unregistering): Released all slaves [ 481.311068][T17925] IPVS: ftp: loaded support on port[0] = 21 [ 481.361249][T17925] chnl_net:caif_netlink_parms(): no params data found [ 481.387145][T17925] bridge0: port 1(bridge_slave_0) entered blocking state [ 481.394305][T17925] bridge0: port 1(bridge_slave_0) entered disabled state [ 481.402036][T17925] device bridge_slave_0 entered promiscuous mode [ 481.409483][T17925] bridge0: port 2(bridge_slave_1) entered blocking state [ 481.416628][T17925] bridge0: port 2(bridge_slave_1) entered disabled state [ 481.424656][T17925] device bridge_slave_1 entered promiscuous mode [ 481.486468][T17925] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 481.497344][T17925] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 481.516591][T17925] team0: Port device team_slave_0 added [ 481.523500][T17925] team0: Port device team_slave_1 added [ 481.577085][T17925] device hsr_slave_0 entered promiscuous mode 09:01:26 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:26 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:26 executing program 3: pipe(&(0x7f0000000300)) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r0, 0x400442c8, &(0x7f0000000140)={0x4, 0x0}) 09:01:26 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:26 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r0, 0x0, 0x73a0b1b, 0x0, 0x0, 0x800e00549) readv(r0, &(0x7f0000000240)=[{&(0x7f0000000000)=""/229, 0xe5}], 0x1) shutdown(r0, 0x0) [ 481.624920][T17925] device hsr_slave_1 entered promiscuous mode [ 481.662053][T17925] debugfs: Directory 'hsr0' with parent '/' already present! 09:01:26 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d9", 0xc0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 481.711287][T17925] bridge0: port 2(bridge_slave_1) entered blocking state [ 481.718381][T17925] bridge0: port 2(bridge_slave_1) entered forwarding state [ 481.725660][T17925] bridge0: port 1(bridge_slave_0) entered blocking state [ 481.732696][T17925] bridge0: port 1(bridge_slave_0) entered forwarding state [ 481.911667][T17925] 8021q: adding VLAN 0 to HW filter on device bond0 [ 481.974810][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 481.990944][ T7639] bridge0: port 1(bridge_slave_0) entered disabled state [ 482.013124][ T7639] bridge0: port 2(bridge_slave_1) entered disabled state [ 482.053935][T17925] 8021q: adding VLAN 0 to HW filter on device team0 [ 482.065859][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 482.074665][ T7639] bridge0: port 1(bridge_slave_0) entered blocking state [ 482.081717][ T7639] bridge0: port 1(bridge_slave_0) entered forwarding state [ 482.106953][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 482.116265][ T7613] bridge0: port 2(bridge_slave_1) entered blocking state [ 482.123315][ T7613] bridge0: port 2(bridge_slave_1) entered forwarding state [ 482.135487][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 482.147228][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 482.164273][T17925] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 482.175170][T17925] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 482.187819][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 482.196263][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 482.204909][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 482.216804][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 482.229785][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 482.237393][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 482.247771][T17925] 8021q: adding VLAN 0 to HW filter on device batadv0 09:01:27 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:27 executing program 1: mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) mount(0x0, &(0x7f0000000480)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000080)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//file0\x00', 0x0) 09:01:27 executing program 3: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = open(&(0x7f0000000080)='./file0\x00', 0x40c5, 0x0) r4 = open$dir(&(0x7f0000000380)='./file0\x00', 0x0, 0x0) write$9p(r3, &(0x7f0000001400)="3b27a4b46ee92b4a59073c369a5e19f9db153c4fdbc76aa2a4bb9f3e5e1aa197a9e97d1016c01813792e50c2692c175aad715d110a892949ccc6e2e54c2d5c8f0b7932b69797f217168b0c1feb128ae34f0daf487a70b5c117acd43725fe17993634f1695dabd7f998cd55e9d5bd911e86aa7a4ad75a574bb96951d6018b25d942a9544bca1ebb0e8d10c092cdcb85797673972099e4041aaf8d636f66cb1103ef2050ad28fabaed33d6927889d97f4b5ce0de71d3fd832980f4f088d0d824e20549b4bbd906ffa51ce9de54d779eb4de462faac20a3ab0ed9934373ca22cea5454f4c2a740cd461e39956bb5f98df2aebc60cf32623adbffbcc378fa7250b6a3fc863dadcf6d4f8b855c4e70f0796eee6218445dad2811dd6b540ff52efa2f167dd9c1b8b016268d37db430983fefc0645d20614c8df2eb0872c58e09664e672b0b6a9970fec199257e1c606ec3e364c66a0f4d258c74accd43b987c756d602fd8787fed3aa43fd8d84e9656d4a413fa9a423bc54b873583d6d497005e54712fafc71384988d80134fbf84f53fdd74b354848006b8b5b67e7cc5a472475d3ae545ca1fcf7628b873e31ba83a98a7ad5b0cfbe9711b517a9a1388ad0efa2a3b4e22152021d631b731e2e100a9831111db7acce948bb5deeea260463c140ac929e77c58402776caf85d4569a75dde2f64c4491508afb541ed9b2c81fc95c06706235f383e31cf662c95b1e49cfd94871e22720a41535756e419b271276941692bd023dd9c9dbec4f7db1e5c00d8b3be7b8e826a6aadd001edd0dfeb00f8048442b5c48456fd642e629dcb2ff55592665ff491cd832672ce4d999da186db2c3a1f8b6b1f7d3750d7cdb3097954e6e14fb2183ad662c63d4ce8b82dc2487f0fe2ea2827b53a7c6dcced878d2fb29c1d3ff583570e7bc172d1a5c716e0447cb08ce3c468ffdf975da372f3f3eb455aaf5822bc04a51b6cad24a2331369df81c123b009a2381b42e9aeb077f621608d81c12a5f5c6c295d74afd4dd5c051296be0b54c70bf899b347c36bff62f313079983409d7f9cf1242c917985c1b5d0736fe21f8514f63d0369a374c42da40bd5140bc3e602d00c3cb4f8e621863ab47422778d67d72de34753fd72cef80649a1548e4e8dcbcffe4054cc9d8a1f922623a75904cbdaacde768131e587269a4a99d82f7009c1b8ab79aa232a2fd45ad71b603803123f6ba979fa6a87525884b08d721a21400fb1f950b96ead82f408cc4388d3b78fb456616429a520656d5e5a876fd04748498902c86f58d45f4c1b3919eb846a00edf07e7a830bf723e4774f085f15534dd3b5246c0c0970b5ad7bb39b30b156a9430378c5b0aab1261c78d72ac301cd552d5e8dd4b642ec1dc0672745d593bb26d095b5b23576e3cfd6ab580f6e09419d0f0c64250fafaa3759aa1888da48d89c3f7c9454b0b3d0ab40445f5bed4493ef43ab08f31b1345ac4ffd94ad79c9eee53904ed6f572817153190d2e6863f2e39356bb99926419fd314341a536b7e76cae60bf7750a4c29e3f4c7f005530b1d4ee0e25b93b76fcc1108222f0b00de52cf4100e97adfd7b9db1370586ba27e1e183299be00d0df8439c380edf2f79deb441eac59b814b04accdff5e17f02046139f91f0332661676ff506e575f0cb2850bcc9f8666f6d1f69f8f4271cb804a79fccd7016f049d1a494c26a527c437fa0be6d51ec7543d9bd7a2f016194ebe3c99080a6c9b5119863dfe865f8e60cae29f50b67dbfaa0a3c9794d73034485ca1613344c572783db3dfab01b28089c51cda99cefa4c1c881a29e229f04c7e0fd04dc425ae8417852e6e31520c6207e9d4e35285feef2a2cb8a3bceb08a166fa4284a516362621e2c06731a442791f1db063a32cf1f005c914102c7273cb4d7ab1bf567d72f230783d2ea99c43a60e8729132441ee6c5362c33f9b613f84417c3c5549f4e3d9e73c6f83f16c8e57ae22fe5f54515e111fe43ad7c400d214281452bb6141cecad84b23a695f061988d906d03be5d89584634b9e9d9a9b072f8e7cbb47c47719318a2001cafa665dd2c82672d16877ea115bd023fc1975f7c59664bfb06f66a1a5e3f05cb283fb45ea67a2727ee6e10bf35b31fdd03d43ec67b753f6737e0d2f4a5275031595878cefc8f0ca", 0x600) sendfile(r3, r4, 0x0, 0x10000) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xffd7) splice(r0, 0x0, r2, 0x0, 0x80000000, 0x0) 09:01:27 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:27 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:27 executing program 1: mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) mount(0x0, &(0x7f0000000480)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000080)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//file0\x00', 0x0) [ 482.527895][ T26] audit: type=1804 audit(1575018087.606:40): pid=18069 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir812193528/syzkaller.JaqhUt/262/file0" dev="sda1" ino=17310 res=1 [ 482.608468][T18082] fuse: Bad value for 'fd' [ 483.772544][ T7649] device bridge_slave_1 left promiscuous mode [ 483.778891][ T7649] bridge0: port 2(bridge_slave_1) entered disabled state [ 483.812750][ T7649] device bridge_slave_0 left promiscuous mode [ 483.819073][ T7649] bridge0: port 1(bridge_slave_0) entered disabled state [ 484.512426][ T7649] device hsr_slave_0 left promiscuous mode [ 484.551981][ T7649] device hsr_slave_1 left promiscuous mode [ 484.598672][ T7649] team0 (unregistering): Port device team_slave_1 removed [ 484.609010][ T7649] team0 (unregistering): Port device team_slave_0 removed [ 484.619054][ T7649] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 484.665560][ T7649] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface 09:01:29 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:29 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:29 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:29 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000001080)=[{&(0x7f0000000cc0)=""/73, 0x49}, {0x0}], 0x2}, 0x40002) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x10000040c, 0x0, 0x0, 0x800e0086e) shutdown(r1, 0x0) r3 = socket$inet6_udp(0x1c, 0x2, 0x0) recvmsg(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f00000009c0)=""/118, 0x2a0}, {0x0}], 0x2}, 0x0) socket$unix(0x1, 0x0, 0x0) shutdown(r2, 0x0) 09:01:29 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r0, &(0x7f0000000780)=[{&(0x7f0000000100)=""/250, 0xfa}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x1008d, 0x0, 0x0, 0x800e00527) shutdown(r1, 0x0) recvfrom$inet(0xffffffffffffffff, 0x0, 0x10101, 0x0, 0x0, 0x800e00749) shutdown(0xffffffffffffffff, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) recvfrom$inet(r2, 0x0, 0xfffffdc4, 0x2, 0x0, 0x800e00525) shutdown(r2, 0x0) [ 484.741444][ T7649] bond0 (unregistering): Released all slaves 09:01:30 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:30 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:30 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r0, &(0x7f0000000080)=[{&(0x7f0000000140)=""/4096, 0x1000}], 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0xfd1d, 0x0, 0x0, 0x800e00526) shutdown(r0, 0x0) setitimer(0x0, &(0x7f0000000000)={{0x100000001}, {0x0, 0x4}}, 0x0) recvfrom$inet(r1, 0x0, 0x10000051f, 0x0, 0x0, 0x800e00521) shutdown(r1, 0x0) 09:01:30 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:30 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:30 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$sock_timeval(r0, 0xffff, 0x1006, &(0x7f0000000000)={0x3}, 0x10) shmget(0x2, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil) recvfrom$inet(r0, 0x0, 0x2bdda7e8, 0x0, 0x0, 0x800e00608) shutdown(r0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(0xffffffffffffffff, 0x0, 0x0) dup(0xffffffffffffffff) 09:01:30 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:30 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:30 executing program 3: poll(0x0, 0x0, 0x4c) r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0x24f, 0x0, 0x0, 0x800e00388) getegid() recvfrom$inet(r0, 0x0, 0x58d, 0x0, 0x0, 0x800e004e5) shutdown(r0, 0x0) [ 487.363427][T18545] IPVS: ftp: loaded support on port[0] = 21 [ 487.413542][T18545] chnl_net:caif_netlink_parms(): no params data found [ 487.438023][T18545] bridge0: port 1(bridge_slave_0) entered blocking state [ 487.445148][T18545] bridge0: port 1(bridge_slave_0) entered disabled state [ 487.453077][T18545] device bridge_slave_0 entered promiscuous mode [ 487.460625][T18545] bridge0: port 2(bridge_slave_1) entered blocking state [ 487.467917][T18545] bridge0: port 2(bridge_slave_1) entered disabled state [ 487.475786][T18545] device bridge_slave_1 entered promiscuous mode [ 487.492085][T18545] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 487.503052][T18545] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 487.520176][T18545] team0: Port device team_slave_0 added [ 487.527033][T18545] team0: Port device team_slave_1 added [ 487.584202][T18545] device hsr_slave_0 entered promiscuous mode [ 487.622235][T18545] device hsr_slave_1 entered promiscuous mode [ 487.671985][T18545] debugfs: Directory 'hsr0' with parent '/' already present! [ 487.686085][T18545] bridge0: port 2(bridge_slave_1) entered blocking state [ 487.693196][T18545] bridge0: port 2(bridge_slave_1) entered forwarding state [ 487.700555][T18545] bridge0: port 1(bridge_slave_0) entered blocking state [ 487.707622][T18545] bridge0: port 1(bridge_slave_0) entered forwarding state [ 487.736714][T18545] 8021q: adding VLAN 0 to HW filter on device bond0 [ 487.748322][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 487.756750][ T7704] bridge0: port 1(bridge_slave_0) entered disabled state [ 487.764676][ T7704] bridge0: port 2(bridge_slave_1) entered disabled state [ 487.774229][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 487.785989][T18545] 8021q: adding VLAN 0 to HW filter on device team0 [ 487.796744][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 487.805271][ T7639] bridge0: port 1(bridge_slave_0) entered blocking state [ 487.812329][ T7639] bridge0: port 1(bridge_slave_0) entered forwarding state [ 487.822934][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 487.831510][ T7704] bridge0: port 2(bridge_slave_1) entered blocking state [ 487.838630][ T7704] bridge0: port 2(bridge_slave_1) entered forwarding state [ 487.861747][T18545] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 487.874009][T18545] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 487.887927][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 487.896574][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 487.905188][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 487.913945][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 487.922230][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 487.929911][ T7639] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 487.946190][T18545] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 487.953624][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 487.961113][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 09:01:33 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:33 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = socket(0x100000000000011, 0x2, 0x81) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x42201, 0x0) dup(r2) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) r3 = open(&(0x7f000000cc80)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x87ffd) sendfile(r0, r3, 0x0, 0x800000000024) 09:01:33 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)=""/55, 0x37}], 0x1}, 0x0) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x1014a, 0x0, 0x0, 0x800e00515) shutdown(r1, 0x0) shutdown(0xffffffffffffffff, 0x0) recvfrom$inet(r2, 0x0, 0xfffffc95, 0x0, 0x0, 0x800e0051e) shutdown(r2, 0x0) 09:01:33 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:33 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) [ 488.274488][T18570] fuse: Bad value for 'fd' 09:01:33 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:33 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:33 executing program 1: socket$inet_udplite(0x2, 0x2, 0x88) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(0xffffffffffffffff) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) mount(0x0, &(0x7f0000000040)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1509ff9b461618f1, @perf_config_ext={0x0, 0xb8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000780)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0) unlink(&(0x7f00000003c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00') sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000240)="24000000180007841dfffd946f610500020f81001f038b050200080008000b000a00ff7e2800", 0x26}], 0x1}, 0x0) accept4$inet(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x0, @broadcast}, &(0x7f0000000180)=0x10, 0x800) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) 09:01:33 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:33 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:33 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f000012afe4)={0xa, 0x4e22, 0x0, @empty}, 0x1c) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) listen(r1, 0x2) sendto$inet6(r0, 0x0, 0x0, 0x20000003, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) shutdown(0xffffffffffffffff, 0x0) 09:01:33 executing program 1: r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00006dbffc), 0x4) setsockopt$RDS_CONG_MONITOR(r0, 0x114, 0x6, &(0x7f0000000080)=0x1, 0x4) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$xdp(r0, &(0x7f0000000100)={0x0, 0x302, &(0x7f0000000740)=[{&(0x7f0000001300)="fe", 0x1}], 0x1}, 0x0) sendto$inet(r0, &(0x7f0000000900)="ba671368d1010000004900000001000000018be49e9301442865319997d0efdb2f54b6a10c7327757482bfce945c2a91fb8dfafc1d3f56bc543ab87321e12cca08a744a2d128b00634bc882151d36809229a96bc3437ef159489384ade077ba295eac2882dbfd3781dd4d4e609c42628dbb709b3eb1fa030009045dd98b9e6d77b6cec9ceb685595d43995e0f04c32260943add79831e661c6a351dedc8b9d220fbf9fb6e44fb6a629ce9a82025124fec9f3ee751f7da0cd7e799be88ddbdac20b48e890ff81d7fa28c2d017d7932f2569038740461accd4582f576e4fdb6150a3399f8266bc19eb943648ad1ad81420ed6c382436e474390c8995e829e4f9df43eed85a60b9ee254e31eb62900857fa134e76cc64880334adbff069a2e5e647d2ed36a96b23834b6f6ca6b8113baf4cf30347fbb7ffc30aea99872cc0dba03b07d3347b2d257edbe2733c26b7337a79962d8ce85469e3bcbe0e4a48a6ae69d13f2d4b5155b390ef67aa714b82b6313ee277cb8986eca5db2e97cb1ae2243bba80274f614ece521baef484394b4c161cb9ae926e21892578b49cfd6efe1cb1572148c10d92218ed73ec116a18de80ac42d2726a4523a764fc6dc356c5fbbf9d2c947ae3bc9a3dc76099f3257c8d5952876151b0326d8cb1d5683ee4ad5ded9a34c00ac1b03f34627ec18a7c2e92c87b7896549cfab5eb55fa85a970994bd4b22b5f0d045e241256d06f485a47b4a55ed389bc1734541232cd41908b5cfa4b8fcfcafce500a0c7ae99767713a98e7927aa69f6ccd7daea62f19ceb82559f41899c9a9aee99113e7e64b5f8b9824be9fdbfa4dd4995673d882bb4daeb64413b334e114965d2ba3cea8051e692508701b9400cb12eae457f8b8549944091b729160939918d8fcae611a5ded665f770db637487a236da1a58ba7566668651a77171fc4fe506496d19059343dbe4f426625d3f2b705f54581372361770bf5a9098a9fafefaf546426b294239ac33e3186e4d58ad2fa995a6ad4dc074e7cca11aead109563b2076c7c6e9f57ec63df960804e2e7f9d8444de9550cca3df7834d864e9777291c2e1f6205de2e43dc995ab8bb1515a365efc2830fa3e7a1dd137f550d6035212bc1f51c3b4ceea430df49ffc9210084ef156ad7e0d219efd6c116693735b44521d389969a3a65617cd2fd6e14060601cee4cd054cf36fe048b57d1d9ee3cad2a73552449926b4a69823823af35bc53e9d339be086e8b03fbe9c0ec68357e1fbe52eee7b67f5870c0aefb7ee8236747e0d67a26725fb515544cbbe8464da94cfd8c0b94bb4e51a263b1749bd0a7cf651931f806d1b928d1f9994f1ad4d50e6a5cd7a8e4e687f8564fdacc864013d095ba9d5709eced3c28eabda476d177a7836400a01e02beeb5a6636d4064fdda344967ad8682d14b87c71727cb66be27d1d39191f4223c545b62fb4860262ba8076a65dbc194cee1df846c584b7bbe9dce6e6895b2cbbb64b03b5554a4845cc3de2f939ef918421af9a5e9157e837651245299c03992d0ddee06bd22a31522aca0f309b1feccebc0b1c0ed9d21c19bfd15cd313ff64394fd6a10904890c9f6d646b026f27253e8f584c3ffd20ad67e8b", 0x480, 0x0, 0x0, 0xfffffff1) 09:01:33 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:33 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:34 executing program 1: r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00006dbffc), 0x4) setsockopt$RDS_CONG_MONITOR(r0, 0x114, 0x6, &(0x7f0000000080)=0x1, 0x4) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$xdp(r0, &(0x7f0000000100)={0x0, 0x302, &(0x7f0000000740)=[{&(0x7f0000001300)="fe", 0x1}], 0x1}, 0x0) sendto$inet(r0, &(0x7f0000000900)="ba671368d1010000004900000001000000018be49e9301442865319997d0efdb2f54b6a10c7327757482bfce945c2a91fb8dfafc1d3f56bc543ab87321e12cca08a744a2d128b00634bc882151d36809229a96bc3437ef159489384ade077ba295eac2882dbfd3781dd4d4e609c42628dbb709b3eb1fa030009045dd98b9e6d77b6cec9ceb685595d43995e0f04c32260943add79831e661c6a351dedc8b9d220fbf9fb6e44fb6a629ce9a82025124fec9f3ee751f7da0cd7e799be88ddbdac20b48e890ff81d7fa28c2d017d7932f2569038740461accd4582f576e4fdb6150a3399f8266bc19eb943648ad1ad81420ed6c382436e474390c8995e829e4f9df43eed85a60b9ee254e31eb62900857fa134e76cc64880334adbff069a2e5e647d2ed36a96b23834b6f6ca6b8113baf4cf30347fbb7ffc30aea99872cc0dba03b07d3347b2d257edbe2733c26b7337a79962d8ce85469e3bcbe0e4a48a6ae69d13f2d4b5155b390ef67aa714b82b6313ee277cb8986eca5db2e97cb1ae2243bba80274f614ece521baef484394b4c161cb9ae926e21892578b49cfd6efe1cb1572148c10d92218ed73ec116a18de80ac42d2726a4523a764fc6dc356c5fbbf9d2c947ae3bc9a3dc76099f3257c8d5952876151b0326d8cb1d5683ee4ad5ded9a34c00ac1b03f34627ec18a7c2e92c87b7896549cfab5eb55fa85a970994bd4b22b5f0d045e241256d06f485a47b4a55ed389bc1734541232cd41908b5cfa4b8fcfcafce500a0c7ae99767713a98e7927aa69f6ccd7daea62f19ceb82559f41899c9a9aee99113e7e64b5f8b9824be9fdbfa4dd4995673d882bb4daeb64413b334e114965d2ba3cea8051e692508701b9400cb12eae457f8b8549944091b729160939918d8fcae611a5ded665f770db637487a236da1a58ba7566668651a77171fc4fe506496d19059343dbe4f426625d3f2b705f54581372361770bf5a9098a9fafefaf546426b294239ac33e3186e4d58ad2fa995a6ad4dc074e7cca11aead109563b2076c7c6e9f57ec63df960804e2e7f9d8444de9550cca3df7834d864e9777291c2e1f6205de2e43dc995ab8bb1515a365efc2830fa3e7a1dd137f550d6035212bc1f51c3b4ceea430df49ffc9210084ef156ad7e0d219efd6c116693735b44521d389969a3a65617cd2fd6e14060601cee4cd054cf36fe048b57d1d9ee3cad2a73552449926b4a69823823af35bc53e9d339be086e8b03fbe9c0ec68357e1fbe52eee7b67f5870c0aefb7ee8236747e0d67a26725fb515544cbbe8464da94cfd8c0b94bb4e51a263b1749bd0a7cf651931f806d1b928d1f9994f1ad4d50e6a5cd7a8e4e687f8564fdacc864013d095ba9d5709eced3c28eabda476d177a7836400a01e02beeb5a6636d4064fdda344967ad8682d14b87c71727cb66be27d1d39191f4223c545b62fb4860262ba8076a65dbc194cee1df846c584b7bbe9dce6e6895b2cbbb64b03b5554a4845cc3de2f939ef918421af9a5e9157e837651245299c03992d0ddee06bd22a31522aca0f309b1feccebc0b1c0ed9d21c19bfd15cd313ff64394fd6a10904890c9f6d646b026f27253e8f584c3ffd20ad67e8b", 0x480, 0x0, 0x0, 0xfffffff1) [ 489.882432][ T7649] device bridge_slave_1 left promiscuous mode [ 489.888686][ T7649] bridge0: port 2(bridge_slave_1) entered disabled state [ 489.952619][ T7649] device bridge_slave_0 left promiscuous mode [ 489.958957][ T7649] bridge0: port 1(bridge_slave_0) entered disabled state [ 490.652191][ T7649] device hsr_slave_0 left promiscuous mode [ 490.701990][ T7649] device hsr_slave_1 left promiscuous mode [ 490.758579][ T7649] team0 (unregistering): Port device team_slave_1 removed [ 490.772937][ T7649] team0 (unregistering): Port device team_slave_0 removed [ 490.787031][ T7649] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 490.845673][ T7649] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 490.922286][ T7649] bond0 (unregistering): Released all slaves [ 491.018973][T18812] IPVS: ftp: loaded support on port[0] = 21 [ 491.071356][T18812] chnl_net:caif_netlink_parms(): no params data found [ 491.096979][T18812] bridge0: port 1(bridge_slave_0) entered blocking state [ 491.104253][T18812] bridge0: port 1(bridge_slave_0) entered disabled state [ 491.111814][T18812] device bridge_slave_0 entered promiscuous mode 09:01:36 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:36 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:36 executing program 3: r0 = io_uring_setup(0xf9, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, [], {0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r0) 09:01:36 executing program 1: perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe2$9p(&(0x7f0000000140), 0x84000) write$P9_RWALK(0xffffffffffffffff, &(0x7f0000000180)=ANY=[@ANYBLOB="300000006f0200030010000000000700000000000000040000070000000000000000000087000000150000f4ffffff00"], 0x30) r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00006dbffc), 0x4) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$xdp(r0, &(0x7f0000000100)={0x0, 0x302, &(0x7f0000000740)=[{&(0x7f0000001300)="fe", 0x1}], 0x1}, 0x0) sendto$inet(r0, &(0x7f0000000900)="ba671368d1010000004900000001000000018be49e9301442865319997d0efdb2f54b6a10c7327757482bfce945c2a91fb8dfafc1d3f56bc543ab87321e12cca08a744a2d128b00634bc882151d36809229a96bc3437ef159489384ade077ba295eac2882dbfd3781dd4d4e609c42628dbb709b3eb1fa030009045dd98b9e6d77b6cec9ceb685595d43995e0f04c32260943add79831e661c6a351dedc8b9d220fbf9fb6e44fb6a629ce9a82025124fec9f3ee751f7da0cd7e799be88ddbdac20b48e890ff81d7fa28c2d017d7932f2569038740461accd4582f576e4fdb6150a3399f8266bc19eb943648ad1ad81420ed6c382436e474390c8995e829e4f9df43eed85a60b9ee254e31eb62900857fa134e76cc64880334adbff069a2e5e647d2ed36a96b23834b6f6ca6b8113baf4cf30347fbb7ffc30aea99872cc0dba03b07d3347b2d257edbe2733c26b7337a79962d8ce85469e3bcbe0e4a48a6ae69d13f2d4b5155b390ef67aa714b82b6313ee277cb8986eca5db2e97cb1ae2243bba80274f614ece521baef484394b4c161cb9ae926e21892578b49cfd6efe1cb1572148c10d92218ed73ec116a18de80ac42d2726a4523a764fc6dc356c5fbbf9d2c947ae3bc9a3dc76099f3257c8d5952876151b0326d8cb1d5683ee4ad5ded9a34c00ac1b03f34627ec18a7c2e92c87b7896549cfab5eb55fa85a970994bd4b22b5f0d045e241256d06f485a47b4a55ed389bc1734541232cd41908b5cfa4b8fcfcafce500a0c7ae99767713a98e7927aa69f6ccd7daea62f19ceb82559f41899c9a9aee99113e7e64b5f8b9824be9fdbfa4dd4995673d882bb4daeb64413b334e114965d2ba3cea8051e692508701b9400cb12eae457f8b8549944091b729160939918d8fcae611a5ded665f770db637487a236da1a58ba7566668651a77171fc4fe506496d19059343dbe4f426625d3f2b705f54581372361770bf5a9098a9fafefaf546426b294239ac33e3186e4d58ad2fa995a6ad4dc074e7cca11aead109563b2076c7c6e9f57ec63df960804e2e7f9d8444de9550cca3df7834d864e9777291c2e1f6205de2e43dc995ab8bb1515a365efc2830fa3e7a1dd137f550d6035212bc1f51c3b4ceea430df49ffc9210084ef156ad7e0d219efd6c116693735b44521d389969a3a65617cd2fd6e14060601cee4cd054cf36fe048b57d1d9ee3cad2a73552449926b4a69823823af35bc53e9d339be086e8b03fbe9c0ec68357e1fbe52eee7b67f5870c0aefb7ee8236747e0d67a26725fb515544cbbe8464da94cfd8c0b94bb4e51a263b1749bd0a7cf651931f806d1b928d1f9994f1ad4d50e6a5cd7a8e4e687f8564fdacc864013d095ba9d5709eced3c28eabda476d177a7836400a01e02beeb5a6636d4064fdda344967ad8682d14b87c71727cb66be27d1d39191f4223c545b62fb4860262ba8076a65dbc194cee1df846c584b7bbe9dce6e6895b2cbbb64b03b5554a4845cc3de2f939ef918421af9a5e9157e837651245299c03992d0ddee06bd22a31522aca0f309b1feccebc0b1c0ed9d21c19bfd15cd313ff64394fd6a10904890c9f6d646b026f27253e8f584c3ffd20ad67e8b", 0x480, 0x0, 0x0, 0xfffffff1) [ 491.119577][T18812] bridge0: port 2(bridge_slave_1) entered blocking state [ 491.126639][T18812] bridge0: port 2(bridge_slave_1) entered disabled state [ 491.134331][T18812] device bridge_slave_1 entered promiscuous mode [ 491.151363][T18812] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 491.162026][T18812] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 491.215316][T18812] team0: Port device team_slave_0 added [ 491.228000][T18812] team0: Port device team_slave_1 added 09:01:36 executing program 1: perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe2$9p(&(0x7f0000000140), 0x84000) write$P9_RWALK(0xffffffffffffffff, &(0x7f0000000180)=ANY=[@ANYBLOB="300000006f0200030010000000000700000000000000040000070000000000000000000087000000150000f4ffffff00"], 0x30) r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00006dbffc), 0x4) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$xdp(r0, &(0x7f0000000100)={0x0, 0x302, &(0x7f0000000740)=[{&(0x7f0000001300)="fe", 0x1}], 0x1}, 0x0) sendto$inet(r0, &(0x7f0000000900)="ba671368d1010000004900000001000000018be49e9301442865319997d0efdb2f54b6a10c7327757482bfce945c2a91fb8dfafc1d3f56bc543ab87321e12cca08a744a2d128b00634bc882151d36809229a96bc3437ef159489384ade077ba295eac2882dbfd3781dd4d4e609c42628dbb709b3eb1fa030009045dd98b9e6d77b6cec9ceb685595d43995e0f04c32260943add79831e661c6a351dedc8b9d220fbf9fb6e44fb6a629ce9a82025124fec9f3ee751f7da0cd7e799be88ddbdac20b48e890ff81d7fa28c2d017d7932f2569038740461accd4582f576e4fdb6150a3399f8266bc19eb943648ad1ad81420ed6c382436e474390c8995e829e4f9df43eed85a60b9ee254e31eb62900857fa134e76cc64880334adbff069a2e5e647d2ed36a96b23834b6f6ca6b8113baf4cf30347fbb7ffc30aea99872cc0dba03b07d3347b2d257edbe2733c26b7337a79962d8ce85469e3bcbe0e4a48a6ae69d13f2d4b5155b390ef67aa714b82b6313ee277cb8986eca5db2e97cb1ae2243bba80274f614ece521baef484394b4c161cb9ae926e21892578b49cfd6efe1cb1572148c10d92218ed73ec116a18de80ac42d2726a4523a764fc6dc356c5fbbf9d2c947ae3bc9a3dc76099f3257c8d5952876151b0326d8cb1d5683ee4ad5ded9a34c00ac1b03f34627ec18a7c2e92c87b7896549cfab5eb55fa85a970994bd4b22b5f0d045e241256d06f485a47b4a55ed389bc1734541232cd41908b5cfa4b8fcfcafce500a0c7ae99767713a98e7927aa69f6ccd7daea62f19ceb82559f41899c9a9aee99113e7e64b5f8b9824be9fdbfa4dd4995673d882bb4daeb64413b334e114965d2ba3cea8051e692508701b9400cb12eae457f8b8549944091b729160939918d8fcae611a5ded665f770db637487a236da1a58ba7566668651a77171fc4fe506496d19059343dbe4f426625d3f2b705f54581372361770bf5a9098a9fafefaf546426b294239ac33e3186e4d58ad2fa995a6ad4dc074e7cca11aead109563b2076c7c6e9f57ec63df960804e2e7f9d8444de9550cca3df7834d864e9777291c2e1f6205de2e43dc995ab8bb1515a365efc2830fa3e7a1dd137f550d6035212bc1f51c3b4ceea430df49ffc9210084ef156ad7e0d219efd6c116693735b44521d389969a3a65617cd2fd6e14060601cee4cd054cf36fe048b57d1d9ee3cad2a73552449926b4a69823823af35bc53e9d339be086e8b03fbe9c0ec68357e1fbe52eee7b67f5870c0aefb7ee8236747e0d67a26725fb515544cbbe8464da94cfd8c0b94bb4e51a263b1749bd0a7cf651931f806d1b928d1f9994f1ad4d50e6a5cd7a8e4e687f8564fdacc864013d095ba9d5709eced3c28eabda476d177a7836400a01e02beeb5a6636d4064fdda344967ad8682d14b87c71727cb66be27d1d39191f4223c545b62fb4860262ba8076a65dbc194cee1df846c584b7bbe9dce6e6895b2cbbb64b03b5554a4845cc3de2f939ef918421af9a5e9157e837651245299c03992d0ddee06bd22a31522aca0f309b1feccebc0b1c0ed9d21c19bfd15cd313ff64394fd6a10904890c9f6d646b026f27253e8f584c3ffd20ad67e8b", 0x480, 0x0, 0x0, 0xfffffff1) [ 491.334384][T18812] device hsr_slave_0 entered promiscuous mode [ 491.372875][T18812] device hsr_slave_1 entered promiscuous mode [ 491.432491][T18812] debugfs: Directory 'hsr0' with parent '/' already present! [ 491.472721][T18812] bridge0: port 2(bridge_slave_1) entered blocking state [ 491.480522][T18812] bridge0: port 2(bridge_slave_1) entered forwarding state [ 491.487929][T18812] bridge0: port 1(bridge_slave_0) entered blocking state [ 491.495038][T18812] bridge0: port 1(bridge_slave_0) entered forwarding state [ 491.588044][T18812] 8021q: adding VLAN 0 to HW filter on device bond0 [ 491.600194][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 491.608594][ T7613] bridge0: port 1(bridge_slave_0) entered disabled state [ 491.618725][ T7613] bridge0: port 2(bridge_slave_1) entered disabled state [ 491.635757][T18812] 8021q: adding VLAN 0 to HW filter on device team0 [ 491.649356][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 491.659854][ T7613] bridge0: port 1(bridge_slave_0) entered blocking state [ 491.666905][ T7613] bridge0: port 1(bridge_slave_0) entered forwarding state 09:01:36 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:36 executing program 1: perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe2$9p(&(0x7f0000000140), 0x84000) write$P9_RWALK(0xffffffffffffffff, &(0x7f0000000180)=ANY=[@ANYBLOB="300000006f0200030010000000000700000000000000040000070000000000000000000087000000150000f4ffffff00"], 0x30) r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00006dbffc), 0x4) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$xdp(r0, &(0x7f0000000100)={0x0, 0x302, &(0x7f0000000740)=[{&(0x7f0000001300)="fe", 0x1}], 0x1}, 0x0) sendto$inet(r0, &(0x7f0000000900)="ba671368d1010000004900000001000000018be49e9301442865319997d0efdb2f54b6a10c7327757482bfce945c2a91fb8dfafc1d3f56bc543ab87321e12cca08a744a2d128b00634bc882151d36809229a96bc3437ef159489384ade077ba295eac2882dbfd3781dd4d4e609c42628dbb709b3eb1fa030009045dd98b9e6d77b6cec9ceb685595d43995e0f04c32260943add79831e661c6a351dedc8b9d220fbf9fb6e44fb6a629ce9a82025124fec9f3ee751f7da0cd7e799be88ddbdac20b48e890ff81d7fa28c2d017d7932f2569038740461accd4582f576e4fdb6150a3399f8266bc19eb943648ad1ad81420ed6c382436e474390c8995e829e4f9df43eed85a60b9ee254e31eb62900857fa134e76cc64880334adbff069a2e5e647d2ed36a96b23834b6f6ca6b8113baf4cf30347fbb7ffc30aea99872cc0dba03b07d3347b2d257edbe2733c26b7337a79962d8ce85469e3bcbe0e4a48a6ae69d13f2d4b5155b390ef67aa714b82b6313ee277cb8986eca5db2e97cb1ae2243bba80274f614ece521baef484394b4c161cb9ae926e21892578b49cfd6efe1cb1572148c10d92218ed73ec116a18de80ac42d2726a4523a764fc6dc356c5fbbf9d2c947ae3bc9a3dc76099f3257c8d5952876151b0326d8cb1d5683ee4ad5ded9a34c00ac1b03f34627ec18a7c2e92c87b7896549cfab5eb55fa85a970994bd4b22b5f0d045e241256d06f485a47b4a55ed389bc1734541232cd41908b5cfa4b8fcfcafce500a0c7ae99767713a98e7927aa69f6ccd7daea62f19ceb82559f41899c9a9aee99113e7e64b5f8b9824be9fdbfa4dd4995673d882bb4daeb64413b334e114965d2ba3cea8051e692508701b9400cb12eae457f8b8549944091b729160939918d8fcae611a5ded665f770db637487a236da1a58ba7566668651a77171fc4fe506496d19059343dbe4f426625d3f2b705f54581372361770bf5a9098a9fafefaf546426b294239ac33e3186e4d58ad2fa995a6ad4dc074e7cca11aead109563b2076c7c6e9f57ec63df960804e2e7f9d8444de9550cca3df7834d864e9777291c2e1f6205de2e43dc995ab8bb1515a365efc2830fa3e7a1dd137f550d6035212bc1f51c3b4ceea430df49ffc9210084ef156ad7e0d219efd6c116693735b44521d389969a3a65617cd2fd6e14060601cee4cd054cf36fe048b57d1d9ee3cad2a73552449926b4a69823823af35bc53e9d339be086e8b03fbe9c0ec68357e1fbe52eee7b67f5870c0aefb7ee8236747e0d67a26725fb515544cbbe8464da94cfd8c0b94bb4e51a263b1749bd0a7cf651931f806d1b928d1f9994f1ad4d50e6a5cd7a8e4e687f8564fdacc864013d095ba9d5709eced3c28eabda476d177a7836400a01e02beeb5a6636d4064fdda344967ad8682d14b87c71727cb66be27d1d39191f4223c545b62fb4860262ba8076a65dbc194cee1df846c584b7bbe9dce6e6895b2cbbb64b03b5554a4845cc3de2f939ef918421af9a5e9157e837651245299c03992d0ddee06bd22a31522aca0f309b1feccebc0b1c0ed9d21c19bfd15cd313ff64394fd6a10904890c9f6d646b026f27253e8f584c3ffd20ad67e8b", 0x480, 0x0, 0x0, 0xfffffff1) 09:01:36 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:36 executing program 3: r0 = io_uring_setup(0xf9, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, [], {0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r0) [ 491.696563][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 491.706200][ T7613] bridge0: port 2(bridge_slave_1) entered blocking state [ 491.713286][ T7613] bridge0: port 2(bridge_slave_1) entered forwarding state [ 491.726026][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 491.736053][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 491.776398][ T7613] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 491.807304][ T3012] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready 09:01:36 executing program 3: r0 = io_uring_setup(0xf9, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, [], {0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r0) [ 491.840845][ T3012] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 491.870203][T18812] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 491.928159][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 491.943053][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 491.980904][T18812] 8021q: adding VLAN 0 to HW filter on device batadv0 09:01:37 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:37 executing program 1: syz_open_dev$sndseq(&(0x7f0000000000)='/dev/ind/\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/icmp\x00') sendfile(r0, r1, &(0x7f0000000040)=0x426, 0xbb30) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r1, 0x40bc5311, &(0x7f0000000100)={0x0, 0x3, 'client1\x00', 0x4, "6e1b9eb791d83803", "80ab30432aead9721d37e32b097723cf8976e6e3070f50b6dba28eb43ed0decd", 0x10000, 0x1ff}) socket(0x1, 0x5, 0x7e) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r2 = getpid() sched_setattr(r2, &(0x7f0000000440)={0x30, 0x2, 0x0, 0x4, 0x8, 0x3, 0x800000000000}, 0x0) socket$inet6(0xa, 0x2, 0x0) shmget(0x3, 0x1000, 0x20, &(0x7f0000ffe000/0x1000)=nil) socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000400)={0x26, 'hash\x00', 0x0, 0x0, 'digest_null\x00'}, 0x58) r7 = accept4(r6, 0x0, 0x0, 0x0) splice(r5, 0x0, r7, 0x0, 0x80000001, 0x0) ioctl$TCSETS2(r5, 0x402c542b, &(0x7f00000000c0)={0x5, 0x7, 0x0, 0x5, 0x3f, "4b4c2956b8a660180f31e34de3e3b24b60505a", 0x3}) fcntl$setpipe(r4, 0x407, 0x0) write(r4, &(0x7f0000000480)="b0a3cdef47f59ec515de0fcb5dfc761cf7120c4312b2054efdc0cf574f65329a05d03a24674b1d94d072b4bd702c576dc1d6e4fef97bdd899d359dadcfe32ba24fb1e152533e4df2c20324dda85d95c102000000d81d2b9bea7f9e468b3da19d62e9913b2f7cd488de25886811470818af91afd3bce1422670d6f2d054d8b16374e3617a22b1c70e7e3104b814e24e6e7b62256ae8faaae5f59f840c029418a34c", 0xffffff47) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x2000, 0x3, 0xfffffffffffffffd}, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r1, 0xc058534b, &(0x7f00000001c0)={0x22afdad6, 0x4cdf, 0x4, 0xe4f6, 0x7, 0x3}) listen(r8, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0xff, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r9 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r9, 0xc0481273, &(0x7f0000000300)={[], 0x0, 0x4, 0x1fd, 0x0, 0x5}) ioctl$BLKTRACESTART(r9, 0x1274, 0x0) ioctl$BLKTRACESTOP(r9, 0x1275, 0x0) [ 493.184607][T18970] debugfs: File 'dropped' in directory 'loop0' already present! [ 493.192376][T18970] debugfs: File 'msg' in directory 'loop0' already present! [ 493.199702][T18970] debugfs: File 'trace0' in directory 'loop0' already present! 09:01:39 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:39 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:39 executing program 3: clone(0x2000000024000300, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000040)={0x0, 0x7530}, 0x10) listen(r0, 0x0) accept$inet(r0, 0x0, 0x0) r1 = memfd_create(&(0x7f0000000180)='&wlan0%*(\x00', 0x0) mmap(&(0x7f0000000000/0xaa2000)=nil, 0xaa2000, 0x5, 0x11, r1, 0x0) rt_sigaction(0x7, &(0x7f0000b4a000)={0xfffffffffffffffd, {0x4000001}, 0x0, 0x0}, 0x0, 0x8, &(0x7f0000000000)) syz_open_procfs(0x0, &(0x7f0000000200)='net/\x14\x00A!') prctl$PR_SET_DUMPABLE(0x4, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000000400)='ch\xf7ldren\x00') 09:01:39 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:39 executing program 1: syz_open_dev$sndseq(&(0x7f0000000000)='/dev/ind/\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/icmp\x00') sendfile(r0, r1, &(0x7f0000000040)=0x426, 0xbb30) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r1, 0x40bc5311, &(0x7f0000000100)={0x0, 0x3, 'client1\x00', 0x4, "6e1b9eb791d83803", "80ab30432aead9721d37e32b097723cf8976e6e3070f50b6dba28eb43ed0decd", 0x10000, 0x1ff}) socket(0x1, 0x5, 0x7e) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r2 = getpid() sched_setattr(r2, &(0x7f0000000440)={0x30, 0x2, 0x0, 0x4, 0x8, 0x3, 0x800000000000}, 0x0) socket$inet6(0xa, 0x2, 0x0) shmget(0x3, 0x1000, 0x20, &(0x7f0000ffe000/0x1000)=nil) socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000400)={0x26, 'hash\x00', 0x0, 0x0, 'digest_null\x00'}, 0x58) r7 = accept4(r6, 0x0, 0x0, 0x0) splice(r5, 0x0, r7, 0x0, 0x80000001, 0x0) ioctl$TCSETS2(r5, 0x402c542b, &(0x7f00000000c0)={0x5, 0x7, 0x0, 0x5, 0x3f, "4b4c2956b8a660180f31e34de3e3b24b60505a", 0x3}) fcntl$setpipe(r4, 0x407, 0x0) write(r4, &(0x7f0000000480)="b0a3cdef47f59ec515de0fcb5dfc761cf7120c4312b2054efdc0cf574f65329a05d03a24674b1d94d072b4bd702c576dc1d6e4fef97bdd899d359dadcfe32ba24fb1e152533e4df2c20324dda85d95c102000000d81d2b9bea7f9e468b3da19d62e9913b2f7cd488de25886811470818af91afd3bce1422670d6f2d054d8b16374e3617a22b1c70e7e3104b814e24e6e7b62256ae8faaae5f59f840c029418a34c", 0xffffff47) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x2000, 0x3, 0xfffffffffffffffd}, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r1, 0xc058534b, &(0x7f00000001c0)={0x22afdad6, 0x4cdf, 0x4, 0xe4f6, 0x7, 0x3}) listen(r8, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0xff, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r9 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r9, 0xc0481273, &(0x7f0000000300)={[], 0x0, 0x4, 0x1fd, 0x0, 0x5}) ioctl$BLKTRACESTART(r9, 0x1274, 0x0) ioctl$BLKTRACESTOP(r9, 0x1275, 0x0) [ 494.541339][T18992] debugfs: File 'dropped' in directory 'loop0' already present! [ 494.549416][T18992] debugfs: File 'msg' in directory 'loop0' already present! [ 494.557121][T18992] debugfs: File 'trace0' in directory 'loop0' already present! 09:01:39 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:39 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:39 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:39 executing program 3: syz_open_dev$sndseq(&(0x7f0000000000)='/dev/ind/\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/icmp\x00') sendfile(r0, r1, &(0x7f0000000040)=0x426, 0xbb30) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r1, 0x40bc5311, &(0x7f0000000100)={0x0, 0x3, 'client1\x00', 0x4, "6e1b9eb791d83803", "80ab30432aead9721d37e32b097723cf8976e6e3070f50b6dba28eb43ed0decd", 0x10000, 0x1ff}) socket(0x1, 0x5, 0x7e) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r2 = getpid() sched_setattr(r2, &(0x7f0000000440)={0x30, 0x2, 0x0, 0x4, 0x8, 0x3, 0x800000000000}, 0x0) socket$inet6(0xa, 0x2, 0x0) shmget(0x3, 0x1000, 0x20, &(0x7f0000ffe000/0x1000)=nil) socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000400)={0x26, 'hash\x00', 0x0, 0x0, 'digest_null\x00'}, 0x58) r7 = accept4(r6, 0x0, 0x0, 0x0) splice(r5, 0x0, r7, 0x0, 0x80000001, 0x0) ioctl$TCSETS2(r5, 0x402c542b, &(0x7f00000000c0)={0x5, 0x7, 0x0, 0x5, 0x3f, "4b4c2956b8a660180f31e34de3e3b24b60505a", 0x3}) fcntl$setpipe(r4, 0x407, 0x0) write(r4, &(0x7f0000000480)="b0a3cdef47f59ec515de0fcb5dfc761cf7120c4312b2054efdc0cf574f65329a05d03a24674b1d94d072b4bd702c576dc1d6e4fef97bdd899d359dadcfe32ba24fb1e152533e4df2c20324dda85d95c102000000d81d2b9bea7f9e468b3da19d62e9913b2f7cd488de25886811470818af91afd3bce1422670d6f2d054d8b16374e3617a22b1c70e7e3104b814e24e6e7b62256ae8faaae5f59f840c029418a34c", 0xffffff47) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x2000, 0x3, 0xfffffffffffffffd}, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r1, 0xc058534b, &(0x7f00000001c0)={0x22afdad6, 0x4cdf, 0x4, 0xe4f6, 0x7, 0x3}) listen(r8, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0xff, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r9 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r9, 0xc0481273, &(0x7f0000000300)={[], 0x0, 0x4, 0x1fd, 0x0, 0x5}) ioctl$BLKTRACESTART(r9, 0x1274, 0x0) ioctl$BLKTRACESTOP(r9, 0x1275, 0x0) 09:01:40 executing program 2: mkdir(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:40 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:40 executing program 3: syz_open_dev$sndseq(&(0x7f0000000000)='/dev/ind/\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/icmp\x00') sendfile(r0, r1, &(0x7f0000000040)=0x426, 0xbb30) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r1, 0x40bc5311, &(0x7f0000000100)={0x0, 0x3, 'client1\x00', 0x4, "6e1b9eb791d83803", "80ab30432aead9721d37e32b097723cf8976e6e3070f50b6dba28eb43ed0decd", 0x10000, 0x1ff}) socket(0x1, 0x5, 0x7e) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r2 = getpid() sched_setattr(r2, &(0x7f0000000440)={0x30, 0x2, 0x0, 0x4, 0x8, 0x3, 0x800000000000}, 0x0) socket$inet6(0xa, 0x2, 0x0) shmget(0x3, 0x1000, 0x20, &(0x7f0000ffe000/0x1000)=nil) socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000400)={0x26, 'hash\x00', 0x0, 0x0, 'digest_null\x00'}, 0x58) r7 = accept4(r6, 0x0, 0x0, 0x0) splice(r5, 0x0, r7, 0x0, 0x80000001, 0x0) ioctl$TCSETS2(r5, 0x402c542b, &(0x7f00000000c0)={0x5, 0x7, 0x0, 0x5, 0x3f, "4b4c2956b8a660180f31e34de3e3b24b60505a", 0x3}) fcntl$setpipe(r4, 0x407, 0x0) write(r4, &(0x7f0000000480)="b0a3cdef47f59ec515de0fcb5dfc761cf7120c4312b2054efdc0cf574f65329a05d03a24674b1d94d072b4bd702c576dc1d6e4fef97bdd899d359dadcfe32ba24fb1e152533e4df2c20324dda85d95c102000000d81d2b9bea7f9e468b3da19d62e9913b2f7cd488de25886811470818af91afd3bce1422670d6f2d054d8b16374e3617a22b1c70e7e3104b814e24e6e7b62256ae8faaae5f59f840c029418a34c", 0xffffff47) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x2000, 0x3, 0xfffffffffffffffd}, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r1, 0xc058534b, &(0x7f00000001c0)={0x22afdad6, 0x4cdf, 0x4, 0xe4f6, 0x7, 0x3}) listen(r8, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0xff, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r9 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r9, 0xc0481273, &(0x7f0000000300)={[], 0x0, 0x4, 0x1fd, 0x0, 0x5}) ioctl$BLKTRACESTART(r9, 0x1274, 0x0) ioctl$BLKTRACESTOP(r9, 0x1275, 0x0) 09:01:42 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:42 executing program 2: mkdir(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:42 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:42 executing program 1: syz_open_dev$sndseq(&(0x7f0000000000)='/dev/ind/\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/icmp\x00') sendfile(r0, r1, &(0x7f0000000040)=0x426, 0xbb30) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r1, 0x40bc5311, &(0x7f0000000100)={0x0, 0x3, 'client1\x00', 0x4, "6e1b9eb791d83803", "80ab30432aead9721d37e32b097723cf8976e6e3070f50b6dba28eb43ed0decd", 0x10000, 0x1ff}) socket(0x1, 0x5, 0x7e) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r2 = getpid() sched_setattr(r2, &(0x7f0000000440)={0x30, 0x2, 0x0, 0x4, 0x8, 0x3, 0x800000000000}, 0x0) socket$inet6(0xa, 0x2, 0x0) shmget(0x3, 0x1000, 0x20, &(0x7f0000ffe000/0x1000)=nil) socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000400)={0x26, 'hash\x00', 0x0, 0x0, 'digest_null\x00'}, 0x58) r7 = accept4(r6, 0x0, 0x0, 0x0) splice(r5, 0x0, r7, 0x0, 0x80000001, 0x0) ioctl$TCSETS2(r5, 0x402c542b, &(0x7f00000000c0)={0x5, 0x7, 0x0, 0x5, 0x3f, "4b4c2956b8a660180f31e34de3e3b24b60505a", 0x3}) fcntl$setpipe(r4, 0x407, 0x0) write(r4, &(0x7f0000000480)="b0a3cdef47f59ec515de0fcb5dfc761cf7120c4312b2054efdc0cf574f65329a05d03a24674b1d94d072b4bd702c576dc1d6e4fef97bdd899d359dadcfe32ba24fb1e152533e4df2c20324dda85d95c102000000d81d2b9bea7f9e468b3da19d62e9913b2f7cd488de25886811470818af91afd3bce1422670d6f2d054d8b16374e3617a22b1c70e7e3104b814e24e6e7b62256ae8faaae5f59f840c029418a34c", 0xffffff47) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x2000, 0x3, 0xfffffffffffffffd}, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r1, 0xc058534b, &(0x7f00000001c0)={0x22afdad6, 0x4cdf, 0x4, 0xe4f6, 0x7, 0x3}) listen(r8, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0xff, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r9 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r9, 0xc0481273, &(0x7f0000000300)={[], 0x0, 0x4, 0x1fd, 0x0, 0x5}) ioctl$BLKTRACESTART(r9, 0x1274, 0x0) ioctl$BLKTRACESTOP(r9, 0x1275, 0x0) 09:01:42 executing program 3: syz_open_dev$sndseq(&(0x7f0000000000)='/dev/ind/\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/icmp\x00') sendfile(r0, r1, &(0x7f0000000040)=0x426, 0xbb30) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r1, 0x40bc5311, &(0x7f0000000100)={0x0, 0x3, 'client1\x00', 0x4, "6e1b9eb791d83803", "80ab30432aead9721d37e32b097723cf8976e6e3070f50b6dba28eb43ed0decd", 0x10000, 0x1ff}) socket(0x1, 0x5, 0x7e) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r2 = getpid() sched_setattr(r2, &(0x7f0000000440)={0x30, 0x2, 0x0, 0x4, 0x8, 0x3, 0x800000000000}, 0x0) socket$inet6(0xa, 0x2, 0x0) shmget(0x3, 0x1000, 0x20, &(0x7f0000ffe000/0x1000)=nil) socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000400)={0x26, 'hash\x00', 0x0, 0x0, 'digest_null\x00'}, 0x58) r7 = accept4(r6, 0x0, 0x0, 0x0) splice(r5, 0x0, r7, 0x0, 0x80000001, 0x0) ioctl$TCSETS2(r5, 0x402c542b, &(0x7f00000000c0)={0x5, 0x7, 0x0, 0x5, 0x3f, "4b4c2956b8a660180f31e34de3e3b24b60505a", 0x3}) fcntl$setpipe(r4, 0x407, 0x0) write(r4, &(0x7f0000000480)="b0a3cdef47f59ec515de0fcb5dfc761cf7120c4312b2054efdc0cf574f65329a05d03a24674b1d94d072b4bd702c576dc1d6e4fef97bdd899d359dadcfe32ba24fb1e152533e4df2c20324dda85d95c102000000d81d2b9bea7f9e468b3da19d62e9913b2f7cd488de25886811470818af91afd3bce1422670d6f2d054d8b16374e3617a22b1c70e7e3104b814e24e6e7b62256ae8faaae5f59f840c029418a34c", 0xffffff47) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x2000, 0x3, 0xfffffffffffffffd}, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r1, 0xc058534b, &(0x7f00000001c0)={0x22afdad6, 0x4cdf, 0x4, 0xe4f6, 0x7, 0x3}) listen(r8, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0xff, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r9 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r9, 0xc0481273, &(0x7f0000000300)={[], 0x0, 0x4, 0x1fd, 0x0, 0x5}) ioctl$BLKTRACESTART(r9, 0x1274, 0x0) ioctl$BLKTRACESTOP(r9, 0x1275, 0x0) [ 497.721402][T19346] debugfs: File 'dropped' in directory 'loop0' already present! [ 497.729189][T19346] debugfs: File 'msg' in directory 'loop0' already present! [ 497.736607][T19346] debugfs: File 'trace0' in directory 'loop0' already present! 09:01:43 executing program 3: syz_open_dev$sndseq(&(0x7f0000000000)='/dev/ind/\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/icmp\x00') sendfile(r0, r1, &(0x7f0000000040)=0x426, 0xbb30) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r1, 0x40bc5311, &(0x7f0000000100)={0x0, 0x3, 'client1\x00', 0x4, "6e1b9eb791d83803", "80ab30432aead9721d37e32b097723cf8976e6e3070f50b6dba28eb43ed0decd", 0x10000, 0x1ff}) socket(0x1, 0x5, 0x7e) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r2 = getpid() sched_setattr(r2, &(0x7f0000000440)={0x30, 0x2, 0x0, 0x4, 0x8, 0x3, 0x800000000000}, 0x0) socket$inet6(0xa, 0x2, 0x0) shmget(0x3, 0x1000, 0x20, &(0x7f0000ffe000/0x1000)=nil) socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000400)={0x26, 'hash\x00', 0x0, 0x0, 'digest_null\x00'}, 0x58) r7 = accept4(r6, 0x0, 0x0, 0x0) splice(r5, 0x0, r7, 0x0, 0x80000001, 0x0) ioctl$TCSETS2(r5, 0x402c542b, &(0x7f00000000c0)={0x5, 0x7, 0x0, 0x5, 0x3f, "4b4c2956b8a660180f31e34de3e3b24b60505a", 0x3}) fcntl$setpipe(r4, 0x407, 0x0) write(r4, &(0x7f0000000480)="b0a3cdef47f59ec515de0fcb5dfc761cf7120c4312b2054efdc0cf574f65329a05d03a24674b1d94d072b4bd702c576dc1d6e4fef97bdd899d359dadcfe32ba24fb1e152533e4df2c20324dda85d95c102000000d81d2b9bea7f9e468b3da19d62e9913b2f7cd488de25886811470818af91afd3bce1422670d6f2d054d8b16374e3617a22b1c70e7e3104b814e24e6e7b62256ae8faaae5f59f840c029418a34c", 0xffffff47) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x2000, 0x3, 0xfffffffffffffffd}, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r1, 0xc058534b, &(0x7f00000001c0)={0x22afdad6, 0x4cdf, 0x4, 0xe4f6, 0x7, 0x3}) listen(r8, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0xff, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r9 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r9, 0xc0481273, &(0x7f0000000300)={[], 0x0, 0x4, 0x1fd, 0x0, 0x5}) ioctl$BLKTRACESTART(r9, 0x1274, 0x0) ioctl$BLKTRACESTOP(r9, 0x1275, 0x0) 09:01:43 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:43 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:43 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:43 executing program 2: mkdir(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:43 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:43 executing program 3: syz_open_dev$sndseq(&(0x7f0000000000)='/dev/ind/\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/icmp\x00') sendfile(r0, r1, &(0x7f0000000040)=0x426, 0xbb30) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r1, 0x40bc5311, &(0x7f0000000100)={0x0, 0x3, 'client1\x00', 0x4, "6e1b9eb791d83803", "80ab30432aead9721d37e32b097723cf8976e6e3070f50b6dba28eb43ed0decd", 0x10000, 0x1ff}) socket(0x1, 0x5, 0x7e) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r2 = getpid() sched_setattr(r2, &(0x7f0000000440)={0x30, 0x2, 0x0, 0x4, 0x8, 0x3, 0x800000000000}, 0x0) socket$inet6(0xa, 0x2, 0x0) shmget(0x3, 0x1000, 0x20, &(0x7f0000ffe000/0x1000)=nil) socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000400)={0x26, 'hash\x00', 0x0, 0x0, 'digest_null\x00'}, 0x58) r7 = accept4(r6, 0x0, 0x0, 0x0) splice(r5, 0x0, r7, 0x0, 0x80000001, 0x0) ioctl$TCSETS2(r5, 0x402c542b, &(0x7f00000000c0)={0x5, 0x7, 0x0, 0x5, 0x3f, "4b4c2956b8a660180f31e34de3e3b24b60505a", 0x3}) fcntl$setpipe(r4, 0x407, 0x0) write(r4, &(0x7f0000000480)="b0a3cdef47f59ec515de0fcb5dfc761cf7120c4312b2054efdc0cf574f65329a05d03a24674b1d94d072b4bd702c576dc1d6e4fef97bdd899d359dadcfe32ba24fb1e152533e4df2c20324dda85d95c102000000d81d2b9bea7f9e468b3da19d62e9913b2f7cd488de25886811470818af91afd3bce1422670d6f2d054d8b16374e3617a22b1c70e7e3104b814e24e6e7b62256ae8faaae5f59f840c029418a34c", 0xffffff47) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x2000, 0x3, 0xfffffffffffffffd}, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r1, 0xc058534b, &(0x7f00000001c0)={0x22afdad6, 0x4cdf, 0x4, 0xe4f6, 0x7, 0x3}) listen(r8, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0xff, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r9 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r9, 0xc0481273, &(0x7f0000000300)={[], 0x0, 0x4, 0x1fd, 0x0, 0x5}) ioctl$BLKTRACESTART(r9, 0x1274, 0x0) ioctl$BLKTRACESTOP(r9, 0x1275, 0x0) 09:01:43 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) [ 498.165807][T19468] fuse: Bad value for 'fd' 09:01:43 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:43 executing program 1: syz_open_dev$sndseq(&(0x7f0000000000)='/dev/ind/\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/icmp\x00') sendfile(r0, r1, &(0x7f0000000040)=0x426, 0xbb30) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r1, 0x40bc5311, &(0x7f0000000100)={0x0, 0x3, 'client1\x00', 0x4, "6e1b9eb791d83803", "80ab30432aead9721d37e32b097723cf8976e6e3070f50b6dba28eb43ed0decd", 0x10000, 0x1ff}) socket(0x1, 0x5, 0x7e) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r2 = getpid() sched_setattr(r2, &(0x7f0000000440)={0x30, 0x2, 0x0, 0x4, 0x8, 0x3, 0x800000000000}, 0x0) socket$inet6(0xa, 0x2, 0x0) shmget(0x3, 0x1000, 0x20, &(0x7f0000ffe000/0x1000)=nil) socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000400)={0x26, 'hash\x00', 0x0, 0x0, 'digest_null\x00'}, 0x58) r7 = accept4(r6, 0x0, 0x0, 0x0) splice(r5, 0x0, r7, 0x0, 0x80000001, 0x0) ioctl$TCSETS2(r5, 0x402c542b, &(0x7f00000000c0)={0x5, 0x7, 0x0, 0x5, 0x3f, "4b4c2956b8a660180f31e34de3e3b24b60505a", 0x3}) fcntl$setpipe(r4, 0x407, 0x0) write(r4, &(0x7f0000000480)="b0a3cdef47f59ec515de0fcb5dfc761cf7120c4312b2054efdc0cf574f65329a05d03a24674b1d94d072b4bd702c576dc1d6e4fef97bdd899d359dadcfe32ba24fb1e152533e4df2c20324dda85d95c102000000d81d2b9bea7f9e468b3da19d62e9913b2f7cd488de25886811470818af91afd3bce1422670d6f2d054d8b16374e3617a22b1c70e7e3104b814e24e6e7b62256ae8faaae5f59f840c029418a34c", 0xffffff47) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x2000, 0x3, 0xfffffffffffffffd}, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r1, 0xc058534b, &(0x7f00000001c0)={0x22afdad6, 0x4cdf, 0x4, 0xe4f6, 0x7, 0x3}) listen(r8, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0xff, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r9 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r9, 0xc0481273, &(0x7f0000000300)={[], 0x0, 0x4, 0x1fd, 0x0, 0x5}) ioctl$BLKTRACESTART(r9, 0x1274, 0x0) ioctl$BLKTRACESTOP(r9, 0x1275, 0x0) 09:01:43 executing program 3: syz_open_dev$sndseq(&(0x7f0000000000)='/dev/ind/\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/icmp\x00') sendfile(r0, r1, &(0x7f0000000040)=0x426, 0xbb30) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r1, 0x40bc5311, &(0x7f0000000100)={0x0, 0x3, 'client1\x00', 0x4, "6e1b9eb791d83803", "80ab30432aead9721d37e32b097723cf8976e6e3070f50b6dba28eb43ed0decd", 0x10000, 0x1ff}) socket(0x1, 0x5, 0x7e) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r2 = getpid() sched_setattr(r2, &(0x7f0000000440)={0x30, 0x2, 0x0, 0x4, 0x8, 0x3, 0x800000000000}, 0x0) socket$inet6(0xa, 0x2, 0x0) shmget(0x3, 0x1000, 0x20, &(0x7f0000ffe000/0x1000)=nil) socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000400)={0x26, 'hash\x00', 0x0, 0x0, 'digest_null\x00'}, 0x58) r7 = accept4(r6, 0x0, 0x0, 0x0) splice(r5, 0x0, r7, 0x0, 0x80000001, 0x0) ioctl$TCSETS2(r5, 0x402c542b, &(0x7f00000000c0)={0x5, 0x7, 0x0, 0x5, 0x3f, "4b4c2956b8a660180f31e34de3e3b24b60505a", 0x3}) fcntl$setpipe(r4, 0x407, 0x0) write(r4, &(0x7f0000000480)="b0a3cdef47f59ec515de0fcb5dfc761cf7120c4312b2054efdc0cf574f65329a05d03a24674b1d94d072b4bd702c576dc1d6e4fef97bdd899d359dadcfe32ba24fb1e152533e4df2c20324dda85d95c102000000d81d2b9bea7f9e468b3da19d62e9913b2f7cd488de25886811470818af91afd3bce1422670d6f2d054d8b16374e3617a22b1c70e7e3104b814e24e6e7b62256ae8faaae5f59f840c029418a34c", 0xffffff47) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x2000, 0x3, 0xfffffffffffffffd}, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r1, 0xc058534b, &(0x7f00000001c0)={0x22afdad6, 0x4cdf, 0x4, 0xe4f6, 0x7, 0x3}) listen(r8, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0xff, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r9 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r9, 0xc0481273, &(0x7f0000000300)={[], 0x0, 0x4, 0x1fd, 0x0, 0x5}) ioctl$BLKTRACESTART(r9, 0x1274, 0x0) ioctl$BLKTRACESTOP(r9, 0x1275, 0x0) 09:01:43 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) [ 498.433482][T19582] fuse: Bad value for 'fd' [ 498.563059][T19592] debugfs: File 'dropped' in directory 'loop0' already present! [ 498.571114][T19592] debugfs: File 'msg' in directory 'loop0' already present! [ 498.579122][T19592] debugfs: File 'trace0' in directory 'loop0' already present! 09:01:43 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:43 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000000040)=0x80, 0x4) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 498.796194][T19699] fuse: Bad value for 'fd' 09:01:46 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:46 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000003c0)=0x5) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000001c0)) 09:01:46 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:46 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:46 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000000040)=0x80, 0x4) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:01:46 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) [ 501.093730][T19819] fuse: Bad value for 'fd' 09:01:46 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000000040)=0x80, 0x4) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 501.162454][T19825] mkiss: ax0: crc mode is auto. 09:01:46 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:46 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 501.286600][T19825] mkiss: ax0: crc mode is auto. 09:01:46 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:46 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:46 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000000040)=0x80, 0x4) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 501.478067][T19862] fuse: Bad value for 'fd' 09:01:46 executing program 1: r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/pid_for_children\x00') setns(r0, 0x0) 09:01:46 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:46 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:49 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:49 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:49 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ptrace$cont(0x18, 0x0, 0x0, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, 0x0, 0x0, 0x0) 09:01:49 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x2, 0x14, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @empty}}]}, 0x50}}, 0x0) 09:01:49 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000000040)=0x80, 0x4) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:01:49 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:49 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ptrace$cont(0x18, 0x0, 0x0, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, 0x0, 0x0, 0x0) 09:01:49 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000000040)=0x80, 0x4) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 504.342287][T19915] fuse: Bad value for 'fd' 09:01:49 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpuacct.stat\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000040)="0f42", 0x2) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000580)=""/143, &(0x7f0000000340)=0xfee5) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000740)={0x3, 0x2, 0xf000, 0x1000, &(0x7f0000000000/0x1000)=nil}) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000700)=[{&(0x7f00000002c0)=@abs={0x1, 0x0, 0x4e22}, 0x6e, 0x0}], 0x1, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x8, 0xfb, 0x0, 0x0, 0x0, 0x400000000000000]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) sendmsg$IPVS_CMD_DEL_DEST(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYRES16=0x0], 0x1}}, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:49 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ptrace$cont(0x18, 0x0, 0x0, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, 0x0, 0x0, 0x0) 09:01:49 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:49 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:49 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:49 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:49 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000000040)=0x80, 0x4) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 504.739084][T19950] fuse: Bad value for 'fd' 09:01:49 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:49 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:49 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:50 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 505.026755][T19965] fuse: Bad value for 'fd' 09:01:50 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:50 executing program 1: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x6a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xc}, 0x0, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000a00)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x89a1, &(0x7f0000000340)={@local}) ioctl$sock_inet6_SIOCADDRT(r1, 0x89a0, &(0x7f0000000100)={@local={0xfe, 0x80, [0x0, 0xfeff0000, 0x77a0100]}, @rand_addr="58c4c4a733d993a894f49491cb15d13e", @loopback}) r2 = socket$packet(0x11, 0x0, 0x300) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f00000001c0)) sendmsg(r2, &(0x7f0000000480)={&(0x7f0000000180)=@can, 0x80, &(0x7f0000000100)=[{0x0}], 0x1}, 0x0) pipe(0x0) ioctl$INOTIFY_IOC_SETNEXTWD(0xffffffffffffffff, 0x40044900, 0x0) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc8}) r3 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r3) ioctl$DRM_IOCTL_WAIT_VBLANK(r0, 0xc018643a, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) r4 = getuid() getresgid(&(0x7f00000000c0)=0x0, &(0x7f0000000200), &(0x7f0000000280)) r6 = socket(0x15, 0x2, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r8, 0x0) r9 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0x5) getsockopt$inet_IP_XFRM_POLICY(r9, 0x0, 0x11, &(0x7f0000000a80)={{{@in6, @in=@remote}}, {{@in=@dev}, 0x0, @in=@remote}}, &(0x7f0000000240)=0xfe42) r10 = getgid() lsetxattr$system_posix_acl(&(0x7f0000000340)='./bus\x00', &(0x7f0000000300)='system.posix_acl_default\x00', &(0x7f00000013c0)=ANY=[@ANYBLOB="02120000010001000000d940cd90db24cebe14441378f8eb4d859194e4b3296d1a4145aea238d808b1904ea98addef1ec390379bb6e0ff7bd0f50955506136a2b51a8f13180e163c7e3ff871c9fa249c10350915a1bb1b0e40e46d3e9347d975a7273c54548fdb4a627c88726c0ee812bc93c8860740ca6df73edf1fbc67dff041e6ba909cafb3e59ce4cd051cc19a5a5cd41953e4a73d99e6fbbf31cd7ccf22bd50c35122561d3cf9180045165643c1829d304f48459c9bae160afec4728d0fd71877c5", @ANYRES32=0x0, @ANYBLOB="0000003840e94600", @ANYRES32=0x0, @ANYBLOB="0220f8ff3d1e4e4622f3fdeb31c32cd85bf4711c7e27acab7abc7dc97d14156ce6e1e25c8e2eeeed53272fd508eda196d8d46f3d673dc614bc0daa74f9997f968d68d1f7c576c4ad4c91b4569f448db1ec74b7b30b265fa3cead6fe1a2db512b3c43bab686e3e09e4847cfbb8f0aa1f3db727c5711aaedc83ccba0213972c2b7b4a6249209c2ec9ab17a971557b9aec2cb66d4aac97103939ed40360fd4e70f116e72582eabefe1cc5e547ed7c5ef913632a1e50d738429f1055b596296550074c0aea99986434f43082c24cb999c043d9a6ed27601a712e8c2e5fdc4343f2d50331e13fc242166cc3960ed67d62d40b65e62b3cea6915d647afb491ec4e4d72947b737c6d5a533cdaa3ce6b4a6e30d15a227737d408a443fd2b29de2a067eb0a325c5cf0bcc01ee36710a35e142", @ANYRESDEC=r7, @ANYRESOCT=r4, @ANYRES32=0x0, @ANYBLOB='\b', @ANYRESOCT, @ANYBLOB, @ANYRES32=0x0, @ANYBLOB="1000040000000000200002000000"], 0xd, 0x0) write$FUSE_DIRENTPLUS(r0, &(0x7f0000000640)={0x158, 0x0, 0x4, [{{0x4, 0x0, 0x0, 0x8, 0x5, 0x9, {0x4, 0xffffffffffff1a1e, 0x80000001, 0x2, 0xe7e, 0x6989, 0xfffffffa, 0x7fffffff, 0xfffffffb, 0x6, 0x7, r4, r5, 0x5, 0x6}}, {0x5, 0x1000, 0x9, 0x80, '.\',#proc('}}, {{0x0, 0x2, 0x59a7fd17, 0x3, 0xbaf, 0xffff, {0x0, 0x0, 0x2, 0x3, 0xfff, 0x7, 0xb901, 0x1, 0x2, 0xd0f, 0x8000, r8, r10, 0x136, 0x2}}, {0x0, 0x1, 0x4, 0x3, 'eth1'}}]}, 0x158) sendmsg(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000380)=@alg={0x26, 'hash\x00', 0x0, 0x0, 'tgr128-generic\x00'}, 0x80, &(0x7f0000000300)=[{&(0x7f00000004c0)="01f298d2a3e11a7489ea55774dd76c8e6fbe73545a1721b651df469dac97f4a9708d416ed52232a920681788ec0e1c1110d5a0a91a2a378452666af806ddc026697b35c8ff7dc944416aedd2a8dcb781b023a914114d5567b03ffe10b280792211689ed3fa793ede0caa07600aa190d0bad20f390159ef1bb4776beae665c9e9444434950fe7acc4076a47795df1c6134843dbe04029f6b90236a61ec31aeb83b3ee55e094014cf729e21f2014474a376079c107", 0xb4}, {&(0x7f0000000580)="00f9547928c8a4f099d8860845a593c56850397ca94105b86e22dbe014cd19165575b6cc99d0f872b8e05fdc0fd8ebceaf9a39ce5773d71e442acbb13e6cdc06ba5dabe6b16db86246806b98e69c2f415565b419", 0x54}, {&(0x7f0000000000)="b2a49d37f998002e7fe65d7bbe6f4f42b8a0ab03f9e28db82195fce9a433c770694b1a06106b6dc1e07b09e2bd1f14", 0x2f}], 0x3, &(0x7f0000000640)=ANY=[]}, 0x40) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, &(0x7f0000000440)={0x5, 0x4963, 0xfffa, 0x100, 0x2, 0x7ff}) r11 = open(0x0, 0x0, 0x0) r12 = dup(0xffffffffffffffff) ioctl$PPPIOCGFLAGS1(r12, 0x8004745a, &(0x7f0000000040)) fallocate(r11, 0x14, 0x5, 0x4) 09:01:50 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:50 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:01:50 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(0xffffffffffffffff, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) [ 505.638654][T19994] fuse: Bad value for 'fd' 09:01:52 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:52 executing program 5: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:52 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:01:52 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:52 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(0xffffffffffffffff, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:52 executing program 1: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x6a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xc}, 0x0, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000a00)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x89a1, &(0x7f0000000340)={@local}) ioctl$sock_inet6_SIOCADDRT(r1, 0x89a0, &(0x7f0000000100)={@local={0xfe, 0x80, [0x0, 0xfeff0000, 0x77a0100]}, @rand_addr="58c4c4a733d993a894f49491cb15d13e", @loopback}) r2 = socket$packet(0x11, 0x0, 0x300) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f00000001c0)) sendmsg(r2, &(0x7f0000000480)={&(0x7f0000000180)=@can, 0x80, &(0x7f0000000100)=[{0x0}], 0x1}, 0x0) pipe(0x0) ioctl$INOTIFY_IOC_SETNEXTWD(0xffffffffffffffff, 0x40044900, 0x0) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc8}) r3 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r3) ioctl$DRM_IOCTL_WAIT_VBLANK(r0, 0xc018643a, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) r4 = getuid() getresgid(&(0x7f00000000c0)=0x0, &(0x7f0000000200), &(0x7f0000000280)) r6 = socket(0x15, 0x2, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r8, 0x0) r9 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0x5) getsockopt$inet_IP_XFRM_POLICY(r9, 0x0, 0x11, &(0x7f0000000a80)={{{@in6, @in=@remote}}, {{@in=@dev}, 0x0, @in=@remote}}, &(0x7f0000000240)=0xfe42) r10 = getgid() lsetxattr$system_posix_acl(&(0x7f0000000340)='./bus\x00', &(0x7f0000000300)='system.posix_acl_default\x00', &(0x7f00000013c0)=ANY=[@ANYBLOB="02120000010001000000d940cd90db24cebe14441378f8eb4d859194e4b3296d1a4145aea238d808b1904ea98addef1ec390379bb6e0ff7bd0f50955506136a2b51a8f13180e163c7e3ff871c9fa249c10350915a1bb1b0e40e46d3e9347d975a7273c54548fdb4a627c88726c0ee812bc93c8860740ca6df73edf1fbc67dff041e6ba909cafb3e59ce4cd051cc19a5a5cd41953e4a73d99e6fbbf31cd7ccf22bd50c35122561d3cf9180045165643c1829d304f48459c9bae160afec4728d0fd71877c5", @ANYRES32=0x0, @ANYBLOB="0000003840e94600", @ANYRES32=0x0, @ANYBLOB="0220f8ff3d1e4e4622f3fdeb31c32cd85bf4711c7e27acab7abc7dc97d14156ce6e1e25c8e2eeeed53272fd508eda196d8d46f3d673dc614bc0daa74f9997f968d68d1f7c576c4ad4c91b4569f448db1ec74b7b30b265fa3cead6fe1a2db512b3c43bab686e3e09e4847cfbb8f0aa1f3db727c5711aaedc83ccba0213972c2b7b4a6249209c2ec9ab17a971557b9aec2cb66d4aac97103939ed40360fd4e70f116e72582eabefe1cc5e547ed7c5ef913632a1e50d738429f1055b596296550074c0aea99986434f43082c24cb999c043d9a6ed27601a712e8c2e5fdc4343f2d50331e13fc242166cc3960ed67d62d40b65e62b3cea6915d647afb491ec4e4d72947b737c6d5a533cdaa3ce6b4a6e30d15a227737d408a443fd2b29de2a067eb0a325c5cf0bcc01ee36710a35e142", @ANYRESDEC=r7, @ANYRESOCT=r4, @ANYRES32=0x0, @ANYBLOB='\b', @ANYRESOCT, @ANYBLOB, @ANYRES32=0x0, @ANYBLOB="1000040000000000200002000000"], 0xd, 0x0) write$FUSE_DIRENTPLUS(r0, &(0x7f0000000640)={0x158, 0x0, 0x4, [{{0x4, 0x0, 0x0, 0x8, 0x5, 0x9, {0x4, 0xffffffffffff1a1e, 0x80000001, 0x2, 0xe7e, 0x6989, 0xfffffffa, 0x7fffffff, 0xfffffffb, 0x6, 0x7, r4, r5, 0x5, 0x6}}, {0x5, 0x1000, 0x9, 0x80, '.\',#proc('}}, {{0x0, 0x2, 0x59a7fd17, 0x3, 0xbaf, 0xffff, {0x0, 0x0, 0x2, 0x3, 0xfff, 0x7, 0xb901, 0x1, 0x2, 0xd0f, 0x8000, r8, r10, 0x136, 0x2}}, {0x0, 0x1, 0x4, 0x3, 'eth1'}}]}, 0x158) sendmsg(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000380)=@alg={0x26, 'hash\x00', 0x0, 0x0, 'tgr128-generic\x00'}, 0x80, &(0x7f0000000300)=[{&(0x7f00000004c0)="01f298d2a3e11a7489ea55774dd76c8e6fbe73545a1721b651df469dac97f4a9708d416ed52232a920681788ec0e1c1110d5a0a91a2a378452666af806ddc026697b35c8ff7dc944416aedd2a8dcb781b023a914114d5567b03ffe10b280792211689ed3fa793ede0caa07600aa190d0bad20f390159ef1bb4776beae665c9e9444434950fe7acc4076a47795df1c6134843dbe04029f6b90236a61ec31aeb83b3ee55e094014cf729e21f2014474a376079c107", 0xb4}, {&(0x7f0000000580)="00f9547928c8a4f099d8860845a593c56850397ca94105b86e22dbe014cd19165575b6cc99d0f872b8e05fdc0fd8ebceaf9a39ce5773d71e442acbb13e6cdc06ba5dabe6b16db86246806b98e69c2f415565b419", 0x54}, {&(0x7f0000000000)="b2a49d37f998002e7fe65d7bbe6f4f42b8a0ab03f9e28db82195fce9a433c770694b1a06106b6dc1e07b09e2bd1f14", 0x2f}], 0x3, &(0x7f0000000640)=ANY=[]}, 0x40) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, &(0x7f0000000440)={0x5, 0x4963, 0xfffa, 0x100, 0x2, 0x7ff}) r11 = open(0x0, 0x0, 0x0) r12 = dup(0xffffffffffffffff) ioctl$PPPIOCGFLAGS1(r12, 0x8004745a, &(0x7f0000000040)) fallocate(r11, 0x14, 0x5, 0x4) 09:01:52 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:01:52 executing program 5: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 507.750737][T20015] ptrace attach of "/root/syz-executor.5"[20014] was attempted by "/root/syz-executor.5"[20015] [ 507.787201][T20019] fuse: Bad value for 'fd' 09:01:52 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:53 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(0xffffffffffffffff, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) [ 507.918522][T20033] ptrace attach of "/root/syz-executor.5"[20032] was attempted by "/root/syz-executor.5"[20033] 09:01:53 executing program 5: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:53 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 508.185588][T20050] fuse: Bad value for 'fd' 09:01:55 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:55 executing program 1: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x6a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xc}, 0x0, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000a00)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x89a1, &(0x7f0000000340)={@local}) ioctl$sock_inet6_SIOCADDRT(r1, 0x89a0, &(0x7f0000000100)={@local={0xfe, 0x80, [0x0, 0xfeff0000, 0x77a0100]}, @rand_addr="58c4c4a733d993a894f49491cb15d13e", @loopback}) r2 = socket$packet(0x11, 0x0, 0x300) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f00000001c0)) sendmsg(r2, &(0x7f0000000480)={&(0x7f0000000180)=@can, 0x80, &(0x7f0000000100)=[{0x0}], 0x1}, 0x0) pipe(0x0) ioctl$INOTIFY_IOC_SETNEXTWD(0xffffffffffffffff, 0x40044900, 0x0) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc8}) r3 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r3) ioctl$DRM_IOCTL_WAIT_VBLANK(r0, 0xc018643a, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) r4 = getuid() getresgid(&(0x7f00000000c0)=0x0, &(0x7f0000000200), &(0x7f0000000280)) r6 = socket(0x15, 0x2, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r8, 0x0) r9 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0x5) getsockopt$inet_IP_XFRM_POLICY(r9, 0x0, 0x11, &(0x7f0000000a80)={{{@in6, @in=@remote}}, {{@in=@dev}, 0x0, @in=@remote}}, &(0x7f0000000240)=0xfe42) r10 = getgid() lsetxattr$system_posix_acl(&(0x7f0000000340)='./bus\x00', &(0x7f0000000300)='system.posix_acl_default\x00', &(0x7f00000013c0)=ANY=[@ANYBLOB="02120000010001000000d940cd90db24cebe14441378f8eb4d859194e4b3296d1a4145aea238d808b1904ea98addef1ec390379bb6e0ff7bd0f50955506136a2b51a8f13180e163c7e3ff871c9fa249c10350915a1bb1b0e40e46d3e9347d975a7273c54548fdb4a627c88726c0ee812bc93c8860740ca6df73edf1fbc67dff041e6ba909cafb3e59ce4cd051cc19a5a5cd41953e4a73d99e6fbbf31cd7ccf22bd50c35122561d3cf9180045165643c1829d304f48459c9bae160afec4728d0fd71877c5", @ANYRES32=0x0, @ANYBLOB="0000003840e94600", @ANYRES32=0x0, @ANYBLOB="0220f8ff3d1e4e4622f3fdeb31c32cd85bf4711c7e27acab7abc7dc97d14156ce6e1e25c8e2eeeed53272fd508eda196d8d46f3d673dc614bc0daa74f9997f968d68d1f7c576c4ad4c91b4569f448db1ec74b7b30b265fa3cead6fe1a2db512b3c43bab686e3e09e4847cfbb8f0aa1f3db727c5711aaedc83ccba0213972c2b7b4a6249209c2ec9ab17a971557b9aec2cb66d4aac97103939ed40360fd4e70f116e72582eabefe1cc5e547ed7c5ef913632a1e50d738429f1055b596296550074c0aea99986434f43082c24cb999c043d9a6ed27601a712e8c2e5fdc4343f2d50331e13fc242166cc3960ed67d62d40b65e62b3cea6915d647afb491ec4e4d72947b737c6d5a533cdaa3ce6b4a6e30d15a227737d408a443fd2b29de2a067eb0a325c5cf0bcc01ee36710a35e142", @ANYRESDEC=r7, @ANYRESOCT=r4, @ANYRES32=0x0, @ANYBLOB='\b', @ANYRESOCT, @ANYBLOB, @ANYRES32=0x0, @ANYBLOB="1000040000000000200002000000"], 0xd, 0x0) write$FUSE_DIRENTPLUS(r0, &(0x7f0000000640)={0x158, 0x0, 0x4, [{{0x4, 0x0, 0x0, 0x8, 0x5, 0x9, {0x4, 0xffffffffffff1a1e, 0x80000001, 0x2, 0xe7e, 0x6989, 0xfffffffa, 0x7fffffff, 0xfffffffb, 0x6, 0x7, r4, r5, 0x5, 0x6}}, {0x5, 0x1000, 0x9, 0x80, '.\',#proc('}}, {{0x0, 0x2, 0x59a7fd17, 0x3, 0xbaf, 0xffff, {0x0, 0x0, 0x2, 0x3, 0xfff, 0x7, 0xb901, 0x1, 0x2, 0xd0f, 0x8000, r8, r10, 0x136, 0x2}}, {0x0, 0x1, 0x4, 0x3, 'eth1'}}]}, 0x158) sendmsg(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000380)=@alg={0x26, 'hash\x00', 0x0, 0x0, 'tgr128-generic\x00'}, 0x80, &(0x7f0000000300)=[{&(0x7f00000004c0)="01f298d2a3e11a7489ea55774dd76c8e6fbe73545a1721b651df469dac97f4a9708d416ed52232a920681788ec0e1c1110d5a0a91a2a378452666af806ddc026697b35c8ff7dc944416aedd2a8dcb781b023a914114d5567b03ffe10b280792211689ed3fa793ede0caa07600aa190d0bad20f390159ef1bb4776beae665c9e9444434950fe7acc4076a47795df1c6134843dbe04029f6b90236a61ec31aeb83b3ee55e094014cf729e21f2014474a376079c107", 0xb4}, {&(0x7f0000000580)="00f9547928c8a4f099d8860845a593c56850397ca94105b86e22dbe014cd19165575b6cc99d0f872b8e05fdc0fd8ebceaf9a39ce5773d71e442acbb13e6cdc06ba5dabe6b16db86246806b98e69c2f415565b419", 0x54}, {&(0x7f0000000000)="b2a49d37f998002e7fe65d7bbe6f4f42b8a0ab03f9e28db82195fce9a433c770694b1a06106b6dc1e07b09e2bd1f14", 0x2f}], 0x3, &(0x7f0000000640)=ANY=[]}, 0x40) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, &(0x7f0000000440)={0x5, 0x4963, 0xfffa, 0x100, 0x2, 0x7ff}) r11 = open(0x0, 0x0, 0x0) r12 = dup(0xffffffffffffffff) ioctl$PPPIOCGFLAGS1(r12, 0x8004745a, &(0x7f0000000040)) fallocate(r11, 0x14, 0x5, 0x4) 09:01:55 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:01:55 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:55 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:55 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:56 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 510.951490][T20064] fuse: Bad value for 'fd' 09:01:56 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d6", 0x60}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:56 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:56 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(0x0) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:56 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:56 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:01:56 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000000140)) [ 511.349696][T20105] fuse: Bad value for 'fd' 09:01:56 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0xa, 0x90}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f00000028c0)=[{{0x0, 0x0, 0x0}, 0xe0f5}], 0x1, 0x0, 0x0) pipe(0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) lstat(&(0x7f0000000580)='./bus/file0\x00', 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x8482) bind$bt_rfcomm(0xffffffffffffffff, &(0x7f0000000100)={0x1f, {0x0, 0x9, 0x0, 0x0, 0x0, 0x7}, 0xa7}, 0xfffffffffffffcfc) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x3) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$EVIOCGBITSW(0xffffffffffffffff, 0x80404525, &(0x7f00000003c0)=""/238) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) r4 = socket$inet(0x10, 0x3, 0x0) sendmsg(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000340)="4c0000001200ff09fffefd956fa283b7270fd917df226c24a6008000000000000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f", 0x4c}], 0x1}, 0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0) openat(0xffffffffffffffff, 0x0, 0x1, 0x60) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9dd23eea16f99d3, @perf_bp={0x0}, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(r4, &(0x7f0000001380), 0x4000056, 0x0, &(0x7f0000000200)={0x77359400}) syz_emit_ethernet(0x1, &(0x7f0000001640)=ANY=[@ANYRESDEC], 0x0) 09:01:56 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:01:56 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:56 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:56 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(0x0) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:56 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 511.733082][T20132] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. [ 511.743093][T20132] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. [ 511.760697][T20132] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. [ 511.774966][T20132] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. [ 511.787414][T20132] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. [ 511.794723][T20136] fuse: Bad value for 'fd' [ 511.804277][T20132] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. [ 511.817048][T20132] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. [ 511.828696][T20132] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. [ 511.839509][T20132] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. [ 511.851261][T20132] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. 09:01:59 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d6", 0x60}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:59 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:59 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(0x0) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:59 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:59 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:01:59 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0xa, 0x90}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f00000028c0)=[{{0x0, 0x0, 0x0}, 0xe0f5}], 0x1, 0x0, 0x0) pipe(0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) lstat(&(0x7f0000000580)='./bus/file0\x00', 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x8482) bind$bt_rfcomm(0xffffffffffffffff, &(0x7f0000000100)={0x1f, {0x0, 0x9, 0x0, 0x0, 0x0, 0x7}, 0xa7}, 0xfffffffffffffcfc) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x3) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$EVIOCGBITSW(0xffffffffffffffff, 0x80404525, &(0x7f00000003c0)=""/238) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) r4 = socket$inet(0x10, 0x3, 0x0) sendmsg(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000340)="4c0000001200ff09fffefd956fa283b7270fd917df226c24a6008000000000000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f", 0x4c}], 0x1}, 0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0) openat(0xffffffffffffffff, 0x0, 0x1, 0x60) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9dd23eea16f99d3, @perf_bp={0x0}, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(r4, &(0x7f0000001380), 0x4000056, 0x0, &(0x7f0000000200)={0x77359400}) syz_emit_ethernet(0x1, &(0x7f0000001640)=ANY=[@ANYRESDEC], 0x0) 09:01:59 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:01:59 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 514.408597][T20163] fuse: Bad value for 'fd' 09:01:59 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:01:59 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d6", 0x60}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:59 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:59 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, 0x0, 0x0) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:01:59 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:01:59 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:01:59 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 514.880941][T20199] fuse: Bad value for 'fd' 09:02:00 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:02:00 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, 0x0, 0x0) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:00 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0xa, 0x90}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f00000028c0)=[{{0x0, 0x0, 0x0}, 0xe0f5}], 0x1, 0x0, 0x0) pipe(0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) lstat(&(0x7f0000000580)='./bus/file0\x00', 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x8482) bind$bt_rfcomm(0xffffffffffffffff, &(0x7f0000000100)={0x1f, {0x0, 0x9, 0x0, 0x0, 0x0, 0x7}, 0xa7}, 0xfffffffffffffcfc) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x3) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$EVIOCGBITSW(0xffffffffffffffff, 0x80404525, &(0x7f00000003c0)=""/238) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) r4 = socket$inet(0x10, 0x3, 0x0) sendmsg(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000340)="4c0000001200ff09fffefd956fa283b7270fd917df226c24a6008000000000000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f", 0x4c}], 0x1}, 0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0) openat(0xffffffffffffffff, 0x0, 0x1, 0x60) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9dd23eea16f99d3, @perf_bp={0x0}, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(r4, &(0x7f0000001380), 0x4000056, 0x0, &(0x7f0000000200)={0x77359400}) syz_emit_ethernet(0x1, &(0x7f0000001640)=ANY=[@ANYRESDEC], 0x0) 09:02:00 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:00 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 515.201239][T20221] fuse: Bad value for 'fd' 09:02:00 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, 0x0, 0x0) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) [ 515.597745][T20236] fuse: Bad value for 'fd' 09:02:02 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f", 0x90}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:02 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:02 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x0, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:02 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) [ 517.796289][T20256] fuse: Bad value for 'fd' 09:02:02 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:02 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0xa, 0x90}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f00000028c0)=[{{0x0, 0x0, 0x0}, 0xe0f5}], 0x1, 0x0, 0x0) pipe(0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) lstat(&(0x7f0000000580)='./bus/file0\x00', 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x8482) bind$bt_rfcomm(0xffffffffffffffff, &(0x7f0000000100)={0x1f, {0x0, 0x9, 0x0, 0x0, 0x0, 0x7}, 0xa7}, 0xfffffffffffffcfc) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x3) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$EVIOCGBITSW(0xffffffffffffffff, 0x80404525, &(0x7f00000003c0)=""/238) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) r4 = socket$inet(0x10, 0x3, 0x0) sendmsg(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000340)="4c0000001200ff09fffefd956fa283b7270fd917df226c24a6008000000000000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f", 0x4c}], 0x1}, 0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0) openat(0xffffffffffffffff, 0x0, 0x1, 0x60) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9dd23eea16f99d3, @perf_bp={0x0}, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(r4, &(0x7f0000001380), 0x4000056, 0x0, &(0x7f0000000200)={0x77359400}) syz_emit_ethernet(0x1, &(0x7f0000001640)=ANY=[@ANYRESDEC], 0x0) 09:02:02 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:02 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x0, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:03 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:03 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) [ 518.034804][T20273] fuse: Bad value for 'fd' [ 518.053444][T20274] __nla_validate_parse: 69 callbacks suppressed [ 518.053511][T20274] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. [ 518.069439][T20274] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. [ 518.089672][T20274] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. [ 518.103267][T20274] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. [ 518.116160][T20274] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. [ 518.127912][T20274] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. [ 518.140421][T20274] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. [ 518.154483][T20274] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. [ 518.168790][T20274] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. [ 518.182155][T20274] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. 09:02:03 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x0, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:03 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 518.491382][T20295] fuse: Bad value for 'fd' 09:02:05 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f", 0x90}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:05 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 09:02:05 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:05 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0x0, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) [ 520.843964][T20309] fuse: Bad value for 'fd' 09:02:06 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:06 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0xa, 0x90}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f00000028c0)=[{{0x0, 0x0, 0x0}, 0xe0f5}], 0x1, 0x0, 0x0) pipe(0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) lstat(&(0x7f0000000580)='./bus/file0\x00', 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x8482) bind$bt_rfcomm(0xffffffffffffffff, &(0x7f0000000100)={0x1f, {0x0, 0x9, 0x0, 0x0, 0x0, 0x7}, 0xa7}, 0xfffffffffffffcfc) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x3) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$EVIOCGBITSW(0xffffffffffffffff, 0x80404525, &(0x7f00000003c0)=""/238) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) r4 = socket$inet(0x10, 0x3, 0x0) sendmsg(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000340)="4c0000001200ff09fffefd956fa283b7270fd917df226c24a6008000000000000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f", 0x4c}], 0x1}, 0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0) openat(0xffffffffffffffff, 0x0, 0x1, 0x60) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9dd23eea16f99d3, @perf_bp={0x0}, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(r4, &(0x7f0000001380), 0x4000056, 0x0, &(0x7f0000000200)={0x77359400}) syz_emit_ethernet(0x1, &(0x7f0000001640)=ANY=[@ANYRESDEC], 0x0) 09:02:06 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:06 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 09:02:06 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0x0, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:06 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 521.124355][T20336] fuse: Bad value for 'fd' 09:02:06 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:06 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 09:02:08 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f", 0x90}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:08 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0x0, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:08 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:08 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) [ 523.938872][T20359] fuse: Bad value for 'fd' 09:02:09 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:09 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0xa, 0x90}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f00000028c0)=[{{0x0, 0x0, 0x0}, 0xe0f5}], 0x1, 0x0, 0x0) pipe(0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) lstat(&(0x7f0000000580)='./bus/file0\x00', 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x8482) bind$bt_rfcomm(0xffffffffffffffff, &(0x7f0000000100)={0x1f, {0x0, 0x9, 0x0, 0x0, 0x0, 0x7}, 0xa7}, 0xfffffffffffffcfc) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x3) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$EVIOCGBITSW(0xffffffffffffffff, 0x80404525, &(0x7f00000003c0)=""/238) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) r4 = socket$inet(0x10, 0x3, 0x0) sendmsg(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000340)="4c0000001200ff09fffefd956fa283b7270fd917df226c24a6008000000000000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f", 0x4c}], 0x1}, 0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0) openat(0xffffffffffffffff, 0x0, 0x1, 0x60) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9dd23eea16f99d3, @perf_bp={0x0}, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(r4, &(0x7f0000001380), 0x4000056, 0x0, &(0x7f0000000200)={0x77359400}) syz_emit_ethernet(0x1, &(0x7f0000001640)=ANY=[@ANYRESDEC], 0x0) 09:02:09 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:09 executing program 4: r0 = semget$private(0x0, 0x0, 0x9) semctl$IPC_INFO(r0, 0x3, 0x3, 0x0) semctl$SEM_STAT(0x0, 0x1, 0x12, &(0x7f0000000040)=""/126) timer_getoverrun(0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='attr/sockcreate\x00') r2 = syz_open_pts(0xffffffffffffffff, 0x0) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r2, &(0x7f0000000100)) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'team0\x00'}) getuid() setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0xab1e9769135c8510, 0x0) write$P9_RRENAMEAT(r3, 0x0, 0x0) pipe(0x0) stat(&(0x7f0000000340)='./file0\x00', 0x0) timer_create(0x5, 0x0, &(0x7f0000000740)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) ioctl$sock_inet_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000780)) lsetxattr$security_smack_transmute(&(0x7f00000007c0)='./file0\x00', &(0x7f0000000800)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000840)='TRUE', 0x4, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}) openat$full(0xffffffffffffff9c, &(0x7f0000000940)='/dev/full\x00', 0x2000, 0x0) pipe(&(0x7f0000000980)) setsockopt$inet_udp_int(r4, 0x11, 0x67, &(0x7f0000000a00)=0xffff, 0x4) 09:02:09 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x0, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:09 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r0, 0x400442c8, &(0x7f0000000140)={0x4, 0x0}) [ 524.226611][T20387] fuse: Bad value for 'fd' 09:02:09 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:09 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 524.285043][T20393] __nla_validate_parse: 26 callbacks suppressed [ 524.291417][T20393] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. [ 524.302735][T20393] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. [ 524.324096][T20393] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. [ 524.335940][T20393] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. [ 524.347710][T20393] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. [ 524.359853][T20393] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. [ 524.372312][T20393] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. [ 524.383711][T20393] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. [ 524.396066][T20393] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. [ 524.406400][T20393] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. 09:02:12 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r0, 0x400442c8, &(0x7f0000000140)={0x4, 0x0}) 09:02:12 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x0, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:12 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb10000000000", 0xa8}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:12 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)=""/55, 0x37}], 0x1}, 0x0) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x1014a, 0x2, 0x0, 0x800e00515) shutdown(r1, 0x0) shutdown(0xffffffffffffffff, 0x0) recvfrom$inet(r2, 0x0, 0xfffffc95, 0x2, 0x0, 0x800e0051e) shutdown(r2, 0x0) 09:02:12 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 527.003258][T20413] fuse: Bad value for 'fd' 09:02:12 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000001080)=[{&(0x7f0000000cc0)=""/73, 0x49}, {0x0}], 0x2}, 0x40002) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x10000040c, 0x0, 0x0, 0x800e0086e) shutdown(r1, 0x0) r3 = socket$inet6_udp(0x1c, 0x2, 0x0) recvmsg(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f00000009c0)=""/118, 0x76}], 0x1}, 0x0) shutdown(r2, 0x0) 09:02:12 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:12 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x0, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:12 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb10000000000", 0xa8}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:12 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)=""/55, 0x37}], 0x1}, 0x0) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x1014a, 0x0, 0x0, 0x800e00515) shutdown(r1, 0x0) shutdown(0xffffffffffffffff, 0x0) recvfrom$inet(r2, 0x0, 0xfffffc95, 0x2, 0x0, 0x800e0051e) shutdown(r2, 0x0) [ 527.340843][T20436] fuse: Bad value for 'fd' 09:02:12 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:12 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:12 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r0, &(0x7f0000001640)=[{&(0x7f0000000000)=""/107, 0x6b}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0xa) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0xfd1d, 0x0, 0x0, 0x800e00526) shutdown(r0, 0x0) getsockopt$inet_mreq(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) recvfrom$inet(r1, 0x0, 0x10000051f, 0x42, 0x0, 0x800e00521) shutdown(r1, 0x0) 09:02:12 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x0, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:12 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r0, &(0x7f0000000780)=[{&(0x7f0000000100)=""/250, 0xfa}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x8) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x1008d, 0x0, 0x0, 0x800e00527) shutdown(r1, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) recvfrom$inet(r2, 0x0, 0xfffffdc4, 0x2, 0x0, 0x800e00525) shutdown(r2, 0x0) 09:02:12 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:12 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 527.657113][T20473] fuse: Bad value for 'fd' 09:02:12 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)=""/55, 0x37}, {0x0}], 0x2}, 0x0) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x1014a, 0x0, 0x0, 0x800e00515) shutdown(r1, 0x0) accept$inet(0xffffffffffffffff, 0x0, 0x0) recvfrom$inet(r2, 0x0, 0xfffffc95, 0x0, 0x0, 0x800e0051e) shutdown(r2, 0x0) 09:02:12 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x0, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:12 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000540)={0x53, 0xfffffffffffffffb, 0x0, 0x81, @buffer={0x0, 0x7e, &(0x7f0000000300)=""/126}, 0x0, &(0x7f0000000440)=""/242, 0x1ff, 0x0, 0xa, 0x0}) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) r0 = socket(0xa, 0x1, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000040)={0x2, {{0x2, 0x0, @multicast2}}}, 0x5c4) r1 = socket$inet6_sctp(0xa, 0x0, 0x84) socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000000), &(0x7f0000000040)=0x10) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000780)={0x0, @in={{0x2, 0x0, @multicast1}}}, 0x84) r2 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RWALK(r2, 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6, 0x0, 0x10360}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r1, 0x84, 0x4, &(0x7f0000000140)=0x800, 0x4) dup2(r2, r3) [ 527.918677][T20487] fuse: Bad value for 'fd' 09:02:15 executing program 4: getpid() rt_tgsigqueueinfo(0x0, 0x0, 0x0, 0x0) ptrace(0xffffffffffffffff, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) syz_open_pts(0xffffffffffffffff, 0x0) creat(0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) close(r0) r1 = socket$inet_sctp(0x2, 0x801, 0x84) sendmsg(r1, &(0x7f0000000180)={&(0x7f00000002c0)=@in={0x2, 0x0, @local}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)='#', 0x1}], 0x1, 0x0, 0x0, 0x9000004}, 0x0) alarm(0x0) io_setup(0x6, &(0x7f0000000140)=0x0) io_submit(r2, 0x1, &(0x7f0000000040)=[&(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x257}]) accept$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$TIOCCBRK(0xffffffffffffffff, 0x5428) kcmp(0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) creat(0x0, 0x0) accept$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$TIOCCBRK(0xffffffffffffffff, 0x5428) syz_mount_image$ntfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) sendmmsg$nfc_llcp(0xffffffffffffffff, 0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ptrace$getsig(0x4202, 0x0, 0x0, 0x0) 09:02:15 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:15 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000540)={0x53, 0xfffffffffffffffb, 0x0, 0x81, @buffer={0x0, 0x7e, &(0x7f0000000300)=""/126}, 0x0, &(0x7f0000000440)=""/242, 0x1ff, 0x0, 0xa, 0x0}) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) r0 = socket(0xa, 0x1, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000040)={0x2, {{0x2, 0x0, @multicast2}}}, 0x5c4) r1 = socket$inet6_sctp(0xa, 0x0, 0x84) socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000000), &(0x7f0000000040)=0x10) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000780)={0x0, @in={{0x2, 0x0, @multicast1}}}, 0x84) r2 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RWALK(r2, 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6, 0x0, 0x10360}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r1, 0x84, 0x4, &(0x7f0000000140)=0x800, 0x4) dup2(r2, r3) 09:02:15 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:15 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb10000000000", 0xa8}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:15 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:15 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x0, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:15 executing program 4: getpid() rt_tgsigqueueinfo(0x0, 0x0, 0x0, 0x0) ptrace(0xffffffffffffffff, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) syz_open_pts(0xffffffffffffffff, 0x0) creat(0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) close(r0) r1 = socket$inet_sctp(0x2, 0x801, 0x84) sendmsg(r1, &(0x7f0000000180)={&(0x7f00000002c0)=@in={0x2, 0x0, @local}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)='#', 0x1}], 0x1, 0x0, 0x0, 0x9000004}, 0x0) alarm(0x0) io_setup(0x6, &(0x7f0000000140)=0x0) io_submit(r2, 0x1, &(0x7f0000000040)=[&(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x257}]) accept$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$TIOCCBRK(0xffffffffffffffff, 0x5428) kcmp(0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) creat(0x0, 0x0) accept$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$TIOCCBRK(0xffffffffffffffff, 0x5428) syz_mount_image$ntfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) sendmmsg$nfc_llcp(0xffffffffffffffff, 0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ptrace$getsig(0x4202, 0x0, 0x0, 0x0) 09:02:15 executing program 3: pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 530.750177][T20524] fuse: Bad value for 'fd' 09:02:15 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x0, 0x0, 0x4, 0xf0000000, 0x8, 0x3}, 0x118) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:16 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000540)={0x53, 0xfffffffffffffffb, 0x0, 0x81, @buffer={0x0, 0x7e, &(0x7f0000000300)=""/126}, 0x0, &(0x7f0000000440)=""/242, 0x1ff, 0x0, 0xa, 0x0}) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) r0 = socket(0xa, 0x1, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000040)={0x2, {{0x2, 0x0, @multicast2}}}, 0x5c4) r1 = socket$inet6_sctp(0xa, 0x0, 0x84) socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000000), &(0x7f0000000040)=0x10) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000780)={0x0, @in={{0x2, 0x0, @multicast1}}}, 0x84) r2 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RWALK(r2, 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6, 0x0, 0x10360}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r1, 0x84, 0x4, &(0x7f0000000140)=0x800, 0x4) dup2(r2, r3) 09:02:16 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000540)={0x53, 0xfffffffffffffffb, 0x0, 0x81, @buffer={0x0, 0x7e, &(0x7f0000000300)=""/126}, 0x0, &(0x7f0000000440)=""/242, 0x1ff, 0x0, 0xa, 0x0}) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) r0 = socket(0xa, 0x1, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000040)={0x2, {{0x2, 0x0, @multicast2}}}, 0x5c4) r1 = socket$inet6_sctp(0xa, 0x0, 0x84) socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000000), &(0x7f0000000040)=0x10) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000780)={0x0, @in={{0x2, 0x0, @multicast1}}}, 0x84) r2 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RWALK(r2, 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6, 0x0, 0x10360}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r1, 0x84, 0x4, &(0x7f0000000140)=0x800, 0x4) dup2(r2, r3) 09:02:16 executing program 3: pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 531.019301][T20553] fuse: Bad value for 'fd' 09:02:16 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x0, 0x0, 0x4, 0xf0000000, 0x8, 0x3}, 0x118) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:16 executing program 3: pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 531.282612][T20569] fuse: Bad value for 'fd' 09:02:18 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:18 executing program 4: pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{0x0}], 0x1, 0x0) 09:02:18 executing program 3: bpf$MAP_CREATE(0x0, 0x0, 0x0) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:18 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x0, 0x0, 0x4, 0xf0000000, 0x8, 0x3}, 0x118) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:18 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000540)={0x53, 0xfffffffffffffffb, 0x0, 0x81, @buffer={0x0, 0x7e, &(0x7f0000000300)=""/126}, 0x0, &(0x7f0000000440)=""/242, 0x1ff, 0x0, 0xa, 0x0}) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) r0 = socket(0xa, 0x1, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000040)={0x2, {{0x2, 0x0, @multicast2}}}, 0x5c4) r1 = socket$inet6_sctp(0xa, 0x0, 0x84) socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000000), &(0x7f0000000040)=0x10) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000780)={0x0, @in={{0x2, 0x0, @multicast1}}}, 0x84) r2 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RWALK(r2, 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6, 0x0, 0x10360}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r1, 0x84, 0x4, &(0x7f0000000140)=0x800, 0x4) dup2(r2, r3) 09:02:18 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed", 0xb4}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:18 executing program 3: bpf$MAP_CREATE(0x0, 0x0, 0x0) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 533.847181][T20586] fuse: Bad value for 'fd' 09:02:19 executing program 3: bpf$MAP_CREATE(0x0, 0x0, 0x0) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:19 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0xe, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca"}, 0x126) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:19 executing program 1: pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000740)={0xffffffffffffffff, 0x0, 0x0}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000080), 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) mkdir(0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) 09:02:19 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x0, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 534.037774][T20607] fuse: Bad value for 'fd' 09:02:19 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0xe, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca"}, 0x126) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) [ 534.218405][T20620] fuse: Bad value for 'fd' 09:02:21 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:21 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x0, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:21 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0xe, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca"}, 0x126) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:21 executing program 1: pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000740)={0xffffffffffffffff, 0x0, 0x0}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000080), 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) mkdir(0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) 09:02:21 executing program 4: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = memfd_create(&(0x7f0000000700)='/7\x02\xe8\xa4\xef\x9e\xc8e\xd5n\x89\xeb[<\x18-\x14\x8d8\xbf\xfe\x83\x19\xf3(\xd7y\x14h\xcf(f\x06I:\xa4\xea\xcb\b\x81C\xdd\xcc\x00\x00\x00\x00\xf9\b1h\xbam\xa4x\xb1:\xcf\a\x94Z\x7f\xc8\vy\xf2F\xf4\x9d\n3\xd4\x9a[\xee\xaa\t\xbe\x90\xabU3\xd3[y\xd1d^We\xa9\xcb\x86a\"\xba\xb7\xcd\xcf\x88\x9eqO|\x9f\xcf\r\x86\xf4\x15@\x82w\xa8\\\x8c^a\xbe\x991l\\\x16\xd4\xd53\xdd\x9e\x00\x01:\xac\x14^\xf6\xb6\xb1^\xaa\xfa\x02x\x8aV\x87\xe3\xfb\xef\xd0\xb7({,\xf4\xa2cl`\xdc\xf7\xe2f\xad\xaa>\xd4Ts\x10\xb9V!\x91uGTy\xde$X\xff\xb1\xf3={\xb7\xe65\xb6\x1a\x99q^\xc2\xfc\xb0\xc09\x85\x03\xf1]\xc54;\x8d\x01\xec3#\x8f%5\xef\xfe\xc5\xdb\xd5\xb7\xe0\xdd\xec,rV\x82!\xa0', 0x0) pwritev(r1, &(0x7f0000000380)=[{&(0x7f0000000680)='d', 0x1}], 0x1, 0x0) sendfile(r0, r1, 0x0, 0x20020102000007) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) listen(0xffffffffffffffff, 0x0) 09:02:21 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed", 0xb4}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:22 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x0, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 536.949844][T20641] fuse: Bad value for 'fd' 09:02:22 executing program 4: dup(0xffffffffffffffff) socket$inet6_udplite(0xa, 0x2, 0x88) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) r1 = dup(0xffffffffffffffff) open(0x0, 0x0, 0x0) socket$inet6(0xa, 0x800000003, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prctl$PR_GET_KEEPCAPS(0x7) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0, 0x9}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000700)='/7\x02\xe8\xa4\xef\x9e\xc8e\xd5n\x89\xeb[<\x18-\x14\x8d8\xbf\xfe\x83\x19\xf3(\xd7y\x14h\xcf(f\x06I:\xa4\xea\xcb\b\x81C\xdd\xcc\x00\x00\x00\x00\xf9\b1h\xbam\xa4x\xb1:\xcf\a\x94Z\x7f\xc8\vy\xf2F\xf4\x9d\n3\xd4\x9a[\xee\xaa\t\xbe\x90\xabU3\xd3[y\xd1d^We\xa9\xcb\x86a\"\xba\xb7\xcd\xcf\x88\x9eqO|\x9f\xcf\r\x86\xf4\x15@\x82w\xa8\\\x8c^a\xbe\x991l\\\x16\xd4\xd53\xdd\x9e\x00\x01:\xac\x14^\xf6\xb6\xb1^\xaa\xfa\x02x\x8aV\x87\xe3\xfb\xef\xd0\xb7({,\xf4\xa2cl`\xdc\xf7\xe2f\xad\xaa>\xd4Ts\x10\xb9V!\x91uGTy\xde$X\xff\xb1\xf3={\xb7\xe65\xb6\x1a\x99q^\xc2\xfc\xb0\xc09\x85\x03\xf1]\xc54;\x8d\x01\xec3#\x8f%5\xef\xfe\xc5\xdb\xd5\xb7\xe0\xdd\xec,rV\x82!\xa0', 0x0) pwritev(r3, &(0x7f0000000380)=[{&(0x7f0000000680)='d', 0x1}], 0x1, 0x4081806) dup3(r2, 0xffffffffffffffff, 0xfc93aadfd100503f) sendfile(r2, r3, 0x0, 0x20020102000007) fcntl$setstatus(r2, 0x4, 0x2800) sendfile(0xffffffffffffffff, r2, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0xff, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xce3, 0x7}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) listen(0xffffffffffffffff, 0x0) sendto$inet6(r0, &(0x7f0000000100), 0x0, 0x20000003, &(0x7f000031e000)={0xa, 0x0, 0x5, @ipv4={[], [], @dev}}, 0x1c) setns(r1, 0x0) shutdown(0xffffffffffffffff, 0x0) 09:02:22 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x0, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:22 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x15, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8f"}, 0x12d) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:22 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x0, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 537.269401][T20667] fuse: Bad value for 'fd' 09:02:22 executing program 1: 09:02:25 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:25 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x0, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:25 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x15, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8f"}, 0x12d) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:25 executing program 1: 09:02:25 executing program 4: dup(0xffffffffffffffff) socket$inet6_udplite(0xa, 0x2, 0x88) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) r1 = dup(0xffffffffffffffff) open(0x0, 0x0, 0x0) socket$inet6(0xa, 0x800000003, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prctl$PR_GET_KEEPCAPS(0x7) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0, 0x9}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000000700)='/7\x02\xe8\xa4\xef\x9e\xc8e\xd5n\x89\xeb[<\x18-\x14\x8d8\xbf\xfe\x83\x19\xf3(\xd7y\x14h\xcf(f\x06I:\xa4\xea\xcb\b\x81C\xdd\xcc\x00\x00\x00\x00\xf9\b1h\xbam\xa4x\xb1:\xcf\a\x94Z\x7f\xc8\vy\xf2F\xf4\x9d\n3\xd4\x9a[\xee\xaa\t\xbe\x90\xabU3\xd3[y\xd1d^We\xa9\xcb\x86a\"\xba\xb7\xcd\xcf\x88\x9eqO|\x9f\xcf\r\x86\xf4\x15@\x82w\xa8\\\x8c^a\xbe\x991l\\\x16\xd4\xd53\xdd\x9e\x00\x01:\xac\x14^\xf6\xb6\xb1^\xaa\xfa\x02x\x8aV\x87\xe3\xfb\xef\xd0\xb7({,\xf4\xa2cl`\xdc\xf7\xe2f\xad\xaa>\xd4Ts\x10\xb9V!\x91uGTy\xde$X\xff\xb1\xf3={\xb7\xe65\xb6\x1a\x99q^\xc2\xfc\xb0\xc09\x85\x03\xf1]\xc54;\x8d\x01\xec3#\x8f%5\xef\xfe\xc5\xdb\xd5\xb7\xe0\xdd\xec,rV\x82!\xa0', 0x0) pwritev(r3, &(0x7f0000000380)=[{&(0x7f0000000680)='d', 0x1}], 0x1, 0x4081806) dup3(r2, 0xffffffffffffffff, 0xfc93aadfd100503f) sendfile(r2, r3, 0x0, 0x20020102000007) fcntl$setstatus(r2, 0x4, 0x2800) sendfile(0xffffffffffffffff, r2, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0xff, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xce3, 0x7}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) listen(0xffffffffffffffff, 0x0) sendto$inet6(r0, &(0x7f0000000100), 0x0, 0x20000003, &(0x7f000031e000)={0xa, 0x0, 0x5, @ipv4={[], [], @dev}}, 0x1c) setns(r1, 0x0) shutdown(0xffffffffffffffff, 0x0) 09:02:25 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed", 0xb4}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:25 executing program 1: 09:02:25 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x0, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 540.077462][T20706] fuse: Bad value for 'fd' 09:02:25 executing program 1: 09:02:25 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x15, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8f"}, 0x12d) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:25 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x0, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:25 executing program 1: [ 540.401359][T20724] fuse: Bad value for 'fd' 09:02:28 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:28 executing program 4: 09:02:28 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x0, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:28 executing program 1: 09:02:28 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x18, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd"}, 0x130) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:28 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc00800000", 0xba}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:28 executing program 4: [ 543.160614][T20745] fuse: Bad value for 'fd' 09:02:28 executing program 1: 09:02:28 executing program 4: 09:02:28 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x0, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:28 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x18, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd"}, 0x130) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:28 executing program 1: [ 543.446255][T20761] fuse: Bad value for 'fd' 09:02:31 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:31 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x0, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:31 executing program 4: 09:02:31 executing program 1: 09:02:31 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x18, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd"}, 0x130) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:31 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc00800000", 0xba}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:31 executing program 4: 09:02:31 executing program 1: 09:02:31 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x0, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 546.297265][T20783] fuse: Bad value for 'fd' 09:02:31 executing program 4: 09:02:31 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1a, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569"}, 0x132) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:31 executing program 1: [ 546.603584][T20801] fuse: Bad value for 'fd' 09:02:34 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d6", 0x60}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:34 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(0x0) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:34 executing program 1: 09:02:34 executing program 4: 09:02:34 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1a, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569"}, 0x132) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:34 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc00800000", 0xba}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:34 executing program 4: 09:02:34 executing program 1: 09:02:34 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(0x0) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 549.378570][T20821] fuse: Bad value for 'fd' 09:02:34 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d6", 0x60}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:34 executing program 4: 09:02:34 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1a, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569"}, 0x132) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:34 executing program 1: 09:02:34 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(0x0) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:34 executing program 4: 09:02:34 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d6", 0x60}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 549.693886][T20842] fuse: Bad value for 'fd' 09:02:34 executing program 1: 09:02:37 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c", 0xbd}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:37 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x0, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:37 executing program 4: 09:02:37 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, 0x0, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:37 executing program 1: 09:02:37 executing program 1: 09:02:37 executing program 4: [ 552.432586][T20975] fuse: Bad value for 'fd' 09:02:37 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x0, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:37 executing program 1: 09:02:37 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, 0x0, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) [ 552.689556][T21087] fuse: Bad value for 'fd' 09:02:37 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f", 0x90}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:37 executing program 1: 09:02:40 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c", 0xbd}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:40 executing program 4: 09:02:40 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x0, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:40 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, 0x0, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:40 executing program 1: 09:02:40 executing program 1: [ 555.529935][T21106] fuse: Bad value for 'fd' 09:02:40 executing program 4: 09:02:40 executing program 1: 09:02:40 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x0) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:40 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:40 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f", 0x90}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:40 executing program 4: [ 555.845403][T21233] fuse: Bad value for 'fd' 09:02:43 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c", 0xbd}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:43 executing program 1: 09:02:43 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x0) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:43 executing program 4: 09:02:43 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:43 executing program 1: 09:02:43 executing program 4: [ 558.632441][T21297] fuse: Bad value for 'fd' 09:02:43 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x0) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:43 executing program 1: 09:02:43 executing program 4: 09:02:44 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f", 0x90}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:44 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) [ 559.075964][T21474] fuse: Bad value for 'fd' 09:02:46 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:46 executing program 4: 09:02:46 executing program 1: 09:02:46 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x0, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:46 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:46 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', 0x0, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, &(0x7f00000000c0)="b805000000b9510000000f01c10f46a78900000066ba2100b067ee66ba4100edb9800000c00f3266ba400066ed0f30c4c271de9d0000000066b808008ed0660f38806f000f011c2666b8bf008ee0", 0x4e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x20000004cb]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2}, 0x1c) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) 09:02:46 executing program 4: creat(&(0x7f0000000100)='./file0\x00', 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r1 = perf_event_open(0x0, 0xffffffffffffffff, 0x0, r0, 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) clone(0x100000000100010b, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setxattr$security_selinux(&(0x7f0000000080)='./file0\x00', &(0x7f0000000000)='security.selinux\x00', &(0x7f0000000040)='system_u:object_r:auditd_unit_file_t:s0\x00', 0x24, 0x0) 09:02:46 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x0, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 561.728578][T21487] fuse: Bad value for 'fd' 09:02:46 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:47 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x0, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:47 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb10000000000", 0xa8}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:47 executing program 4: clone(0x205, 0x0, 0x0, 0x0, 0x0) mknod(&(0x7f00000001c0)='./file1\x00', 0xc042, 0x0) mknod(&(0x7f0000f80000)='./file0\x00', 0x1042, 0x0) execve(&(0x7f0000005840)='./file0\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000540)=""/11, 0x22c) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000200)) r1 = creat(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) dup2(r0, r1) execve(&(0x7f00000000c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f0000000000)='./file0\x00', 0x84a, 0x0) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file1\x00', 0x0, 0x0) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) [ 562.067738][T21512] fuse: Bad value for 'fd' 09:02:49 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb10000000000", 0xa8}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:49 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a", 0xbe}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:49 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x0, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:49 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:49 executing program 1: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x800000000050000}]}) mount(0x0, 0x0, &(0x7f0000000100)='configfs\x00', 0x0, &(0x7f0000000140)='\x00') 09:02:49 executing program 4: clone(0x205, 0x0, 0x0, 0x0, 0x0) mknod(&(0x7f00000001c0)='./file1\x00', 0xc042, 0x0) mknod(&(0x7f0000f80000)='./file0\x00', 0x1042, 0x0) execve(&(0x7f0000005840)='./file0\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000540)=""/11, 0x22c) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000200)) r1 = creat(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) dup2(r0, r1) execve(&(0x7f00000000c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f0000000000)='./file0\x00', 0x84a, 0x0) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file1\x00', 0x0, 0x0) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) [ 564.833622][T21610] fuse: Bad value for 'fd' 09:02:49 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb10000000000", 0xa8}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:50 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x0, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:50 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, 0xffffffffffffffff, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:50 executing program 1: preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) ioctl$FS_IOC_RESVSP(r2, 0x402c5828, &(0x7f0000000080)={0x0, 0x0, 0x100000000000000a}) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f00000002c0)={0x0, 0x7}) 09:02:50 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a", 0xbe}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:50 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed", 0xb4}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 565.157543][T21688] fuse: Bad value for 'fd' 09:02:50 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r1, 0x0, 0x0, 0x0, 0x0, 0xb2) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, &(0x7f0000000180)=0xfffffe00, 0x4) r2 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents64(r2, 0x0, 0x12c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000b6dfc8)={0x500, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x2, 0x400000000000003, 0x0, 0x403, 0xf, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[0x300000000000000, 0x0, 0x0, 0x6000000, 0x0, 0x0, 0x6000000, 0x40030000000000], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @sadb_key={0x1, 0x9}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x7, 0xb}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @rand_addr="2d997e568b940344a40733b5e36b51d3"}}]}, 0x78}}, 0x0) bind$inet(r0, &(0x7f00000002c0)={0x2, 0x0, @local}, 0x10) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$ARPT_SO_SET_REPLACE(r4, 0x0, 0x60, &(0x7f0000000600)={'filter\x00', 0x7, 0x4, 0x4a0, 0x118, 0x258, 0x258, 0x3b8, 0x3b8, 0x3b8, 0x4, &(0x7f00000001c0), {[{{@arp={@broadcast, @local, 0x0, 0xffffffff, @empty, {[0x0, 0xff, 0x0, 0x181]}, @mac=@local, {[0x0, 0xff, 0x0, 0x0, 0xff, 0xff]}, 0x4, 0x455, 0x3ff, 0x2960, 0x0, 0x0, 'veth1\x00', 'bridge0\x00'}, 0xf0, 0x118}, @unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x7fff, 0x80000000}}}, {{@arp={@loopback, @dev={0xac, 0x14, 0x14, 0x23}, 0xff000000, 0x0, @mac=@remote, {[0x0, 0x0, 0x1fe, 0xff]}, @empty, {[0x0, 0x0, 0x7f, 0xff, 0x0, 0x17e]}, 0x4, 0x20, 0x0, 0x6, 0xf44, 0x3, 'bridge_slave_0\x00', 'syz_tun\x00', {0xff}, {}, 0x0, 0x80}, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@local, @mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @remote, @multicast1, 0x2, 0x80000000}}}, {{@uncond, 0xf0, 0x160}, @unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x800, 0x1800, 0xfffe, 0x0, 0x0, "46aee200d130d9b93ef6ea1ed7218a126eecf6c077e4ce0bd86dc591d1c3d9d12495a8da7069284647df1faaeb9cbaa89ea741772f8832240ee74967c0c487b7"}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x4f0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) getsockopt$IPT_SO_GET_ENTRIES(r4, 0x0, 0x41, &(0x7f0000000480)=ANY=[@ANYBLOB="66696c7465720000000000000000000000000000000000000000000000000000950000001e784babd02520e242e708e0b5a34117f38b247ec599656297c92a248211d5e1b088185009985f0792c69b5c6124e4a66c2cc1e7e0738d8f640da2c9fe465f6529020c9575e4f59d95190ef0bdc3d17404f222cfba1296e942e8b7a81d1166dd7f16bb303eee8511097ffff8b82826df6997b1ed1aeb117ac16a75d52fcdb734516baf1772b8f761a9dc3935a07658caa31eeb1396bcf6e7252c7164fe5f6d0436c4419e47a61784ca616d714f838f9d124fbd2ebd6f7d5ca536eb8fa70e6dcc404cf5cd23f9a39499e534baa43acc99288ad58679c4f2a294f0706394188ab62db159b399abded91e9ed880bdb5b5c34f9dca3ed8c379543217e6899b7020127a4d9842924db38a6a622ce40887a5c36e2d4cd07d2e00ab1d14bc4675eaf6aada3337df82471df76bedb840164462f7e23ce4983fe7a8ef0e12a3810ca7e9d3f64cf1ca3c0f78d210381a16ba43365347"], &(0x7f00000000c0)=0xffffffffffffffcf) 09:02:50 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, 0xffffffffffffffff, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:50 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x0, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:50 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) socket$inet(0x2, 0x0, 0x0) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(r0, &(0x7f00000002c0)={0x2, 0x0, @local}, 0x10) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) [ 565.422793][T21815] fuse: Bad value for 'fd' 09:02:50 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:50 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, 0xffffffffffffffff, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:50 executing program 4: r0 = creat(&(0x7f0000000680)='./bus\x00', 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x0, 0x2) r1 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) sendfile(r0, r1, 0x0, 0xffffffff) r2 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r2, 0x800) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r2, r3, &(0x7f0000000380), 0x8001) sendfile(r2, r3, 0x0, 0x8400fffffffa) sendfile(r2, r3, 0x0, 0xffffffff) r4 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) fchdir(r4) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) write$ppp(0xffffffffffffffff, &(0x7f00000000c0), 0x0) getsockopt$bt_hci(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000100)=""/34, &(0x7f0000000140)=0x22) open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket(0x0, 0x3, 0x87) connect$inet6(r5, &(0x7f0000000140)={0xa, 0x0, 0x0, @rand_addr="ffba4195a8914923d5b3b6e33004d368"}, 0x1c) r6 = creat(&(0x7f0000000680)='./bus\x00', 0x0) fcntl$setstatus(r6, 0x4, 0x6900) lseek(r6, 0x0, 0x2) sendfile(r6, 0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r5, 0x5411, &(0x7f0000000040)) signalfd(0xffffffffffffffff, 0x0, 0x0) fsync(0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)}, 0x0) r8 = openat$full(0xffffffffffffff9c, &(0x7f0000000300)='/dev/full\x00', 0x420242, 0x0) ftruncate(r8, 0x1) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6900) open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) 09:02:50 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r1, 0x0, 0x0, 0x0, 0x0, 0xb2) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, &(0x7f0000000180)=0xfffffe00, 0x4) r2 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents64(r2, 0x0, 0x12c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000b6dfc8)={0x500, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x2, 0x400000000000003, 0x0, 0x403, 0xf, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[0x300000000000000, 0x0, 0x0, 0x6000000, 0x0, 0x0, 0x6000000, 0x40030000000000], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @sadb_key={0x1, 0x9}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x7, 0xb}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @rand_addr="2d997e568b940344a40733b5e36b51d3"}}]}, 0x78}}, 0x0) bind$inet(r0, &(0x7f00000002c0)={0x2, 0x0, @local}, 0x10) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$ARPT_SO_SET_REPLACE(r4, 0x0, 0x60, &(0x7f0000000600)={'filter\x00', 0x7, 0x4, 0x4a0, 0x118, 0x258, 0x258, 0x3b8, 0x3b8, 0x3b8, 0x4, &(0x7f00000001c0), {[{{@arp={@broadcast, @local, 0x0, 0xffffffff, @empty, {[0x0, 0xff, 0x0, 0x181]}, @mac=@local, {[0x0, 0xff, 0x0, 0x0, 0xff, 0xff]}, 0x4, 0x455, 0x3ff, 0x2960, 0x0, 0x0, 'veth1\x00', 'bridge0\x00'}, 0xf0, 0x118}, @unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x7fff, 0x80000000}}}, {{@arp={@loopback, @dev={0xac, 0x14, 0x14, 0x23}, 0xff000000, 0x0, @mac=@remote, {[0x0, 0x0, 0x1fe, 0xff]}, @empty, {[0x0, 0x0, 0x7f, 0xff, 0x0, 0x17e]}, 0x4, 0x20, 0x0, 0x6, 0xf44, 0x3, 'bridge_slave_0\x00', 'syz_tun\x00', {0xff}, {}, 0x0, 0x80}, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@local, @mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @remote, @multicast1, 0x2, 0x80000000}}}, {{@uncond, 0xf0, 0x160}, @unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x800, 0x1800, 0xfffe, 0x0, 0x0, "46aee200d130d9b93ef6ea1ed7218a126eecf6c077e4ce0bd86dc591d1c3d9d12495a8da7069284647df1faaeb9cbaa89ea741772f8832240ee74967c0c487b7"}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x4f0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) getsockopt$IPT_SO_GET_ENTRIES(r4, 0x0, 0x41, &(0x7f0000000480)=ANY=[@ANYBLOB="66696c7465720000000000000000000000000000000000000000000000000000950000001e784babd02520e242e708e0b5a34117f38b247ec599656297c92a248211d5e1b088185009985f0792c69b5c6124e4a66c2cc1e7e0738d8f640da2c9fe465f6529020c9575e4f59d95190ef0bdc3d17404f222cfba1296e942e8b7a81d1166dd7f16bb303eee8511097ffff8b82826df6997b1ed1aeb117ac16a75d52fcdb734516baf1772b8f761a9dc3935a07658caa31eeb1396bcf6e7252c7164fe5f6d0436c4419e47a61784ca616d714f838f9d124fbd2ebd6f7d5ca536eb8fa70e6dcc404cf5cd23f9a39499e534baa43acc99288ad58679c4f2a294f0706394188ab62db159b399abded91e9ed880bdb5b5c34f9dca3ed8c379543217e6899b7020127a4d9842924db38a6a622ce40887a5c36e2d4cd07d2e00ab1d14bc4675eaf6aada3337df82471df76bedb840164462f7e23ce4983fe7a8ef0e12a3810ca7e9d3f64cf1ca3c0f78d210381a16ba43365347"], &(0x7f00000000c0)=0xffffffffffffffcf) [ 565.700763][T21936] fuse: Bad value for 'fd' 09:02:50 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:50 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x0) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) [ 565.765332][ T26] audit: type=1804 audit(1575018170.846:41): pid=22044 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/278/bus" dev="sda1" ino=17602 res=1 [ 565.904234][ T26] audit: type=1804 audit(1575018170.986:42): pid=22053 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/278/bus" dev="sda1" ino=17602 res=1 [ 565.936545][ T26] audit: type=1804 audit(1575018171.006:43): pid=22053 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/278/bus" dev="sda1" ino=17602 res=1 [ 565.984940][T22060] fuse: Bad value for 'fd' [ 566.059523][ T26] audit: type=1804 audit(1575018171.136:44): pid=22063 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/278/bus" dev="sda1" ino=17602 res=1 [ 566.143535][ T26] audit: type=1804 audit(1575018171.226:45): pid=22063 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/278/bus" dev="sda1" ino=17602 res=1 [ 566.195377][ T26] audit: type=1804 audit(1575018171.276:46): pid=22067 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/278/bus" dev="sda1" ino=17602 res=1 [ 566.667151][ T26] audit: type=1804 audit(1575018171.746:47): pid=22063 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/278/bus" dev="sda1" ino=17602 res=1 [ 566.759112][ T26] audit: type=1804 audit(1575018171.836:48): pid=22068 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/278/bus" dev="sda1" ino=17602 res=1 [ 566.837672][ T26] audit: type=1804 audit(1575018171.916:49): pid=22068 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/278/bus" dev="sda1" ino=17602 res=1 09:02:53 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a", 0xbe}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:53 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed", 0xb4}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:53 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:53 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x0) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:53 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r1, 0x0, 0x0, 0x0, 0x0, 0xb2) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, &(0x7f0000000180)=0xfffffe00, 0x4) r2 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents64(r2, 0x0, 0x12c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000b6dfc8)={0x500, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x2, 0x400000000000003, 0x0, 0x403, 0xf, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[0x300000000000000, 0x0, 0x0, 0x6000000, 0x0, 0x0, 0x6000000, 0x40030000000000], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @sadb_key={0x1, 0x9}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x7, 0xb}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @rand_addr="2d997e568b940344a40733b5e36b51d3"}}]}, 0x78}}, 0x0) bind$inet(r0, &(0x7f00000002c0)={0x2, 0x0, @local}, 0x10) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$ARPT_SO_SET_REPLACE(r4, 0x0, 0x60, &(0x7f0000000600)={'filter\x00', 0x7, 0x4, 0x4a0, 0x118, 0x258, 0x258, 0x3b8, 0x3b8, 0x3b8, 0x4, &(0x7f00000001c0), {[{{@arp={@broadcast, @local, 0x0, 0xffffffff, @empty, {[0x0, 0xff, 0x0, 0x181]}, @mac=@local, {[0x0, 0xff, 0x0, 0x0, 0xff, 0xff]}, 0x4, 0x455, 0x3ff, 0x2960, 0x0, 0x0, 'veth1\x00', 'bridge0\x00'}, 0xf0, 0x118}, @unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x7fff, 0x80000000}}}, {{@arp={@loopback, @dev={0xac, 0x14, 0x14, 0x23}, 0xff000000, 0x0, @mac=@remote, {[0x0, 0x0, 0x1fe, 0xff]}, @empty, {[0x0, 0x0, 0x7f, 0xff, 0x0, 0x17e]}, 0x4, 0x20, 0x0, 0x6, 0xf44, 0x3, 'bridge_slave_0\x00', 'syz_tun\x00', {0xff}, {}, 0x0, 0x80}, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@local, @mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @remote, @multicast1, 0x2, 0x80000000}}}, {{@uncond, 0xf0, 0x160}, @unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x800, 0x1800, 0xfffe, 0x0, 0x0, "46aee200d130d9b93ef6ea1ed7218a126eecf6c077e4ce0bd86dc591d1c3d9d12495a8da7069284647df1faaeb9cbaa89ea741772f8832240ee74967c0c487b7"}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x4f0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) getsockopt$IPT_SO_GET_ENTRIES(r4, 0x0, 0x41, &(0x7f0000000480)=ANY=[@ANYBLOB="66696c7465720000000000000000000000000000000000000000000000000000950000001e784babd02520e242e708e0b5a34117f38b247ec599656297c92a248211d5e1b088185009985f0792c69b5c6124e4a66c2cc1e7e0738d8f640da2c9fe465f6529020c9575e4f59d95190ef0bdc3d17404f222cfba1296e942e8b7a81d1166dd7f16bb303eee8511097ffff8b82826df6997b1ed1aeb117ac16a75d52fcdb734516baf1772b8f761a9dc3935a07658caa31eeb1396bcf6e7252c7164fe5f6d0436c4419e47a61784ca616d714f838f9d124fbd2ebd6f7d5ca536eb8fa70e6dcc404cf5cd23f9a39499e534baa43acc99288ad58679c4f2a294f0706394188ab62db159b399abded91e9ed880bdb5b5c34f9dca3ed8c379543217e6899b7020127a4d9842924db38a6a622ce40887a5c36e2d4cd07d2e00ab1d14bc4675eaf6aada3337df82471df76bedb840164462f7e23ce4983fe7a8ef0e12a3810ca7e9d3f64cf1ca3c0f78d210381a16ba43365347"], &(0x7f00000000c0)=0xffffffffffffffcf) 09:02:53 executing program 4: r0 = creat(&(0x7f0000000680)='./bus\x00', 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x0, 0x2) r1 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) sendfile(r0, r1, 0x0, 0xffffffff) r2 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r2, 0x800) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r2, r3, &(0x7f0000000380), 0x8001) sendfile(r2, r3, 0x0, 0x8400fffffffa) sendfile(r2, r3, 0x0, 0xffffffff) r4 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) fchdir(r4) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) write$ppp(0xffffffffffffffff, &(0x7f00000000c0), 0x0) getsockopt$bt_hci(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000100)=""/34, &(0x7f0000000140)=0x22) open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket(0x0, 0x3, 0x87) connect$inet6(r5, &(0x7f0000000140)={0xa, 0x0, 0x0, @rand_addr="ffba4195a8914923d5b3b6e33004d368"}, 0x1c) r6 = creat(&(0x7f0000000680)='./bus\x00', 0x0) fcntl$setstatus(r6, 0x4, 0x6900) lseek(r6, 0x0, 0x2) sendfile(r6, 0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r5, 0x5411, &(0x7f0000000040)) signalfd(0xffffffffffffffff, 0x0, 0x0) fsync(0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)}, 0x0) r8 = openat$full(0xffffffffffffff9c, &(0x7f0000000300)='/dev/full\x00', 0x420242, 0x0) ftruncate(r8, 0x1) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6900) open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) [ 568.338334][ T26] audit: type=1804 audit(1575018173.416:50): pid=22079 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/279/bus" dev="sda1" ino=17620 res=1 [ 568.396787][T22086] fuse: Bad value for 'fd' 09:02:53 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:53 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x0) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:53 executing program 1: r0 = creat(&(0x7f0000000680)='./bus\x00', 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x0, 0x2) r1 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) sendfile(r0, r1, 0x0, 0xffffffff) r2 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r2, 0x800) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r2, r3, &(0x7f0000000380), 0x8001) sendfile(r2, r3, 0x0, 0x8400fffffffa) sendfile(r2, r3, 0x0, 0xffffffff) r4 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) fchdir(r4) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) write$ppp(0xffffffffffffffff, &(0x7f00000000c0), 0x0) getsockopt$bt_hci(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000100)=""/34, &(0x7f0000000140)=0x22) open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket(0x0, 0x3, 0x87) connect$inet6(r5, &(0x7f0000000140)={0xa, 0x0, 0x0, @rand_addr="ffba4195a8914923d5b3b6e33004d368"}, 0x1c) r6 = creat(&(0x7f0000000680)='./bus\x00', 0x0) fcntl$setstatus(r6, 0x4, 0x6900) lseek(r6, 0x0, 0x2) sendfile(r6, 0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r5, 0x5411, &(0x7f0000000040)) signalfd(0xffffffffffffffff, 0x0, 0x0) fsync(0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)}, 0x0) r8 = openat$full(0xffffffffffffff9c, &(0x7f0000000300)='/dev/full\x00', 0x420242, 0x0) ftruncate(r8, 0x1) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6900) open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) 09:02:53 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 568.660621][T22204] fuse: Bad value for 'fd' 09:02:53 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:53 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 568.923512][T22220] fuse: Bad value for 'fd' 09:02:56 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) [ 571.235569][T22229] fuse: Bad value for 'fd' 09:02:56 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed", 0xb4}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:56 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x3, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:56 executing program 1: r0 = creat(&(0x7f0000000680)='./bus\x00', 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x0, 0x2) r1 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) sendfile(r0, r1, 0x0, 0xffffffff) r2 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r2, 0x800) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r2, r3, &(0x7f0000000380), 0x8001) sendfile(r2, r3, 0x0, 0x8400fffffffa) sendfile(r2, r3, 0x0, 0xffffffff) r4 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) fchdir(r4) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) write$ppp(0xffffffffffffffff, &(0x7f00000000c0), 0x0) getsockopt$bt_hci(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000100)=""/34, &(0x7f0000000140)=0x22) open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket(0x0, 0x3, 0x87) connect$inet6(r5, &(0x7f0000000140)={0xa, 0x0, 0x0, @rand_addr="ffba4195a8914923d5b3b6e33004d368"}, 0x1c) r6 = creat(&(0x7f0000000680)='./bus\x00', 0x0) fcntl$setstatus(r6, 0x4, 0x6900) lseek(r6, 0x0, 0x2) sendfile(r6, 0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r5, 0x5411, &(0x7f0000000040)) signalfd(0xffffffffffffffff, 0x0, 0x0) fsync(0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)}, 0x0) r8 = openat$full(0xffffffffffffff9c, &(0x7f0000000300)='/dev/full\x00', 0x420242, 0x0) ftruncate(r8, 0x1) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6900) open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) 09:02:56 executing program 4: r0 = creat(&(0x7f0000000680)='./bus\x00', 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x0, 0x2) r1 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) sendfile(r0, r1, 0x0, 0xffffffff) r2 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r2, 0x800) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r2, r3, &(0x7f0000000380), 0x8001) sendfile(r2, r3, 0x0, 0x8400fffffffa) sendfile(r2, r3, 0x0, 0xffffffff) r4 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) fchdir(r4) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) write$ppp(0xffffffffffffffff, &(0x7f00000000c0), 0x0) getsockopt$bt_hci(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000100)=""/34, &(0x7f0000000140)=0x22) open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket(0x0, 0x3, 0x87) connect$inet6(r5, &(0x7f0000000140)={0xa, 0x0, 0x0, @rand_addr="ffba4195a8914923d5b3b6e33004d368"}, 0x1c) r6 = creat(&(0x7f0000000680)='./bus\x00', 0x0) fcntl$setstatus(r6, 0x4, 0x6900) lseek(r6, 0x0, 0x2) sendfile(r6, 0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r5, 0x5411, &(0x7f0000000040)) signalfd(0xffffffffffffffff, 0x0, 0x0) fsync(0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)}, 0x0) r8 = openat$full(0xffffffffffffff9c, &(0x7f0000000300)='/dev/full\x00', 0x420242, 0x0) ftruncate(r8, 0x1) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6900) open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) 09:02:56 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x0, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:56 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) [ 571.422014][ T26] kauditd_printk_skb: 11 callbacks suppressed [ 571.422082][ T26] audit: type=1804 audit(1575018176.486:62): pid=22240 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir949210370/syzkaller.461FP0/322/bus" dev="sda1" ino=16673 res=1 09:02:56 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x0, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 571.537635][ T26] audit: type=1804 audit(1575018176.506:63): pid=22243 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/280/bus" dev="sda1" ino=16802 res=1 [ 571.577672][T22346] fuse: Bad value for 'fd' [ 571.600496][ T26] audit: type=1804 audit(1575018176.606:64): pid=22355 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir949210370/syzkaller.461FP0/322/bus" dev="sda1" ino=16673 res=1 [ 571.658631][ T26] audit: type=1804 audit(1575018176.616:65): pid=22356 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/280/bus" dev="sda1" ino=16802 res=1 09:02:56 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) [ 571.691378][ T26] audit: type=1804 audit(1575018176.756:66): pid=22355 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir949210370/syzkaller.461FP0/322/bus" dev="sda1" ino=16673 res=1 09:02:56 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x0, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 571.779404][ T26] audit: type=1804 audit(1575018176.856:67): pid=22344 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/280/bus" dev="sda1" ino=16802 res=1 [ 571.866910][ T26] audit: type=1804 audit(1575018176.946:68): pid=22469 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir949210370/syzkaller.461FP0/322/bus" dev="sda1" ino=16673 res=1 [ 571.906882][T22467] fuse: Bad value for 'fd' 09:02:57 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:57 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x0, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 571.957232][ T26] audit: type=1804 audit(1575018177.036:69): pid=22578 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/280/bus" dev="sda1" ino=16802 res=1 [ 572.065776][ T26] audit: type=1804 audit(1575018177.076:70): pid=22580 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir949210370/syzkaller.461FP0/322/bus" dev="sda1" ino=16673 res=1 [ 572.128522][ T26] audit: type=1804 audit(1575018177.176:71): pid=22585 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/280/bus" dev="sda1" ino=16802 res=1 [ 572.160463][T22646] fuse: Bad value for 'fd' 09:02:57 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x0, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:59 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc00800000", 0xba}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:59 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:02:59 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x0, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:59 executing program 4: r0 = creat(&(0x7f0000000680)='./bus\x00', 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x0, 0x2) r1 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) sendfile(r0, r1, 0x0, 0xffffffff) r2 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r2, 0x800) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r2, r3, &(0x7f0000000380), 0x8001) sendfile(r2, r3, 0x0, 0x8400fffffffa) sendfile(r2, r3, 0x0, 0xffffffff) r4 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) fchdir(r4) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) write$ppp(0xffffffffffffffff, &(0x7f00000000c0), 0x0) getsockopt$bt_hci(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000100)=""/34, &(0x7f0000000140)=0x22) open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket(0x0, 0x3, 0x87) connect$inet6(r5, &(0x7f0000000140)={0xa, 0x0, 0x0, @rand_addr="ffba4195a8914923d5b3b6e33004d368"}, 0x1c) r6 = creat(&(0x7f0000000680)='./bus\x00', 0x0) fcntl$setstatus(r6, 0x4, 0x6900) lseek(r6, 0x0, 0x2) sendfile(r6, 0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r5, 0x5411, &(0x7f0000000040)) signalfd(0xffffffffffffffff, 0x0, 0x0) fsync(0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)}, 0x0) r8 = openat$full(0xffffffffffffff9c, &(0x7f0000000300)='/dev/full\x00', 0x420242, 0x0) ftruncate(r8, 0x1) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6900) open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) 09:02:59 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r1, 0x0, 0x0, 0x0, 0x0, 0xb2) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, &(0x7f0000000180)=0xfffffe00, 0x4) r2 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents64(r2, 0x0, 0x12c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000b6dfc8)={0x500, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x2, 0x400000000000003, 0x0, 0x403, 0xf, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[0x300000000000000, 0x0, 0x0, 0x6000000, 0x0, 0x0, 0x6000000, 0x40030000000000], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @sadb_key={0x1, 0x9}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x7, 0xb}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @rand_addr="2d997e568b940344a40733b5e36b51d3"}}]}, 0x78}}, 0x0) bind$inet(r0, &(0x7f00000002c0)={0x2, 0x0, @local}, 0x10) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$ARPT_SO_SET_REPLACE(r4, 0x0, 0x60, &(0x7f0000000600)={'filter\x00', 0x7, 0x4, 0x4a0, 0x118, 0x258, 0x258, 0x3b8, 0x3b8, 0x3b8, 0x4, &(0x7f00000001c0), {[{{@arp={@broadcast, @local, 0x0, 0xffffffff, @empty, {[0x0, 0xff, 0x0, 0x181]}, @mac=@local, {[0x0, 0xff, 0x0, 0x0, 0xff, 0xff]}, 0x4, 0x455, 0x3ff, 0x2960, 0x0, 0x0, 'veth1\x00', 'bridge0\x00'}, 0xf0, 0x118}, @unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x7fff, 0x80000000}}}, {{@arp={@loopback, @dev={0xac, 0x14, 0x14, 0x23}, 0xff000000, 0x0, @mac=@remote, {[0x0, 0x0, 0x1fe, 0xff]}, @empty, {[0x0, 0x0, 0x7f, 0xff, 0x0, 0x17e]}, 0x4, 0x20, 0x0, 0x6, 0xf44, 0x3, 'bridge_slave_0\x00', 'syz_tun\x00', {0xff}, {}, 0x0, 0x80}, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@local, @mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @remote, @multicast1, 0x2, 0x80000000}}}, {{@uncond, 0xf0, 0x160}, @unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x800, 0x1800, 0xfffe, 0x0, 0x0, "46aee200d130d9b93ef6ea1ed7218a126eecf6c077e4ce0bd86dc591d1c3d9d12495a8da7069284647df1faaeb9cbaa89ea741772f8832240ee74967c0c487b7"}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x4f0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) getsockopt$IPT_SO_GET_ENTRIES(r4, 0x0, 0x41, &(0x7f0000000480)=ANY=[@ANYBLOB="66696c7465720000000000000000000000000000000000000000000000000000950000001e784babd02520e242e708e0b5a34117f38b247ec599656297c92a248211d5e1b088185009985f0792c69b5c6124e4a66c2cc1e7e0738d8f640da2c9fe465f6529020c9575e4f59d95190ef0bdc3d17404f222cfba1296e942e8b7a81d1166dd7f16bb303eee8511097ffff8b82826df6997b1ed1aeb117ac16a75d52fcdb734516baf1772b8f761a9dc3935a07658caa31eeb1396bcf6e7252c7164fe5f6d0436c4419e47a61784ca616d714f838f9d124fbd2ebd6f7d5ca536eb8fa70e6dcc404cf5cd23f9a39499e534baa43acc99288ad58679c4f2a294f0706394188ab62db159b399abded91e9ed880bdb5b5c34f9dca3ed8c379543217e6899b7020127a4d9842924db38a6a622ce40887a5c36e2d4cd07d2e00ab1d14bc4675eaf6aada3337df82471df76bedb840164462f7e23ce4983fe7a8ef0e12a3810ca7e9d3f64cf1ca3c0f78d210381a16ba43365347"], &(0x7f00000000c0)=0xffffffffffffffcf) 09:02:59 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x3, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 574.626935][T22776] fuse: Bad value for 'fd' 09:02:59 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:02:59 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc00800000", 0xba}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:59 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x3, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:02:59 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r1, 0x0, 0x0, 0x0, 0x0, 0xb2) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, &(0x7f0000000180)=0xfffffe00, 0x4) r2 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents64(r2, 0x0, 0x12c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000b6dfc8)={0x500, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x2, 0x400000000000003, 0x0, 0x403, 0xf, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[0x300000000000000, 0x0, 0x0, 0x6000000, 0x0, 0x0, 0x6000000, 0x40030000000000], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @sadb_key={0x1, 0x9}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x7, 0xb}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @rand_addr="2d997e568b940344a40733b5e36b51d3"}}]}, 0x78}}, 0x0) bind$inet(r0, &(0x7f00000002c0)={0x2, 0x0, @local}, 0x10) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$ARPT_SO_SET_REPLACE(r4, 0x0, 0x60, &(0x7f0000000600)={'filter\x00', 0x7, 0x4, 0x4a0, 0x118, 0x258, 0x258, 0x3b8, 0x3b8, 0x3b8, 0x4, &(0x7f00000001c0), {[{{@arp={@broadcast, @local, 0x0, 0xffffffff, @empty, {[0x0, 0xff, 0x0, 0x181]}, @mac=@local, {[0x0, 0xff, 0x0, 0x0, 0xff, 0xff]}, 0x4, 0x455, 0x3ff, 0x2960, 0x0, 0x0, 'veth1\x00', 'bridge0\x00'}, 0xf0, 0x118}, @unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x7fff, 0x80000000}}}, {{@arp={@loopback, @dev={0xac, 0x14, 0x14, 0x23}, 0xff000000, 0x0, @mac=@remote, {[0x0, 0x0, 0x1fe, 0xff]}, @empty, {[0x0, 0x0, 0x7f, 0xff, 0x0, 0x17e]}, 0x4, 0x20, 0x0, 0x6, 0xf44, 0x3, 'bridge_slave_0\x00', 'syz_tun\x00', {0xff}, {}, 0x0, 0x80}, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@local, @mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @remote, @multicast1, 0x2, 0x80000000}}}, {{@uncond, 0xf0, 0x160}, @unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x800, 0x1800, 0xfffe, 0x0, 0x0, "46aee200d130d9b93ef6ea1ed7218a126eecf6c077e4ce0bd86dc591d1c3d9d12495a8da7069284647df1faaeb9cbaa89ea741772f8832240ee74967c0c487b7"}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x4f0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) getsockopt$IPT_SO_GET_ENTRIES(r4, 0x0, 0x41, &(0x7f0000000480)=ANY=[@ANYBLOB="66696c7465720000000000000000000000000000000000000000000000000000950000001e784babd02520e242e708e0b5a34117f38b247ec599656297c92a248211d5e1b088185009985f0792c69b5c6124e4a66c2cc1e7e0738d8f640da2c9fe465f6529020c9575e4f59d95190ef0bdc3d17404f222cfba1296e942e8b7a81d1166dd7f16bb303eee8511097ffff8b82826df6997b1ed1aeb117ac16a75d52fcdb734516baf1772b8f761a9dc3935a07658caa31eeb1396bcf6e7252c7164fe5f6d0436c4419e47a61784ca616d714f838f9d124fbd2ebd6f7d5ca536eb8fa70e6dcc404cf5cd23f9a39499e534baa43acc99288ad58679c4f2a294f0706394188ab62db159b399abded91e9ed880bdb5b5c34f9dca3ed8c379543217e6899b7020127a4d9842924db38a6a622ce40887a5c36e2d4cd07d2e00ab1d14bc4675eaf6aada3337df82471df76bedb840164462f7e23ce4983fe7a8ef0e12a3810ca7e9d3f64cf1ca3c0f78d210381a16ba43365347"], &(0x7f00000000c0)=0xffffffffffffffcf) 09:02:59 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x0, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:03:00 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r1, 0x0, 0x0, 0x0, 0x0, 0xb2) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, &(0x7f0000000180)=0xfffffe00, 0x4) r2 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents64(r2, 0x0, 0x12c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000b6dfc8)={0x500, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x2, 0x400000000000003, 0x0, 0x403, 0xf, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[0x300000000000000, 0x0, 0x0, 0x6000000, 0x0, 0x0, 0x6000000, 0x40030000000000], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @sadb_key={0x1, 0x9}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x7, 0xb}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @rand_addr="2d997e568b940344a40733b5e36b51d3"}}]}, 0x78}}, 0x0) bind$inet(r0, &(0x7f00000002c0)={0x2, 0x0, @local}, 0x10) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$ARPT_SO_SET_REPLACE(r4, 0x0, 0x60, &(0x7f0000000600)={'filter\x00', 0x7, 0x4, 0x4a0, 0x118, 0x258, 0x258, 0x3b8, 0x3b8, 0x3b8, 0x4, &(0x7f00000001c0), {[{{@arp={@broadcast, @local, 0x0, 0xffffffff, @empty, {[0x0, 0xff, 0x0, 0x181]}, @mac=@local, {[0x0, 0xff, 0x0, 0x0, 0xff, 0xff]}, 0x4, 0x455, 0x3ff, 0x2960, 0x0, 0x0, 'veth1\x00', 'bridge0\x00'}, 0xf0, 0x118}, @unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x7fff, 0x80000000}}}, {{@arp={@loopback, @dev={0xac, 0x14, 0x14, 0x23}, 0xff000000, 0x0, @mac=@remote, {[0x0, 0x0, 0x1fe, 0xff]}, @empty, {[0x0, 0x0, 0x7f, 0xff, 0x0, 0x17e]}, 0x4, 0x20, 0x0, 0x6, 0xf44, 0x3, 'bridge_slave_0\x00', 'syz_tun\x00', {0xff}, {}, 0x0, 0x80}, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@local, @mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @remote, @multicast1, 0x2, 0x80000000}}}, {{@uncond, 0xf0, 0x160}, @unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x800, 0x1800, 0xfffe, 0x0, 0x0, "46aee200d130d9b93ef6ea1ed7218a126eecf6c077e4ce0bd86dc591d1c3d9d12495a8da7069284647df1faaeb9cbaa89ea741772f8832240ee74967c0c487b7"}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x4f0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) getsockopt$IPT_SO_GET_ENTRIES(r4, 0x0, 0x41, &(0x7f0000000480)=ANY=[@ANYBLOB="66696c7465720000000000000000000000000000000000000000000000000000950000001e784babd02520e242e708e0b5a34117f38b247ec599656297c92a248211d5e1b088185009985f0792c69b5c6124e4a66c2cc1e7e0738d8f640da2c9fe465f6529020c9575e4f59d95190ef0bdc3d17404f222cfba1296e942e8b7a81d1166dd7f16bb303eee8511097ffff8b82826df6997b1ed1aeb117ac16a75d52fcdb734516baf1772b8f761a9dc3935a07658caa31eeb1396bcf6e7252c7164fe5f6d0436c4419e47a61784ca616d714f838f9d124fbd2ebd6f7d5ca536eb8fa70e6dcc404cf5cd23f9a39499e534baa43acc99288ad58679c4f2a294f0706394188ab62db159b399abded91e9ed880bdb5b5c34f9dca3ed8c379543217e6899b7020127a4d9842924db38a6a622ce40887a5c36e2d4cd07d2e00ab1d14bc4675eaf6aada3337df82471df76bedb840164462f7e23ce4983fe7a8ef0e12a3810ca7e9d3f64cf1ca3c0f78d210381a16ba43365347"], &(0x7f00000000c0)=0xffffffffffffffcf) 09:03:00 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 575.015407][T22855] fuse: Bad value for 'fd' 09:03:00 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x0, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:03:00 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 575.309037][T22868] fuse: Bad value for 'fd' 09:03:00 executing program 4: r0 = creat(&(0x7f0000000680)='./bus\x00', 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x0, 0x2) r1 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) sendfile(r0, r1, 0x0, 0xffffffff) r2 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r2, 0x800) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r2, r3, &(0x7f0000000380), 0x8001) sendfile(r2, r3, 0x0, 0x8400fffffffa) sendfile(r2, r3, 0x0, 0xffffffff) r4 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) fchdir(r4) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) write$ppp(0xffffffffffffffff, &(0x7f00000000c0), 0x0) getsockopt$bt_hci(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000100)=""/34, &(0x7f0000000140)=0x22) open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket(0x0, 0x3, 0x87) connect$inet6(r5, &(0x7f0000000140)={0xa, 0x0, 0x0, @rand_addr="ffba4195a8914923d5b3b6e33004d368"}, 0x1c) r6 = creat(&(0x7f0000000680)='./bus\x00', 0x0) fcntl$setstatus(r6, 0x4, 0x6900) lseek(r6, 0x0, 0x2) sendfile(r6, 0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r5, 0x5411, &(0x7f0000000040)) signalfd(0xffffffffffffffff, 0x0, 0x0) fsync(0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)}, 0x0) r8 = openat$full(0xffffffffffffff9c, &(0x7f0000000300)='/dev/full\x00', 0x420242, 0x0) ftruncate(r8, 0x1) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6900) 09:03:00 executing program 1: syz_emit_ethernet(0x46, &(0x7f0000000000)={@local, @remote, [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x1, 0xffffff3a, 0x0, @rand_addr="f95408b900", @mcast2, {[], @dccp={{0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "b60140", 0x0, "48c5ca"}, "608a828d3413629e6dc3a22e18b5888455af21e3f62a737130afd9704878910d0e9253ea75f24c4613f533bb91c1ed9bb2b2ec17db48a4f5794c3072f109c81e339db26f0edace6ecbaf14191db4f5ec843e7540f5dd33aea2ff7d262148fa037d38d84bdd36f9a0101bfce0071e8410ca7812bbdb6cbabf87d2409c83d6f3654bbe9d6281128d0f5f15caae8f62121a4f354df8c587edfdd4f3755b769e14af2ae178f77d6a4bf03b8fa85cc9b0c9f2a18671b9cac4414b74c42251780dc5e31831191afc761953f5b1fb21c0cd6354437d34daf968f3a3fdbe6e39fedf20b5d1"}}}}}}, 0x0) 09:03:00 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:03:00 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x0, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) [ 575.759006][T22875] fuse: Bad value for 'fd' 09:03:02 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc00800000", 0xba}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:03:02 executing program 1: r0 = socket$inet6(0xa, 0x80003, 0xff) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0800b5055e0bcfe87b2071") r1 = socket$netlink(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x54, r2, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0@'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @empty}}, {0x14, 0x2, @in={0x2, 0x0, @multicast1}}}}]}]}, 0x54}}, 0x0) 09:03:02 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:03:02 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:03:02 executing program 4: r0 = creat(&(0x7f0000000680)='./bus\x00', 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x0, 0x2) r1 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) sendfile(r0, r1, 0x0, 0xffffffff) r2 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r2, 0x800) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r2, r3, &(0x7f0000000380), 0x8001) sendfile(r2, r3, 0x0, 0x8400fffffffa) sendfile(r2, r3, 0x0, 0xffffffff) r4 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) fchdir(r4) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) write$ppp(0xffffffffffffffff, &(0x7f00000000c0), 0x0) getsockopt$bt_hci(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000100)=""/34, &(0x7f0000000140)=0x22) open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket(0x0, 0x3, 0x87) connect$inet6(r5, &(0x7f0000000140)={0xa, 0x0, 0x0, @rand_addr="ffba4195a8914923d5b3b6e33004d368"}, 0x1c) r6 = creat(&(0x7f0000000680)='./bus\x00', 0x0) fcntl$setstatus(r6, 0x4, 0x6900) lseek(r6, 0x0, 0x2) sendfile(r6, 0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r5, 0x5411, &(0x7f0000000040)) signalfd(0xffffffffffffffff, 0x0, 0x0) fsync(0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)}, 0x0) r8 = openat$full(0xffffffffffffff9c, &(0x7f0000000300)='/dev/full\x00', 0x420242, 0x0) ftruncate(r8, 0x1) 09:03:03 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x3, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 577.968317][T22898] tipc: Started in network mode [ 577.978354][ T26] kauditd_printk_skb: 13 callbacks suppressed [ 577.978375][ T26] audit: type=1804 audit(1575018183.056:85): pid=22895 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/283/bus" dev="sda1" ino=17314 res=1 [ 577.986878][T22898] tipc: Own node identity , cluster identity 4711 09:03:03 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) [ 578.082027][T22898] tipc: Failed to set node id, please configure manually [ 578.093688][T22912] fuse: Bad value for 'fd' [ 578.105080][T22898] tipc: Enabling of bearer rejected, failed to enable media [ 578.124435][T22915] tipc: Started in network mode [ 578.141205][T22915] tipc: Own node identity , cluster identity 4711 [ 578.155516][ T26] audit: type=1804 audit(1575018183.236:86): pid=22914 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/283/bus" dev="sda1" ino=17314 res=1 [ 578.195961][T22915] tipc: Failed to set node id, please configure manually [ 578.215281][T22915] tipc: Enabling of bearer rejected, failed to enable media 09:03:03 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) [ 578.228812][ T26] audit: type=1804 audit(1575018183.236:87): pid=22914 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/283/bus" dev="sda1" ino=17314 res=1 09:03:03 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x0, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:03:03 executing program 1: syz_emit_ethernet(0x2a, &(0x7f0000000140)={@broadcast, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x223}, @dev}, @icmp=@echo={0x5}}}}}, 0x0) [ 578.286363][ T26] audit: type=1804 audit(1575018183.356:88): pid=22920 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/283/bus" dev="sda1" ino=17314 res=1 09:03:03 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x0, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:03:03 executing program 1: r0 = socket(0x200000000000011, 0x4000000000080002, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'ip_vti0\x00', 0x0}) bind$packet(r0, &(0x7f0000000000)={0x11, 0x800, r4, 0x1, 0x0, 0x6, @link_local}, 0x14) sendmmsg(r0, &(0x7f0000000d00), 0x4000000000000c9, 0x0) [ 578.424663][ T26] audit: type=1804 audit(1575018183.506:89): pid=22928 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/283/bus" dev="sda1" ino=17314 res=1 [ 578.457994][T22933] fuse: Bad value for 'fd' 09:03:06 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c", 0xbd}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:03:06 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x0, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x20000000000000f1, 0x0) 09:03:06 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:03:06 executing program 1: pipe(&(0x7f0000000140)) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200)={0x0, r0+30000000}, 0x0) 09:03:06 executing program 4: r0 = creat(&(0x7f0000000680)='./bus\x00', 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x0, 0x2) r1 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) sendfile(r0, r1, 0x0, 0xffffffff) r2 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r2, 0x800) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r2, r3, &(0x7f0000000380), 0x8001) sendfile(r2, r3, 0x0, 0x8400fffffffa) sendfile(r2, r3, 0x0, 0xffffffff) r4 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) fchdir(r4) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) write$ppp(0xffffffffffffffff, &(0x7f00000000c0), 0x0) getsockopt$bt_hci(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000100)=""/34, &(0x7f0000000140)=0x22) open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket(0x0, 0x3, 0x87) connect$inet6(r5, &(0x7f0000000140)={0xa, 0x0, 0x0, @rand_addr="ffba4195a8914923d5b3b6e33004d368"}, 0x1c) r6 = creat(&(0x7f0000000680)='./bus\x00', 0x0) fcntl$setstatus(r6, 0x4, 0x6900) lseek(r6, 0x0, 0x2) sendfile(r6, 0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r5, 0x5411, &(0x7f0000000040)) signalfd(0xffffffffffffffff, 0x0, 0x0) fsync(0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)}, 0x0) r8 = openat$full(0xffffffffffffff9c, &(0x7f0000000300)='/dev/full\x00', 0x420242, 0x0) ftruncate(r8, 0x1) 09:03:06 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x3, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 581.117054][ T26] audit: type=1804 audit(1575018186.196:90): pid=22953 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/284/bus" dev="sda1" ino=16769 res=1 09:03:06 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(0x0, 0x0, 0x0) [ 581.160533][T22947] fuse: Bad value for 'fd' 09:03:06 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x3, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 581.240187][ T26] audit: type=1804 audit(1575018186.316:91): pid=22969 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/284/bus" dev="sda1" ino=16769 res=1 09:03:06 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:03:06 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(0x0, 0x0, 0x0) [ 581.335171][ T26] audit: type=1804 audit(1575018186.386:92): pid=22969 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/284/bus" dev="sda1" ino=16769 res=1 09:03:06 executing program 1: r0 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$sock_int(r1, 0x1, 0x2f, &(0x7f0000000180), 0xf0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r2 = dup2(r1, r1) sendmsg$NBD_CMD_RECONFIGURE(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000004c0)=ANY=[@ANYRES16], 0x1}}, 0x0) write$cgroup_type(r2, &(0x7f0000000140)='t\x02\x04\x00', 0xfffffefa) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x0, 0x11, r0, 0x0) [ 581.478840][ T26] audit: type=1804 audit(1575018186.556:93): pid=22979 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/284/bus" dev="sda1" ino=16769 res=1 09:03:06 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) [ 581.536560][ T26] audit: type=1804 audit(1575018186.616:94): pid=22979 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/284/bus" dev="sda1" ino=16769 res=1 09:03:09 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c", 0xbd}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:03:09 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(0x0, 0x0, 0x0) 09:03:09 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:03:09 executing program 4: r0 = creat(&(0x7f0000000680)='./bus\x00', 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x0, 0x2) r1 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) sendfile(r0, r1, 0x0, 0xffffffff) r2 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r2, 0x800) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r2, r3, &(0x7f0000000380), 0x8001) sendfile(r2, r3, 0x0, 0x8400fffffffa) sendfile(r2, r3, 0x0, 0xffffffff) r4 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) fchdir(r4) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) write$ppp(0xffffffffffffffff, &(0x7f00000000c0), 0x0) getsockopt$bt_hci(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000100)=""/34, &(0x7f0000000140)=0x22) open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket(0x0, 0x3, 0x87) connect$inet6(r5, &(0x7f0000000140)={0xa, 0x0, 0x0, @rand_addr="ffba4195a8914923d5b3b6e33004d368"}, 0x1c) r6 = creat(&(0x7f0000000680)='./bus\x00', 0x0) fcntl$setstatus(r6, 0x4, 0x6900) lseek(r6, 0x0, 0x2) sendfile(r6, 0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r5, 0x5411, &(0x7f0000000040)) signalfd(0xffffffffffffffff, 0x0, 0x0) fsync(0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)}, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000300)='/dev/full\x00', 0x420242, 0x0) 09:03:09 executing program 1: pipe(&(0x7f0000000140)) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200)={0x0, r0+30000000}, 0x0) [ 584.195650][ T26] audit: type=1804 audit(1575018189.276:95): pid=23006 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/285/bus" dev="sda1" ino=16802 res=1 09:03:09 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}], 0x6, 0x0) 09:03:09 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}], 0x6, 0x0) 09:03:09 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x3, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 584.346111][ T26] audit: type=1804 audit(1575018189.426:96): pid=23021 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/285/bus" dev="sda1" ino=16802 res=1 09:03:09 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) [ 584.446478][ T26] audit: type=1804 audit(1575018189.496:97): pid=23023 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/285/bus" dev="sda1" ino=16802 res=1 09:03:09 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}], 0x6, 0x0) 09:03:09 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}], 0x6, 0x0) [ 584.604101][ T26] audit: type=1804 audit(1575018189.686:98): pid=23023 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/285/bus" dev="sda1" ino=16802 res=1 09:03:09 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}], 0x6, 0x0) [ 584.732137][ T26] audit: type=1804 audit(1575018189.816:99): pid=23023 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/285/bus" dev="sda1" ino=16802 res=1 09:03:12 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c", 0xbd}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:03:12 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:03:12 executing program 1: 09:03:12 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}], 0x6, 0x0) 09:03:12 executing program 4: r0 = creat(&(0x7f0000000680)='./bus\x00', 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x0, 0x2) r1 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) sendfile(r0, r1, 0x0, 0xffffffff) r2 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r2, 0x800) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r2, r3, &(0x7f0000000380), 0x8001) sendfile(r2, r3, 0x0, 0x8400fffffffa) sendfile(r2, r3, 0x0, 0xffffffff) r4 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) fchdir(r4) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) write$ppp(0xffffffffffffffff, &(0x7f00000000c0), 0x0) getsockopt$bt_hci(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000100)=""/34, &(0x7f0000000140)=0x22) open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket(0x0, 0x3, 0x87) connect$inet6(r5, &(0x7f0000000140)={0xa, 0x0, 0x0, @rand_addr="ffba4195a8914923d5b3b6e33004d368"}, 0x1c) r6 = creat(&(0x7f0000000680)='./bus\x00', 0x0) fcntl$setstatus(r6, 0x4, 0x6900) lseek(r6, 0x0, 0x2) sendfile(r6, 0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r5, 0x5411, &(0x7f0000000040)) signalfd(0xffffffffffffffff, 0x0, 0x0) fsync(0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)}, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000300)='/dev/full\x00', 0x420242, 0x0) [ 587.254862][ T26] audit: type=1804 audit(1575018192.336:100): pid=23052 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/286/bus" dev="sda1" ino=17281 res=1 09:03:12 executing program 1: 09:03:12 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}], 0x6, 0x0) [ 587.361145][ T26] audit: type=1804 audit(1575018192.436:101): pid=23168 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/286/bus" dev="sda1" ino=17281 res=1 [ 587.436421][ T26] audit: type=1804 audit(1575018192.506:102): pid=23170 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/286/bus" dev="sda1" ino=17281 res=1 09:03:12 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x3, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:03:12 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:03:12 executing program 1: 09:03:12 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}], 0x6, 0x0) [ 587.569914][ T26] audit: type=1804 audit(1575018192.646:103): pid=23175 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/286/bus" dev="sda1" ino=17281 res=1 [ 587.689887][ T26] audit: type=1804 audit(1575018192.766:104): pid=23175 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/286/bus" dev="sda1" ino=17281 res=1 09:03:12 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}], 0x6, 0x0) 09:03:15 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:03:15 executing program 1: 09:03:15 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a", 0xbe}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:03:15 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}], 0x6, 0x0) 09:03:15 executing program 4: r0 = creat(&(0x7f0000000680)='./bus\x00', 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x0, 0x2) r1 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) sendfile(r0, r1, 0x0, 0xffffffff) r2 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r2, 0x800) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r2, r3, &(0x7f0000000380), 0x8001) sendfile(r2, r3, 0x0, 0x8400fffffffa) sendfile(r2, r3, 0x0, 0xffffffff) r4 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) fchdir(r4) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) write$ppp(0xffffffffffffffff, &(0x7f00000000c0), 0x0) getsockopt$bt_hci(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000100)=""/34, &(0x7f0000000140)=0x22) open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket(0x0, 0x3, 0x87) connect$inet6(r5, &(0x7f0000000140)={0xa, 0x0, 0x0, @rand_addr="ffba4195a8914923d5b3b6e33004d368"}, 0x1c) r6 = creat(&(0x7f0000000680)='./bus\x00', 0x0) fcntl$setstatus(r6, 0x4, 0x6900) lseek(r6, 0x0, 0x2) sendfile(r6, 0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r5, 0x5411, &(0x7f0000000040)) signalfd(0xffffffffffffffff, 0x0, 0x0) fsync(0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)}, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000300)='/dev/full\x00', 0x420242, 0x0) [ 590.365739][ T26] audit: type=1804 audit(1575018195.446:105): pid=23204 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/287/bus" dev="sda1" ino=17617 res=1 09:03:15 executing program 1: 09:03:15 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}], 0x6, 0x0) [ 590.516178][ T26] audit: type=1804 audit(1575018195.596:106): pid=23216 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/287/bus" dev="sda1" ino=17617 res=1 [ 590.597019][ T26] audit: type=1804 audit(1575018195.676:107): pid=23218 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/287/bus" dev="sda1" ino=17617 res=1 09:03:15 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98", 0xbf}], 0x3, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:03:15 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a", 0xbe}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:03:15 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:03:15 executing program 1: [ 590.676419][ T26] audit: type=1804 audit(1575018195.716:108): pid=23218 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/287/bus" dev="sda1" ino=17617 res=1 09:03:15 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}], 0x6, 0x0) [ 590.797953][ T26] audit: type=1804 audit(1575018195.756:109): pid=23216 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/287/bus" dev="sda1" ino=17617 res=1 09:03:16 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000400)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x1b, 0x0, 0x4, 0xf0000000, 0x8, 0x3, "5f18029038086f32e6cb830fd8ca3b8afa97c41e8fe39abd6569d7"}, 0x133) write$FUSE_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000100), 0xf58c0472) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4010, r0, 0x28a84000) lstat(0x0, &(0x7f0000000600)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000001500)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socket$nl_route(0x10, 0x3, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x21, 0x2}, 0x7) 09:03:16 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a", 0xbe}], 0x4, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x266, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 09:03:16 executing program 1: 09:03:16 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}], 0x6, 0x0) 09:03:16 executing program 4: r0 = creat(&(0x7f0000000680)='./bus\x00', 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x0, 0x2) r1 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) sendfile(r0, r1, 0x0, 0xffffffff) r2 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r2, 0x800) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r2, r3, &(0x7f0000000380), 0x8001) sendfile(r2, r3, 0x0, 0x8400fffffffa) sendfile(r2, r3, 0x0, 0xffffffff) r4 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) fchdir(r4) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) write$ppp(0xffffffffffffffff, &(0x7f00000000c0), 0x0) getsockopt$bt_hci(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000100)=""/34, &(0x7f0000000140)=0x22) open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket(0x0, 0x3, 0x87) connect$inet6(r5, &(0x7f0000000140)={0xa, 0x0, 0x0, @rand_addr="ffba4195a8914923d5b3b6e33004d368"}, 0x1c) r6 = creat(&(0x7f0000000680)='./bus\x00', 0x0) fcntl$setstatus(r6, 0x4, 0x6900) lseek(r6, 0x0, 0x2) sendfile(r6, 0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r5, 0x5411, &(0x7f0000000040)) signalfd(0xffffffffffffffff, 0x0, 0x0) fsync(0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)}, 0x0) ftruncate(0xffffffffffffffff, 0x1) 09:03:16 executing program 1: 09:03:16 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x40000000003, 0x4, 0x4, 0x7cb, 0x0, 0xffffffffffffff9c}, 0x2c) pipe(&(0x7f0000000300)) socket$inet6(0xa, 0x80003, 0x6b) socket$inet(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000300)) socket$inet_tcp(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}], 0x6, 0x0) [ 591.450754][ T26] audit: type=1804 audit(1575018196.526:110): pid=23264 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/288/bus" dev="sda1" ino=16721 res=1 [ 591.551481][T23267] ================================================================== [ 591.559626][T23267] BUG: KCSAN: data-race in ondemand_readahead / ondemand_readahead [ 591.567513][T23267] [ 591.569845][T23267] read to 0xffff8881214e4f98 of 8 bytes by task 23264 on cpu 1: [ 591.577479][T23267] ondemand_readahead+0xfa/0x710 [ 591.582420][T23267] page_cache_sync_readahead+0x1ad/0x1e0 [ 591.588056][T23267] generic_file_read_iter+0xeb6/0x1440 [ 591.593518][T23267] ext4_file_read_iter+0xfa/0x240 [ 591.598563][T23267] generic_file_splice_read+0x35c/0x500 [ 591.604102][T23267] do_splice_to+0xf2/0x130 [ 591.608531][T23267] splice_direct_to_actor+0x1a1/0x510 [ 591.613902][T23267] do_splice_direct+0x161/0x1e0 [ 591.618749][T23267] do_sendfile+0x384/0x7f0 [ 591.623169][T23267] __x64_sys_sendfile64+0x12a/0x140 [ 591.623425][ T26] audit: type=1804 audit(1575018196.706:111): pid=23269 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir029571306/syzkaller.b1MaW4/288/bus" dev="sda1" ino=16721 res=1 [ 591.628378][T23267] do_syscall_64+0xcc/0x370 [ 591.659577][T23267] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 591.665459][T23267] [ 591.667783][T23267] write to 0xffff8881214e4f98 of 8 bytes by task 23267 on cpu 0: [ 591.675498][T23267] ondemand_readahead+0x39c/0x710 [ 591.680516][T23267] page_cache_sync_readahead+0x1ad/0x1e0 [ 591.686134][T23267] generic_file_read_iter+0xeb6/0x1440 [ 591.691584][T23267] ext4_file_read_iter+0xfa/0x240 [ 591.696615][T23267] generic_file_splice_read+0x35c/0x500 [ 591.702150][T23267] do_splice_to+0xf2/0x130 [ 591.706550][T23267] splice_direct_to_actor+0x1a1/0x510 [ 591.711910][T23267] do_splice_direct+0x161/0x1e0 [ 591.716748][T23267] do_sendfile+0x384/0x7f0 [ 591.721156][T23267] __x64_sys_sendfile64+0x12a/0x140 [ 591.726362][T23267] do_syscall_64+0xcc/0x370 [ 591.730858][T23267] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 591.736727][T23267] [ 591.739036][T23267] Reported by Kernel Concurrency Sanitizer on: [ 591.745195][T23267] CPU: 0 PID: 23267 Comm: syz-executor.4 Not tainted 5.4.0-syzkaller #0 [ 591.753514][T23267] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 591.763553][T23267] ================================================================== [ 591.771600][T23267] Kernel panic - not syncing: panic_on_warn set ... [ 591.778179][T23267] CPU: 0 PID: 23267 Comm: syz-executor.4 Not tainted 5.4.0-syzkaller #0 [ 591.786494][T23267] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 591.796546][T23267] Call Trace: [ 591.799837][T23267] dump_stack+0x11d/0x181 [ 591.804163][T23267] panic+0x210/0x640 [ 591.808070][T23267] ? vprintk_func+0x8d/0x140 [ 591.812681][T23267] kcsan_report.cold+0xc/0xd [ 591.817356][T23267] kcsan_setup_watchpoint+0x3fe/0x460 [ 591.822723][T23267] __tsan_unaligned_write8+0xc4/0x100 [ 591.828093][T23267] ondemand_readahead+0x39c/0x710 [ 591.833133][T23267] page_cache_sync_readahead+0x1ad/0x1e0 [ 591.838763][T23267] generic_file_read_iter+0xeb6/0x1440 [ 591.844234][T23267] ext4_file_read_iter+0xfa/0x240 [ 591.849259][T23267] generic_file_splice_read+0x35c/0x500 [ 591.854805][T23267] do_splice_to+0xf2/0x130 [ 591.859209][T23267] ? add_to_pipe+0x1a0/0x1a0 [ 591.863788][T23267] ? add_to_pipe+0x1a0/0x1a0 [ 591.868370][T23267] splice_direct_to_actor+0x1a1/0x510 [ 591.873728][T23267] ? generic_pipe_buf_nosteal+0x20/0x20 [ 591.879296][T23267] do_splice_direct+0x161/0x1e0 [ 591.884145][T23267] do_sendfile+0x384/0x7f0 [ 591.888572][T23267] __x64_sys_sendfile64+0x12a/0x140 [ 591.893764][T23267] do_syscall_64+0xcc/0x370 [ 591.898269][T23267] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 591.904147][T23267] RIP: 0033:0x45a679 [ 591.908039][T23267] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 591.927642][T23267] RSP: 002b:00007fc2e9961c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 591.936042][T23267] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000045a679 [ 591.944001][T23267] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000003 [ 591.951961][T23267] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 591.959941][T23267] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fc2e99626d4 [ 591.967914][T23267] R13: 00000000004c8623 R14: 00000000004df300 R15: 00000000ffffffff [ 591.977270][T23267] Kernel Offset: disabled [ 591.981598][T23267] Rebooting in 86400 seconds..