e0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:34 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x0, 0x0, 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:34 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x0, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) [ 385.935137][T11703] overlayfs: missing 'lowerdir' [ 385.982845][T11708] overlayfs: failed to resolve './fil': -2 12:27:34 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:27:34 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 386.075206][T11713] FAT-fs (loop5): bogus number of reserved sectors [ 386.114237][T11713] FAT-fs (loop5): Can't find a valid FAT filesystem 12:27:34 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x0, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:27:34 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:34 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(0x0, 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) [ 386.196430][T11720] overlayfs: failed to resolve './file': -2 12:27:34 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) [ 386.378877][T11726] overlayfs: missing 'lowerdir' [ 386.512737][T11735] overlayfs: failed to resolve './file': -2 12:27:35 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:35 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x0, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:27:35 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(0x0, 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) 12:27:35 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) [ 386.861680][T11742] overlayfs: missing 'lowerdir' 12:27:35 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x0, 0x0, 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:35 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 386.890599][T11744] overlayfs: failed to resolve './file': -2 12:27:35 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(0x0) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:27:35 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:27:35 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x0, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) 12:27:35 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 387.091234][T11757] FAT-fs (loop5): bogus number of reserved sectors [ 387.104013][T11757] FAT-fs (loop5): Can't find a valid FAT filesystem 12:27:35 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(0x0, 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 387.345606][T11768] overlayfs: missing 'lowerdir' 12:27:35 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(0x0) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:27:35 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:36 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x0, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) 12:27:36 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(0x0, 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:36 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) [ 387.775328][T11782] overlayfs: option "workdir=." is useless in a non-upper mount, ignore [ 387.868010][T11782] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent 12:27:36 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x0, &(0x7f0000000140), 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:36 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(0x0) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:27:36 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:36 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x0, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) [ 388.034143][T11793] FAT-fs (loop5): bogus number of reserved sectors 12:27:36 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:27:36 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(0x0, 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 388.081779][T11793] FAT-fs (loop5): Can't find a valid FAT filesystem 12:27:36 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) [ 388.255645][T11804] overlayfs: option "workdir=." is useless in a non-upper mount, ignore [ 388.310707][T11804] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent 12:27:36 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x0, &(0x7f0000000140), 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:36 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) 12:27:37 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:37 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, 0x0, 0x0, 0x0) [ 388.532655][T11822] FAT-fs (loop5): bogus number of reserved sectors 12:27:37 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x0, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:37 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) [ 388.598044][T11822] FAT-fs (loop5): Can't find a valid FAT filesystem 12:27:37 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) [ 388.812021][T11835] overlayfs: option "workdir=." is useless in a non-upper mount, ignore [ 388.866197][T11835] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent 12:27:37 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x0, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:37 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, 0x0, 0x0, 0x0) 12:27:37 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:37 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) 12:27:37 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(0x0, 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) [ 389.220757][T11854] overlayfs: unrecognized mount option "upper" or missing value 12:27:37 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x0, &(0x7f0000000140), 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:37 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:37 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x0, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:37 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, 0x0, 0x0, 0x0) 12:27:38 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, 0x0, 0x0, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) [ 389.532665][T11862] overlayfs: unrecognized mount option "upper" or missing value [ 389.596383][T11868] FAT-fs (loop5): bogus number of reserved sectors 12:27:38 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(0x0, 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:27:38 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 389.642033][T11868] FAT-fs (loop5): Can't find a valid FAT filesystem 12:27:38 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:38 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080), 0x0, 0x0) 12:27:38 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{0x0}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:38 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(0x0, 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:27:38 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, 0x0, 0x0, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) [ 390.006712][T11888] overlayfs: unrecognized mount option "upper" or missing value 12:27:38 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:38 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080), 0x0, 0x0) [ 390.157208][T11897] FAT-fs (loop5): bogus number of reserved sectors [ 390.179752][T11897] FAT-fs (loop5): Can't find a valid FAT filesystem 12:27:38 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:38 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x0, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:27:38 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, 0x0, 0x0, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) 12:27:39 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 390.582543][T11913] overlayfs: workdir and upperdir must be separate subtrees 12:27:39 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x0, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:27:39 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:39 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080), 0x0, 0x0) 12:27:39 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{0x0}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 391.054293][T11928] overlayfs: workdir and upperdir must be separate subtrees 12:27:39 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, 0x0, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:39 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:39 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x0, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:27:39 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080), 0x0, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) 12:27:39 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{0x0}], 0x1, 0x0) [ 391.175794][T11939] FAT-fs (loop5): bogus number of reserved sectors [ 391.230704][T11939] FAT-fs (loop5): Can't find a valid FAT filesystem [ 391.403093][T11950] overlayfs: workdir and upperdir must be separate subtrees 12:27:40 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:40 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080), 0x0, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) 12:27:40 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{0x0}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:40 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, 0x0, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:40 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:27:40 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{0x0}], 0x1, 0x0) [ 391.761923][T11969] overlayfs: failed to resolve './fil': -2 [ 391.778009][T11968] FAT-fs (loop5): bogus number of reserved sectors [ 391.833144][T11968] FAT-fs (loop5): Can't find a valid FAT filesystem 12:27:40 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:27:40 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{0x0}], 0x1, 0x0) 12:27:40 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080), 0x0, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) 12:27:40 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, 0x0, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:40 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 392.266472][T11992] overlayfs: failed to resolve './fil': -2 12:27:40 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080), 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:40 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:40 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)}], 0x1, 0x0) [ 392.519418][T12003] overlayfs: failed to resolve './fil': -2 12:27:41 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:41 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:41 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:27:41 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{0x0}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) 12:27:41 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080), 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 392.795797][T12013] FAT-fs (loop5): bogus number of reserved sectors [ 392.848988][T12016] overlayfs: failed to resolve './file': -2 [ 392.868428][T12013] FAT-fs (loop5): Can't find a valid FAT filesystem 12:27:41 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{0x0}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) 12:27:41 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)}], 0x1, 0x0) 12:27:41 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:41 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080), 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:41 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, 0x0, 0x0, 0x0) [ 393.325603][T12039] overlayfs: failed to resolve './file': -2 12:27:41 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{0x0}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) 12:27:41 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)}], 0x1, 0x0) 12:27:42 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:42 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:42 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{0x0}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:42 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, 0x0, 0x0, 0x0) [ 393.725832][T12054] overlayfs: failed to resolve './file': -2 12:27:42 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) [ 393.826554][T12060] FAT-fs (loop5): bogus number of reserved sectors 12:27:42 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(0x0) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 393.888580][T12060] FAT-fs (loop5): Can't find a valid FAT filesystem 12:27:42 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)}], 0x1, 0x0) 12:27:42 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(0x0) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:42 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:42 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, 0x0, 0x0, 0x0) 12:27:42 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{0x0}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:42 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:42 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) [ 394.396026][T12086] FAT-fs (loop0): bogus number of reserved sectors [ 394.408327][T12086] FAT-fs (loop0): Can't find a valid FAT filesystem 12:27:42 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(0x0) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:43 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080), 0x0, 0x0) [ 394.558563][T12095] FAT-fs (loop5): bogus number of reserved sectors [ 394.565267][T12095] FAT-fs (loop5): Can't find a valid FAT filesystem 12:27:43 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{0x0}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:43 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:43 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080), 0x0, 0x0) 12:27:43 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:43 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) [ 395.069923][T12117] FAT-fs (loop0): bogus number of reserved sectors [ 395.076633][T12117] FAT-fs (loop0): Can't find a valid FAT filesystem 12:27:43 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:43 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080), 0x0, 0x0) 12:27:43 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174", 0xb}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:44 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0xee, 0x408400) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:44 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:44 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 395.707096][T12138] FAT-fs (loop5): bogus number of reserved sectors [ 395.740083][T12138] FAT-fs (loop5): Can't find a valid FAT filesystem [ 395.766491][T12141] FAT-fs (loop1): bogus number of reserved sectors [ 395.775127][T12141] FAT-fs (loop1): Can't find a valid FAT filesystem 12:27:44 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:44 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{0x0}], 0x1, 0x0) 12:27:44 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174", 0xb}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:44 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x408400) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:44 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 396.277264][T12164] FAT-fs (loop5): bogus number of reserved sectors [ 396.304944][T12164] FAT-fs (loop5): Can't find a valid FAT filesystem 12:27:44 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{0x0}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:44 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{0x0}], 0x1, 0x0) 12:27:45 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174", 0xb}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 396.560572][T12172] overlayfs: failed to resolve './bus': -2 12:27:45 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174", 0xb}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:45 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x408400) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 396.766755][T12190] FAT-fs (loop1): bogus number of reserved sectors [ 396.773394][T12190] FAT-fs (loop1): Can't find a valid FAT filesystem [ 396.780607][T12187] FAT-fs (loop5): bogus number of reserved sectors 12:27:45 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 396.860324][T12187] FAT-fs (loop5): Can't find a valid FAT filesystem 12:27:45 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{0x0}], 0x1, 0x0) 12:27:45 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002", 0x11}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:45 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:45 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:45 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, 0x0, 0x0, 0x0) [ 397.364862][T12209] FAT-fs (loop5): invalid media value (0x00) [ 397.392428][T12209] FAT-fs (loop5): Can't find a valid FAT filesystem 12:27:45 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)}], 0x1, 0x0) 12:27:46 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 397.771773][T12224] FAT-fs (loop0): bogus number of reserved sectors [ 397.804977][T12228] FAT-fs (loop4): bogus number of reserved sectors [ 397.811593][T12228] FAT-fs (loop4): Can't find a valid FAT filesystem [ 397.851539][T12224] FAT-fs (loop0): Can't find a valid FAT filesystem 12:27:46 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)}], 0x1, 0x0) 12:27:46 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)}], 0x1, 0x0) 12:27:46 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:46 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:46 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:46 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002", 0x11}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 398.588738][T12250] overlayfs: failed to resolve './file': -2 [ 398.594779][T12255] FAT-fs (loop5): invalid media value (0x00) [ 398.608154][T12255] FAT-fs (loop5): Can't find a valid FAT filesystem 12:27:47 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(0x0, 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:47 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)}], 0x1, 0x0) 12:27:47 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:47 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, 0x0, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:47 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{0x0}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:47 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002", 0x11}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 398.915173][T12262] overlayfs: failed to resolve './fil': -2 12:27:47 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002", 0x11}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 399.056755][T12272] FAT-fs (loop5): invalid media value (0x00) [ 399.068529][T12272] FAT-fs (loop5): Can't find a valid FAT filesystem 12:27:47 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(0x0, 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:47 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{0x0}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 399.186785][T12278] FAT-fs (loop1): invalid media value (0x00) [ 399.222392][T12278] FAT-fs (loop1): Can't find a valid FAT filesystem [ 399.375950][T12284] FAT-fs (loop0): bogus number of reserved sectors [ 399.398553][T12284] FAT-fs (loop0): Can't find a valid FAT filesystem [ 399.414460][T12289] FAT-fs (loop2): bogus number of reserved sectors 12:27:47 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(0x0, 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 399.427704][T12289] FAT-fs (loop2): Can't find a valid FAT filesystem 12:27:48 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x0, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:27:48 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270", 0x14}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 400.043930][T12307] FAT-fs (loop5): invalid media value (0x00) [ 400.080804][T12307] FAT-fs (loop5): Can't find a valid FAT filesystem 12:27:48 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x0, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:48 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(0x0, 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:48 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002", 0x11}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:48 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x0, &(0x7f0000000140), 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:49 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, 0x0, 0x0, 0x0) 12:27:49 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x0, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 400.532287][T12322] FAT-fs (loop0): invalid media value (0x00) [ 400.588476][T12322] FAT-fs (loop0): Can't find a valid FAT filesystem 12:27:49 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(0x0) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) [ 400.788092][T12327] FAT-fs (loop2): bogus number of reserved sectors [ 400.828965][T12327] FAT-fs (loop2): Can't find a valid FAT filesystem 12:27:49 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270", 0x14}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:49 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x0, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:49 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270", 0x14}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 401.110853][T12344] FAT-fs (loop5): invalid media value (0x00) [ 401.134029][T12344] FAT-fs (loop5): Can't find a valid FAT filesystem 12:27:49 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:49 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 401.356719][T12353] FAT-fs (loop1): invalid media value (0x00) [ 401.401768][T12353] FAT-fs (loop1): Can't find a valid FAT filesystem 12:27:50 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:50 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:50 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:50 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:50 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) [ 401.843374][T12374] FAT-fs (loop2): bogus number of reserved sectors [ 401.860460][T12373] overlayfs: missing 'lowerdir' [ 401.870526][T12374] FAT-fs (loop2): Can't find a valid FAT filesystem 12:27:50 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270", 0x14}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:50 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:50 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:50 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 402.223832][T12390] FAT-fs (loop5): invalid media value (0x00) [ 402.236532][T12389] overlayfs: missing 'lowerdir' [ 402.243724][T12388] overlayfs: workdir and upperdir must be separate subtrees [ 402.255303][T12390] FAT-fs (loop5): Can't find a valid FAT filesystem [ 402.310132][T12397] FAT-fs (loop0): bogus number of reserved sectors [ 402.332716][T12397] FAT-fs (loop0): Can't find a valid FAT filesystem [ 402.341624][T12399] overlayfs: missing 'lowerdir' 12:27:50 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:51 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:51 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', 0x0, 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 402.654010][T12410] FAT-fs (loop1): bogus number of reserved sectors [ 402.691116][T12410] FAT-fs (loop1): Can't find a valid FAT filesystem [ 402.704541][T12417] FAT-fs (loop4): bogus number of reserved sectors [ 402.727866][T12417] FAT-fs (loop4): Can't find a valid FAT filesystem 12:27:51 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, 0x0, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:51 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270ff", 0x15}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:51 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', 0x0, 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 403.327027][T12434] FAT-fs (loop5): invalid media value (0x00) [ 403.334123][T12434] FAT-fs (loop5): Can't find a valid FAT filesystem 12:27:52 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) 12:27:52 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) 12:27:52 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, 0x0, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:52 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270ff", 0x15}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 403.771588][T12449] overlayfs: workdir and upperdir must be separate subtrees 12:27:52 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 403.862499][T12452] overlayfs: workdir and upperdir must be separate subtrees [ 403.967794][T12457] FAT-fs (loop5): invalid media value (0x00) [ 403.994293][T12457] FAT-fs (loop5): Can't find a valid FAT filesystem 12:27:52 executing program 4: syz_mount_image$vfat(0x0, &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:52 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, 0x0, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:52 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 404.144299][T12465] overlayfs: unrecognized mount option "upper" or missing value 12:27:52 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270ff", 0x15}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:52 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270ff", 0x15}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 404.485093][T12478] overlayfs: option "workdir=." is useless in a non-upper mount, ignore 12:27:53 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080), 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 404.542050][T12478] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent 12:27:53 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, 0x0, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 404.844413][T12487] FAT-fs (loop5): invalid media value (0x00) [ 404.908627][T12487] FAT-fs (loop5): Can't find a valid FAT filesystem [ 404.926575][T12490] FAT-fs (loop1): invalid media value (0x00) 12:27:53 executing program 0: syz_mount_image$vfat(0x0, &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:53 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080), 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 404.981216][T12490] FAT-fs (loop1): Can't find a valid FAT filesystem 12:27:53 executing program 4: syz_mount_image$vfat(0x0, &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:53 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(0x0, 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:53 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270ff", 0x15}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:53 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080), 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:54 executing program 1: r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 405.990003][T12533] FAT-fs (loop2): invalid media value (0x00) 12:27:54 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(0x0, 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 406.038147][T12533] FAT-fs (loop2): Can't find a valid FAT filesystem [ 406.065672][T12532] overlayfs: failed to resolve './bus': -2 12:27:54 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(0x0, 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:54 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) 12:27:54 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:54 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{0x0}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:55 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, 0x0, &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 406.645655][T12559] overlayfs: missing 'lowerdir' 12:27:55 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(0x0, 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:55 executing program 1: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:27:55 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:55 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{0x0}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 407.003526][T12577] overlayfs: failed to resolve './file1': -2 12:27:55 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r1, 0x40047452, 0x0) recvmmsg(r1, 0x0, 0x0, 0x0, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r2, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r3, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r4, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) setsockopt$EBT_SO_SET_ENTRIES(r6, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r6, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r3, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000), 0x8080fffffffe) 12:27:55 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) ioctl$PPPIOCGMRU(0xffffffffffffffff, 0x40047452, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r2, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r3, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r4, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) setsockopt$EBT_SO_SET_ENTRIES(r6, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r6, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r3, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:55 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:27:56 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) 12:27:56 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{0x0}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:56 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(0xffffffffffffffff) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 407.969038][T12604] overlayfs: failed to resolve './file0': -2 12:27:56 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:56 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:56 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) [ 408.154288][T12595] FAT-fs (loop2): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 408.177706][T12595] FAT-fs (loop2): Filesystem has been set read-only [ 408.207591][T12595] FAT-fs (loop2): error, fat_free: invalid cluster chain (i_pos 17) 12:27:56 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) [ 408.551091][T12630] overlayfs: failed to resolve './file0': -2 12:27:57 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:57 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:57 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 408.783100][T12625] FAT-fs (loop4): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 408.792418][T12625] FAT-fs (loop4): Filesystem has been set read-only [ 408.800787][T12625] FAT-fs (loop4): error, fat_free: invalid cluster chain (i_pos 17) 12:27:57 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:57 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(0xffffffffffffffff) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:57 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 409.427188][T12645] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 409.436246][T12645] FAT-fs (loop1): Filesystem has been set read-only [ 409.443783][T12645] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 12:27:58 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:58 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) [ 409.646285][T12636] FAT-fs (loop2): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 409.708090][T12636] FAT-fs (loop2): Filesystem has been set read-only [ 409.718598][T12636] FAT-fs (loop2): error, fat_free: invalid cluster chain (i_pos 17) 12:27:58 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:58 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:58 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:27:58 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 410.281122][ T27] kauditd_printk_skb: 6 callbacks suppressed [ 410.281188][ T27] audit: type=1804 audit(1581683278.760:421): pid=12678 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir010268368/syzkaller.oJWIF1/170/bus/bus" dev="overlay" ino=16520 res=1 12:27:58 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(0xffffffffffffffff) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:58 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 410.493123][ T27] audit: type=1804 audit(1581683278.970:422): pid=12678 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir010268368/syzkaller.oJWIF1/170/bus/bus" dev="overlay" ino=16520 res=1 12:27:59 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:27:59 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:27:59 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 411.154425][T12685] FAT-fs (loop4): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 411.189288][T12685] FAT-fs (loop4): Filesystem has been set read-only [ 411.205438][T12685] FAT-fs (loop4): error, fat_free: invalid cluster chain (i_pos 17) [ 411.248013][ T27] audit: type=1804 audit(1581683279.720:423): pid=12705 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir010268368/syzkaller.oJWIF1/171/bus/bus" dev="overlay" ino=16550 res=1 12:27:59 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:27:59 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 411.366595][ T27] audit: type=1804 audit(1581683279.810:424): pid=12705 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir010268368/syzkaller.oJWIF1/171/bus/bus" dev="overlay" ino=16550 res=1 12:27:59 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 411.422835][ T27] audit: type=1804 audit(1581683279.890:425): pid=12708 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir103503770/syzkaller.GOJBao/181/bus/bus" dev="overlay" ino=16535 res=1 [ 411.570695][ T27] audit: type=1804 audit(1581683280.050:426): pid=12708 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir103503770/syzkaller.GOJBao/181/bus/bus" dev="overlay" ino=16535 res=1 12:28:00 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:00 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(0x0, 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:00 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 411.778568][ T27] audit: type=1804 audit(1581683280.260:427): pid=12721 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir010268368/syzkaller.oJWIF1/172/bus/bus" dev="overlay" ino=16540 res=1 [ 411.864880][ T27] audit: type=1804 audit(1581683280.330:428): pid=12721 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir010268368/syzkaller.oJWIF1/172/bus/bus" dev="overlay" ino=16540 res=1 12:28:00 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(0x0, 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 412.011062][ T27] audit: type=1804 audit(1581683280.490:429): pid=12724 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir736071786/syzkaller.nTxy8H/145/bus/bus" dev="overlay" ino=16539 res=1 12:28:00 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:28:00 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:28:00 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r3, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r4, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) setsockopt$EBT_SO_SET_ENTRIES(r6, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r6, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r3, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 412.141072][ T27] audit: type=1804 audit(1581683280.540:430): pid=12724 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir736071786/syzkaller.nTxy8H/145/bus/bus" dev="overlay" ino=16539 res=1 12:28:01 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(0x0, 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:01 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) [ 412.698007][T12749] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 412.727815][T12749] FAT-fs (loop1): Filesystem has been set read-only [ 412.746749][T12749] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 12:28:01 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) 12:28:01 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:28:01 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r3, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r4, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) setsockopt$EBT_SO_SET_ENTRIES(r6, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r6, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r3, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:01 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x0, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:01 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:01 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) [ 413.341460][T12770] overlayfs: './bus' not a directory 12:28:02 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x0, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:02 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:28:02 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:02 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x0, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:02 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:02 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) 12:28:02 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:02 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:02 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r3, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r4, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) setsockopt$EBT_SO_SET_ENTRIES(r6, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r6, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r3, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:03 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(0xffffffffffffffff, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:03 executing program 3: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r3, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r4, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) setsockopt$EBT_SO_SET_ENTRIES(r6, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r6, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r3, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:03 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r3, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r4, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) setsockopt$EBT_SO_SET_ENTRIES(r6, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r6, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r3, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 415.160206][T12840] FAT-fs (loop4): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 415.169114][T12840] FAT-fs (loop4): Filesystem has been set read-only [ 415.176638][T12840] FAT-fs (loop4): error, fat_free: invalid cluster chain (i_pos 17) 12:28:03 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) 12:28:03 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:03 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) [ 415.376337][T12826] FAT-fs (loop2): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 415.394767][T12826] FAT-fs (loop2): Filesystem has been set read-only [ 415.411002][T12826] FAT-fs (loop2): error, fat_free: invalid cluster chain (i_pos 17) 12:28:04 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) [ 415.481049][ T27] kauditd_printk_skb: 26 callbacks suppressed [ 415.481072][ T27] audit: type=1804 audit(1581683283.960:457): pid=12847 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir210777302/syzkaller.YTzwAy/172/bus/bus" dev="overlay" ino=16519 res=1 12:28:04 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(0xffffffffffffffff, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 415.562915][ T27] audit: type=1804 audit(1581683284.010:458): pid=12847 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir210777302/syzkaller.YTzwAy/172/bus/bus" dev="overlay" ino=16519 res=1 12:28:04 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) [ 415.637735][T12836] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 415.653777][T12836] FAT-fs (loop3): Filesystem has been set read-only [ 415.683237][T12836] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 17) 12:28:04 executing program 3: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r3, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r4, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) setsockopt$EBT_SO_SET_ENTRIES(r6, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r6, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r3, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 415.790497][ T27] audit: type=1804 audit(1581683284.270:459): pid=12851 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir103503770/syzkaller.GOJBao/186/bus/bus" dev="overlay" ino=16526 res=1 [ 415.955259][ T27] audit: type=1804 audit(1581683284.410:460): pid=12851 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir103503770/syzkaller.GOJBao/186/bus/bus" dev="overlay" ino=16526 res=1 12:28:04 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r3, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r4, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) setsockopt$EBT_SO_SET_ENTRIES(r6, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r6, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r3, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:04 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) [ 416.306382][ T27] audit: type=1804 audit(1581683284.780:461): pid=12872 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir210777302/syzkaller.YTzwAy/173/bus/bus" dev="sda1" ino=16589 res=1 [ 416.417138][ T27] audit: type=1804 audit(1581683284.880:462): pid=12872 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir210777302/syzkaller.YTzwAy/173/bus/bus" dev="sda1" ino=16589 res=1 [ 416.502815][T12866] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 416.525489][T12866] FAT-fs (loop3): Filesystem has been set read-only [ 416.541190][T12866] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 17) 12:28:05 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:28:05 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(r0, 0x0, 0x2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) 12:28:05 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(r0, 0x0, 0x2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) [ 416.788473][T12881] FAT-fs (loop0): error, fat_get_cluster: invalid cluster chain (i_pos 17) 12:28:05 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(0xffffffffffffffff, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 416.844953][T12881] FAT-fs (loop0): Filesystem has been set read-only [ 416.854201][ T27] audit: type=1804 audit(1581683285.330:463): pid=12886 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir736071786/syzkaller.nTxy8H/151/bus/bus" dev="overlay" ino=16546 res=1 [ 416.928794][T12881] FAT-fs (loop0): error, fat_free: invalid cluster chain (i_pos 17) [ 417.015909][ T27] audit: type=1804 audit(1581683285.490:465): pid=12889 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir010268368/syzkaller.oJWIF1/178/bus/bus" dev="overlay" ino=16595 res=1 12:28:05 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:28:05 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) pwritev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 417.142569][ T27] audit: type=1804 audit(1581683285.490:464): pid=12886 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir736071786/syzkaller.nTxy8H/151/bus/bus" dev="overlay" ino=16546 res=1 [ 417.172298][ T27] audit: type=1804 audit(1581683285.630:466): pid=12889 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir010268368/syzkaller.oJWIF1/178/bus/bus" dev="overlay" ino=16595 res=1 12:28:05 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:05 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(r0, 0x0, 0x2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) 12:28:05 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(r0, 0x0, 0x2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) 12:28:06 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:28:06 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:06 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 417.952907][T12906] FAT-fs (loop0): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 417.984233][T12906] FAT-fs (loop0): Filesystem has been set read-only [ 417.996501][T12906] FAT-fs (loop0): error, fat_free: invalid cluster chain (i_pos 17) 12:28:06 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:28:06 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:06 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:06 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:28:07 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:28:07 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) [ 418.885556][T12924] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 418.912585][T12937] FAT-fs (loop0): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 418.926895][T12937] FAT-fs (loop0): Filesystem has been set read-only 12:28:07 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 418.939884][T12937] FAT-fs (loop0): error, fat_free: invalid cluster chain (i_pos 17) [ 418.960592][T12924] FAT-fs (loop5): Filesystem has been set read-only [ 418.967391][T12924] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) 12:28:07 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:07 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:07 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:07 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 419.664801][T12954] FAT-fs (loop0): error, fat_get_cluster: invalid cluster chain (i_pos 17) 12:28:08 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 419.736679][T12954] FAT-fs (loop0): Filesystem has been set read-only [ 419.769421][T12954] FAT-fs (loop0): error, fat_free: invalid cluster chain (i_pos 17) 12:28:08 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:08 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:08 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) 12:28:08 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 420.154646][T12965] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 420.210075][T12965] FAT-fs (loop5): Filesystem has been set read-only [ 420.226623][T12965] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) 12:28:08 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:09 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 420.554342][ T27] kauditd_printk_skb: 19 callbacks suppressed [ 420.554364][ T27] audit: type=1804 audit(1581683289.030:486): pid=12991 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir103503770/syzkaller.GOJBao/191/bus/bus" dev="overlay" ino=16595 res=1 12:28:09 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 420.742918][ T27] audit: type=1804 audit(1581683289.070:487): pid=12996 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir736071786/syzkaller.nTxy8H/156/bus/bus" dev="overlay" ino=16550 res=1 12:28:09 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 420.822603][ T27] audit: type=1804 audit(1581683289.150:488): pid=12991 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir103503770/syzkaller.GOJBao/191/bus/bus" dev="overlay" ino=16595 res=1 [ 420.906307][ T27] audit: type=1804 audit(1581683289.380:489): pid=12996 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir736071786/syzkaller.nTxy8H/156/bus/bus" dev="overlay" ino=16550 res=1 12:28:09 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:09 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:09 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:09 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 421.463214][ T27] audit: type=1804 audit(1581683289.940:490): pid=13020 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir736071786/syzkaller.nTxy8H/157/bus/bus" dev="overlay" ino=16563 res=1 12:28:10 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 421.780318][T13028] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 421.874469][T13028] FAT-fs (loop5): Filesystem has been set read-only [ 421.919981][ T27] audit: type=1804 audit(1581683290.020:491): pid=13020 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir736071786/syzkaller.nTxy8H/157/bus/bus" dev="overlay" ino=16563 res=1 [ 421.956526][T13028] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) 12:28:10 executing program 3: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 421.965860][T13024] FAT-fs (loop4): error, fat_get_cluster: invalid cluster chain (i_pos 17) 12:28:10 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:10 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 422.085558][T13024] FAT-fs (loop4): Filesystem has been set read-only 12:28:10 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:10 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 422.131825][T13024] FAT-fs (loop4): error, fat_free: invalid cluster chain (i_pos 17) 12:28:10 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:10 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 423.013328][T13049] FAT-fs (loop0): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 423.043642][T13049] FAT-fs (loop0): Filesystem has been set read-only [ 423.054077][T13049] FAT-fs (loop0): error, fat_free: invalid cluster chain (i_pos 17) 12:28:11 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:11 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000200)='./bus\x00', 0x0) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:11 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 423.106808][T13048] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 423.144283][T13048] FAT-fs (loop3): Filesystem has been set read-only [ 423.156350][T13048] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 17) 12:28:11 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:28:11 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 423.501606][T13088] overlayfs: failed to resolve './bus': -2 [ 423.518703][ T27] audit: type=1804 audit(1581683292.000:492): pid=13083 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir736071786/syzkaller.nTxy8H/159/bus/bus" dev="overlay" ino=16596 res=1 12:28:12 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000200)='./bus\x00', 0x0) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 423.630296][ T27] audit: type=1804 audit(1581683292.030:493): pid=13083 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir736071786/syzkaller.nTxy8H/159/bus/bus" dev="overlay" ino=16596 res=1 12:28:12 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:28:12 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:28:12 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 423.819984][T13093] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 423.851021][T13093] FAT-fs (loop5): Filesystem has been set read-only [ 423.860192][T13093] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) 12:28:12 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x0, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:12 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000200)='./bus\x00', 0x0) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 424.194913][ T27] audit: type=1804 audit(1581683292.670:494): pid=13101 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir210777302/syzkaller.YTzwAy/180/bus/bus" dev="overlay" ino=16542 res=1 12:28:12 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 424.352806][ T27] audit: type=1804 audit(1581683292.830:495): pid=13101 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir210777302/syzkaller.YTzwAy/180/bus/bus" dev="overlay" ino=16542 res=1 [ 424.396914][T13109] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 424.431466][T13109] FAT-fs (loop5): Filesystem has been set read-only 12:28:13 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:28:13 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 424.506956][T13109] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) 12:28:13 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) 12:28:13 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:13 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x0, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:13 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x0, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 425.067256][T13142] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 425.077033][T13142] FAT-fs (loop5): Filesystem has been set read-only [ 425.083929][T13142] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) 12:28:13 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:13 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:13 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:13 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:13 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:14 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) 12:28:14 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 425.977436][T13171] FAT-fs (loop0): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 425.988354][T13171] FAT-fs (loop0): Filesystem has been set read-only 12:28:14 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:14 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 426.086251][T13171] FAT-fs (loop0): error, fat_free: invalid cluster chain (i_pos 17) 12:28:14 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x0, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:14 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:14 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) [ 426.406920][ T27] kauditd_printk_skb: 6 callbacks suppressed [ 426.407005][ T27] audit: type=1804 audit(1581683294.880:502): pid=13183 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir736071786/syzkaller.nTxy8H/162/bus/bus" dev="overlay" ino=16609 res=1 12:28:15 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 426.532987][ T27] audit: type=1804 audit(1581683294.990:503): pid=13183 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir736071786/syzkaller.nTxy8H/162/bus/bus" dev="overlay" ino=16609 res=1 12:28:15 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:15 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) [ 426.704963][ T27] audit: type=1804 audit(1581683295.180:504): pid=13199 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir103503770/syzkaller.GOJBao/197/bus/bus" dev="overlay" ino=16689 res=1 12:28:15 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 426.988061][ T27] audit: type=1804 audit(1581683295.460:505): pid=13214 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir736071786/syzkaller.nTxy8H/163/bus/bus" dev="overlay" ino=16542 res=1 12:28:15 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 427.127923][ T27] audit: type=1804 audit(1581683295.480:506): pid=13199 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir103503770/syzkaller.GOJBao/197/bus/bus" dev="overlay" ino=16689 res=1 [ 427.155593][ T27] audit: type=1804 audit(1581683295.590:507): pid=13214 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir736071786/syzkaller.nTxy8H/163/bus/bus" dev="overlay" ino=16542 res=1 [ 427.256717][T13219] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 427.265710][T13219] FAT-fs (loop5): Filesystem has been set read-only [ 427.273439][T13219] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) 12:28:15 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:15 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:15 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:16 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 427.659003][T13233] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 427.682938][T13233] FAT-fs (loop5): Filesystem has been set read-only [ 427.700908][T13233] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) 12:28:16 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:16 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:16 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:28:16 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:16 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 427.993380][ T27] audit: type=1804 audit(1581683296.470:508): pid=13243 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir736071786/syzkaller.nTxy8H/165/bus/bus" dev="overlay" ino=16674 res=1 12:28:16 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 428.286384][ T27] audit: type=1804 audit(1581683296.750:509): pid=13243 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir736071786/syzkaller.nTxy8H/165/bus/bus" dev="overlay" ino=16674 res=1 [ 428.389788][T13256] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 428.420650][T13251] FAT-fs (loop4): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 428.429662][T13251] FAT-fs (loop4): Filesystem has been set read-only [ 428.438377][T13251] FAT-fs (loop4): error, fat_free: invalid cluster chain (i_pos 17) [ 428.451888][T13256] FAT-fs (loop5): Filesystem has been set read-only [ 428.528118][T13256] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) 12:28:17 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:17 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:17 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 428.586212][ T27] audit: type=1804 audit(1581683296.840:510): pid=13246 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir010268368/syzkaller.oJWIF1/189/bus/bus" dev="overlay" ino=16538 res=1 12:28:17 executing program 3: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:17 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 428.672142][T13270] overlayfs: failed to resolve './file0': -2 [ 428.786492][ T27] audit: type=1804 audit(1581683296.990:511): pid=13246 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir010268368/syzkaller.oJWIF1/189/bus/bus" dev="overlay" ino=16538 res=1 12:28:17 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:17 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 429.010217][T13290] overlayfs: failed to resolve './file0': -2 12:28:17 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 429.132635][T13294] overlayfs: failed to resolve './file0': -2 12:28:17 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) 12:28:17 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:17 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:18 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:18 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) 12:28:18 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000400)=0x3) r2 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r2, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:18 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000400)=0x3) r2 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r2, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) 12:28:18 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:18 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 430.147668][T13318] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 430.226704][T13318] FAT-fs (loop5): Filesystem has been set read-only [ 430.275457][T13318] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) 12:28:18 executing program 1: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:18 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r3, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r4, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) setsockopt$EBT_SO_SET_ENTRIES(r6, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r6, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r3, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 430.576176][T13338] overlayfs: failed to resolve './file1': -2 12:28:19 executing program 1: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:19 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:19 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000400)=0x3) r2 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r2, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:19 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000400)=0x3) r2 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r2, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) [ 431.009694][T13349] overlayfs: failed to resolve './file1': -2 [ 431.044501][T13342] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 431.051299][T13332] FAT-fs (loop2): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 431.062357][T13342] FAT-fs (loop5): Filesystem has been set read-only [ 431.098714][T13342] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) [ 431.166548][T13332] FAT-fs (loop2): Filesystem has been set read-only 12:28:19 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r3, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r4, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) setsockopt$EBT_SO_SET_ENTRIES(r6, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r6, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r3, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:19 executing program 1: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 431.207810][T13332] FAT-fs (loop2): error, fat_free: invalid cluster chain (i_pos 17) [ 431.245742][T13351] FAT-fs (loop0): error, fat_get_cluster: invalid cluster chain (i_pos 17) 12:28:19 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 431.276707][T13351] FAT-fs (loop0): Filesystem has been set read-only [ 431.308202][T13351] FAT-fs (loop0): error, fat_free: invalid cluster chain (i_pos 17) 12:28:20 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r3, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r4, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) setsockopt$EBT_SO_SET_ENTRIES(r6, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r6, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r3, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 431.554539][ T27] kauditd_printk_skb: 12 callbacks suppressed [ 431.554561][ T27] audit: type=1804 audit(1581683300.030:524): pid=13360 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir736071786/syzkaller.nTxy8H/168/bus/bus" dev="overlay" ino=16546 res=1 12:28:20 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 431.651067][T13373] overlayfs: failed to resolve './file1': -2 [ 431.864659][T13375] FAT-fs (loop4): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 431.878291][T13375] FAT-fs (loop4): Filesystem has been set read-only [ 431.885659][T13375] FAT-fs (loop4): error, fat_free: invalid cluster chain (i_pos 17) [ 431.917349][ T27] audit: type=1804 audit(1581683300.390:525): pid=13360 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir736071786/syzkaller.nTxy8H/168/bus/bus" dev="overlay" ino=16546 res=1 12:28:20 executing program 1: mkdir(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:20 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000400)=0x3) r2 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r2, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) [ 432.197175][T13390] overlayfs: failed to resolve './file1': -2 12:28:20 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r3, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r4, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) setsockopt$EBT_SO_SET_ENTRIES(r6, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r6, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r3, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:20 executing program 1: mkdir(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:20 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 432.313413][T13366] FAT-fs (loop2): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 432.343212][T13366] FAT-fs (loop2): Filesystem has been set read-only [ 432.350697][T13366] FAT-fs (loop2): error, fat_free: invalid cluster chain (i_pos 17) 12:28:20 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 432.483361][ T27] audit: type=1804 audit(1581683300.960:526): pid=13393 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir736071786/syzkaller.nTxy8H/169/bus/bus" dev="overlay" ino=16516 res=1 [ 432.510651][T13397] overlayfs: failed to resolve './file1': -2 [ 432.728934][ T27] audit: type=1804 audit(1581683301.110:527): pid=13393 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir736071786/syzkaller.nTxy8H/169/bus/bus" dev="overlay" ino=16516 res=1 12:28:21 executing program 1: mkdir(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:21 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:21 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000400)=0x3) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) pwritev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 433.100516][T13419] overlayfs: failed to resolve './file1': -2 12:28:21 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:22 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x0) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:22 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:22 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 433.793017][ T27] audit: type=1804 audit(1581683302.270:528): pid=13429 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir736071786/syzkaller.nTxy8H/170/bus/bus" dev="overlay" ino=16488 res=1 12:28:22 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000400)=0x3) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) pwritev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) [ 433.870695][T13421] FAT-fs (loop0): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 433.901178][T13421] FAT-fs (loop0): Filesystem has been set read-only [ 433.922939][T13421] FAT-fs (loop0): error, fat_free: invalid cluster chain (i_pos 17) [ 433.929994][T13433] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 433.942333][T13433] FAT-fs (loop5): Filesystem has been set read-only [ 433.958631][T13433] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) 12:28:22 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000400)=0x3) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) pwritev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) 12:28:22 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000400)=0x3) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r2 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r2, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:28:22 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000400)=0x3) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r2 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r2, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b49, 0x0) 12:28:22 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 434.087723][ T27] audit: type=1804 audit(1581683302.560:529): pid=13445 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir010268368/syzkaller.oJWIF1/195/bus/bus" dev="overlay" ino=16532 res=1 12:28:22 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x0) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:22 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 434.650674][T13467] overlayfs: failed to resolve './file0': -2 [ 434.667869][ T27] audit: type=1804 audit(1581683303.140:530): pid=13460 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir736071786/syzkaller.nTxy8H/171/bus/bus" dev="overlay" ino=16674 res=1 12:28:23 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 434.777155][T13457] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 434.790484][ T27] audit: type=1804 audit(1581683303.250:531): pid=13460 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir736071786/syzkaller.nTxy8H/171/bus/bus" dev="overlay" ino=16674 res=1 [ 434.821144][T13457] FAT-fs (loop5): Filesystem has been set read-only [ 434.845877][T13471] overlayfs: failed to resolve './file0': -2 12:28:23 executing program 3: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x0) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 434.855093][ T27] audit: type=1804 audit(1581683303.330:532): pid=13455 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir103503770/syzkaller.GOJBao/204/bus/bus" dev="overlay" ino=16818 res=1 [ 434.886711][T13457] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) 12:28:23 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:23 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:23 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:23 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x0) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 435.016925][ T27] audit: type=1804 audit(1581683303.490:533): pid=13464 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir010268368/syzkaller.oJWIF1/196/bus/bus" dev="overlay" ino=16517 res=1 [ 435.082447][T13475] overlayfs: failed to resolve './file0': -2 12:28:23 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, 0x0, &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:23 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 435.449211][T13481] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 435.458049][T13481] FAT-fs (loop3): Filesystem has been set read-only [ 435.465469][T13481] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 17) 12:28:24 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x0) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 435.510730][T13500] overlayfs: failed to resolve './file0': -2 12:28:24 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000400)=0x3) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r2 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r2, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:28:24 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, 0x0, &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:24 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, 0x0, &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:24 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:24 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:24 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x0) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:24 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r4, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) setsockopt$EBT_SO_SET_ENTRIES(r6, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r6, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(0xffffffffffffffff, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 436.331896][T13507] FAT-fs (loop2): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 436.363033][T13507] FAT-fs (loop2): Filesystem has been set read-only [ 436.421733][T13507] FAT-fs (loop2): error, fat_free: invalid cluster chain (i_pos 17) 12:28:25 executing program 3: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r4, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) setsockopt$EBT_SO_SET_ENTRIES(r6, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r6, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(0xffffffffffffffff, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:25 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:25 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) [ 436.871218][T13531] FAT-fs (loop0): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 436.918049][T13531] FAT-fs (loop0): Filesystem has been set read-only [ 436.928623][T13531] FAT-fs (loop0): error, fat_free: invalid cluster chain (i_pos 17) 12:28:25 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000400)=0x3) r2 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r2, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) [ 437.109455][T13527] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) 12:28:25 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 437.176813][T13527] FAT-fs (loop5): Filesystem has been set read-only [ 437.266873][T13537] FAT-fs (loop4): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 437.274997][T13527] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) [ 437.281878][T13537] FAT-fs (loop4): Filesystem has been set read-only [ 437.295443][T13537] FAT-fs (loop4): error, fat_free: invalid cluster chain (i_pos 17) [ 437.356326][ T27] kauditd_printk_skb: 3 callbacks suppressed [ 437.356348][ T27] audit: type=1804 audit(1581683305.830:537): pid=13547 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir010268368/syzkaller.oJWIF1/199/bus/bus" dev="overlay" ino=16506 res=1 12:28:26 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 437.564592][ T27] audit: type=1804 audit(1581683306.040:538): pid=13547 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir010268368/syzkaller.oJWIF1/199/bus/bus" dev="overlay" ino=16506 res=1 [ 437.595575][T13550] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 437.604670][T13550] FAT-fs (loop3): Filesystem has been set read-only 12:28:26 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 437.618243][T13550] FAT-fs (loop3): error, fat_free: invalid cluster chain (i_pos 17) 12:28:26 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 437.655054][ T27] audit: type=1804 audit(1581683306.130:539): pid=13555 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir103503770/syzkaller.GOJBao/207/bus/bus" dev="overlay" ino=16769 res=1 12:28:26 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000400)=0x3) r2 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r2, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:28:26 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) [ 437.792035][ T27] audit: type=1804 audit(1581683306.270:540): pid=13555 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir103503770/syzkaller.GOJBao/207/bus/bus" dev="overlay" ino=16769 res=1 [ 437.880929][T13569] overlayfs: missing 'lowerdir' 12:28:26 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:26 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000400)=0x3) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) pwritev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) [ 438.043579][T13580] overlayfs: missing 'lowerdir' 12:28:26 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 438.158669][ T27] audit: type=1804 audit(1581683306.640:541): pid=13571 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir736071786/syzkaller.nTxy8H/175/bus/bus" dev="overlay" ino=16548 res=1 [ 438.278137][ T27] audit: type=1804 audit(1581683306.740:542): pid=13586 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir736071786/syzkaller.nTxy8H/175/bus/bus" dev="overlay" ino=16548 res=1 [ 438.380293][ T27] audit: type=1804 audit(1581683306.860:543): pid=13589 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir103503770/syzkaller.GOJBao/208/bus/bus" dev="overlay" ino=16642 res=1 12:28:26 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000400)=0x3) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r2 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r2, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:28:26 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000400)=0x3) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r2 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r2, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) [ 438.496062][T13593] overlayfs: missing 'lowerdir' [ 438.630108][ T27] audit: type=1804 audit(1581683307.110:544): pid=13585 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir010268368/syzkaller.oJWIF1/200/bus/bus" dev="overlay" ino=16488 res=1 12:28:27 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:27 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 438.760775][ T27] audit: type=1804 audit(1581683307.180:545): pid=13597 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir103503770/syzkaller.GOJBao/209/bus/bus" dev="overlay" ino=16660 res=1 12:28:27 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 438.815664][ T27] audit: type=1804 audit(1581683307.220:546): pid=13597 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir103503770/syzkaller.GOJBao/209/bus/bus" dev="overlay" ino=16660 res=1 12:28:27 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), 0xffffffffffffffff, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) setsockopt$EBT_SO_SET_ENTRIES(r6, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r6, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:27 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) [ 438.996797][T13602] overlayfs: missing 'lowerdir' 12:28:27 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:27 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000400)=0x3) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r2 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r2, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 439.475030][T13627] overlayfs: missing 'lowerdir' 12:28:28 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:28 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100), 0x2, 0xa}}, 0x20) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) setsockopt$EBT_SO_SET_ENTRIES(r6, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r6, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 439.860713][T13639] overlayfs: missing 'lowerdir' 12:28:28 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:28 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:28 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 440.154949][T13616] FAT-fs (loop4): error, fat_get_cluster: invalid cluster chain (i_pos 17) 12:28:28 executing program 3: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100), 0x2, 0xa}}, 0x20) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) setsockopt$EBT_SO_SET_ENTRIES(r6, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r6, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 440.250069][T13616] FAT-fs (loop4): Filesystem has been set read-only [ 440.270303][T13633] FAT-fs (loop0): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 440.281160][T13633] FAT-fs (loop0): Filesystem has been set read-only [ 440.289796][T13633] FAT-fs (loop0): error, fat_free: invalid cluster chain (i_pos 17) [ 440.328070][T13616] FAT-fs (loop4): error, fat_free: invalid cluster chain (i_pos 17) 12:28:28 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') lgetxattr(&(0x7f0000000140)='./file1\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="6f731d2e6f7665726c61a655ab284a6690a523ec82fe3d16b97900"], &(0x7f0000000300)=""/158, 0x9e) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) truncate(&(0x7f00000000c0)='./file1\x00', 0xfff) open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(r0, 0x0, 0x2) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$video4linux(&(0x7f00000003c0)='/dev/v4l-subdev#\x00', 0xee, 0x408400) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000400)=0x3) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) r2 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r2, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$PIO_FONTX(r3, 0x4b49, 0x0) [ 440.466526][T13649] overlayfs: missing 'lowerdir' 12:28:29 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:29 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 440.937529][T13652] FAT-fs (loop2): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 440.946717][T13652] FAT-fs (loop2): Filesystem has been set read-only [ 440.959140][T13652] FAT-fs (loop2): error, fat_free: invalid cluster chain (i_pos 17) 12:28:29 executing program 2 (fault-call:11 fault-nth:0): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 441.047263][T13674] overlayfs: missing 'lowerdir' 12:28:29 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 441.164420][T13677] FAULT_INJECTION: forcing a failure. [ 441.164420][T13677] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 441.181079][T13677] CPU: 0 PID: 13677 Comm: syz-executor.2 Not tainted 5.6.0-rc1-syzkaller #0 [ 441.189770][T13677] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 441.199851][T13677] Call Trace: [ 441.203218][T13677] dump_stack+0x11d/0x181 [ 441.207679][T13677] should_fail.cold+0x5/0x13 [ 441.212301][T13677] should_fail_alloc_page+0x50/0x60 [ 441.217559][T13677] __alloc_pages_nodemask+0xd2/0x310 [ 441.222870][T13677] alloc_pages_current+0xd1/0x170 [ 441.227986][T13677] __page_cache_alloc+0x183/0x1a0 [ 441.233021][T13677] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 441.239350][T13677] pagecache_get_page+0x24b/0x6f0 [ 441.244446][T13677] grab_cache_page_write_begin+0x5d/0x90 [ 441.250106][T13677] ext4_da_write_begin+0x1a3/0x840 [ 441.255227][T13677] ? generic_update_time+0x189/0x270 [ 441.260522][T13677] ? iov_iter_fault_in_readable+0x15c/0x2b0 [ 441.266439][T13677] generic_perform_write+0x136/0x320 [ 441.271747][T13677] ext4_buffered_write_iter+0x143/0x290 [ 441.277311][T13677] ext4_file_write_iter+0xfa/0xd70 [ 441.282544][T13677] ? common_file_perm+0x1d5/0x490 [ 441.287669][T13677] do_iter_readv_writev+0x487/0x5b0 [ 441.292918][T13677] ? security_file_permission+0x88/0x280 [ 441.298581][T13677] do_iter_write+0x13b/0x3c0 [ 441.303281][T13677] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 441.309301][T13677] vfs_iter_write+0x5c/0x80 [ 441.313826][T13677] ovl_write_iter+0x594/0x790 [ 441.318533][T13677] do_iter_readv_writev+0x487/0x5b0 [ 441.323805][T13677] ? security_file_permission+0x88/0x280 [ 441.329460][T13677] do_iter_write+0x13b/0x3c0 [ 441.334069][T13677] ? __read_once_size+0x5a/0xe0 [ 441.338941][T13677] vfs_writev+0x118/0x1c0 [ 441.343401][T13677] ? __fget_light+0xc4/0x1a0 [ 441.348023][T13677] do_pwritev+0x131/0x1d0 [ 441.352370][T13677] __x64_sys_pwritev+0x61/0x80 [ 441.357296][T13677] do_syscall_64+0xcc/0x3a0 [ 441.361817][T13677] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 441.367705][T13677] RIP: 0033:0x45c6c9 [ 441.371608][T13677] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 441.391214][T13677] RSP: 002b:00007f0943787c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000128 [ 441.399636][T13677] RAX: ffffffffffffffda RBX: 00007f09437886d4 RCX: 000000000045c6c9 [ 441.407613][T13677] RDX: 0000000000000001 RSI: 0000000020000080 RDI: 0000000000000003 12:28:29 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 441.415593][T13677] RBP: 000000000076bf20 R08: 0000000000000000 R09: 0000000000000000 [ 441.423571][T13677] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 441.431548][T13677] R13: 0000000000000868 R14: 00000000004cb0c7 R15: 0000000000000000 12:28:30 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:30 executing program 2 (fault-call:11 fault-nth:1): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 441.600537][T13683] overlayfs: missing 'lowerdir' 12:28:30 executing program 3 (fault-call:10 fault-nth:0): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:28:30 executing program 4 (fault-call:9 fault-nth:0): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:30 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 441.999351][T13700] FAULT_INJECTION: forcing a failure. [ 441.999351][T13700] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 442.018677][T13700] CPU: 1 PID: 13700 Comm: syz-executor.3 Not tainted 5.6.0-rc1-syzkaller #0 [ 442.027402][T13700] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 442.037420][T13703] FAULT_INJECTION: forcing a failure. [ 442.037420][T13703] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 442.037461][T13700] Call Trace: [ 442.053964][T13700] dump_stack+0x11d/0x181 [ 442.058313][T13700] should_fail.cold+0x5/0x13 [ 442.062917][T13700] should_fail_alloc_page+0x50/0x60 [ 442.068129][T13700] __alloc_pages_nodemask+0xd2/0x310 [ 442.073476][T13700] alloc_pages_current+0xd1/0x170 [ 442.078577][T13700] __page_cache_alloc+0x183/0x1a0 [ 442.083692][T13700] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 442.089938][T13700] pagecache_get_page+0x24b/0x6f0 [ 442.094982][T13700] grab_cache_page_write_begin+0x5d/0x90 [ 442.100699][T13700] ext4_da_write_begin+0x1a3/0x840 [ 442.105809][T13700] ? generic_update_time+0x189/0x270 [ 442.111149][T13700] ? iov_iter_fault_in_readable+0x15c/0x2b0 [ 442.117054][T13700] generic_perform_write+0x136/0x320 [ 442.122359][T13700] ext4_buffered_write_iter+0x143/0x290 [ 442.127919][T13700] ext4_file_write_iter+0xfa/0xd70 [ 442.133041][T13700] ? common_file_perm+0x1d5/0x490 [ 442.138071][T13700] ? check_stack_object+0xda/0x110 [ 442.143240][T13700] do_iter_readv_writev+0x487/0x5b0 [ 442.148448][T13700] ? security_file_permission+0x88/0x280 [ 442.154109][T13700] do_iter_write+0x13b/0x3c0 [ 442.158790][T13700] ? __read_once_size+0x5a/0xe0 [ 442.163649][T13700] vfs_writev+0x118/0x1c0 [ 442.168050][T13700] ? __fget_light+0xc4/0x1a0 [ 442.172664][T13700] do_pwritev+0x131/0x1d0 [ 442.177009][T13700] __x64_sys_pwritev+0x61/0x80 [ 442.181799][T13700] do_syscall_64+0xcc/0x3a0 [ 442.186326][T13700] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 442.192218][T13700] RIP: 0033:0x45c6c9 [ 442.196124][T13700] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 442.215792][T13700] RSP: 002b:00007fe3643b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000128 [ 442.224206][T13700] RAX: ffffffffffffffda RBX: 00007fe3643b46d4 RCX: 000000000045c6c9 [ 442.232180][T13700] RDX: 0000000000000001 RSI: 0000000020000080 RDI: 0000000000000003 [ 442.240297][T13700] RBP: 000000000076bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 442.248390][T13700] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 442.256461][T13700] R13: 0000000000000868 R14: 00000000004cb0c7 R15: 0000000000000000 [ 442.271015][T13703] CPU: 1 PID: 13703 Comm: syz-executor.4 Not tainted 5.6.0-rc1-syzkaller #0 [ 442.279709][T13703] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 442.289769][T13703] Call Trace: [ 442.293080][T13703] dump_stack+0x11d/0x181 [ 442.297487][T13703] should_fail.cold+0x5/0x13 [ 442.302106][T13703] should_fail_alloc_page+0x50/0x60 [ 442.307316][T13703] __alloc_pages_nodemask+0xd2/0x310 [ 442.312624][T13703] alloc_pages_current+0xd1/0x170 [ 442.317667][T13703] __page_cache_alloc+0x183/0x1a0 [ 442.322726][T13703] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 442.329004][T13703] pagecache_get_page+0x24b/0x6f0 [ 442.334098][T13703] grab_cache_page_write_begin+0x5d/0x90 [ 442.339769][T13703] ext4_da_write_begin+0x1a3/0x840 [ 442.344996][T13703] ? generic_update_time+0x189/0x270 [ 442.350302][T13703] ? iov_iter_fault_in_readable+0x15c/0x2b0 [ 442.353970][T13695] FAULT_INJECTION: forcing a failure. [ 442.353970][T13695] name failslab, interval 1, probability 0, space 0, times 1 [ 442.356240][T13703] generic_perform_write+0x136/0x320 [ 442.356329][T13703] ext4_buffered_write_iter+0x143/0x290 [ 442.380362][T13703] ext4_file_write_iter+0xfa/0xd70 [ 442.385504][T13703] ? common_file_perm+0x1d5/0x490 [ 442.391601][T13703] do_iter_readv_writev+0x487/0x5b0 [ 442.396813][T13703] ? security_file_permission+0x88/0x280 [ 442.402586][T13703] do_iter_write+0x13b/0x3c0 [ 442.407302][T13703] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 442.413255][T13703] vfs_iter_write+0x5c/0x80 [ 442.417780][T13703] ovl_write_iter+0x594/0x790 [ 442.422489][T13703] do_iter_readv_writev+0x487/0x5b0 [ 442.427811][T13703] ? security_file_permission+0x88/0x280 [ 442.433471][T13703] do_iter_write+0x13b/0x3c0 [ 442.438077][T13703] ? __read_once_size+0x5a/0xe0 [ 442.442952][T13703] vfs_writev+0x118/0x1c0 [ 442.447309][T13703] ? __fget_light+0xc4/0x1a0 [ 442.451931][T13703] do_pwritev+0x131/0x1d0 [ 442.456312][T13703] __x64_sys_pwritev+0x61/0x80 [ 442.461095][T13703] do_syscall_64+0xcc/0x3a0 [ 442.465624][T13703] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 442.466758][T13706] overlayfs: option "workdir=." is useless in a non-upper mount, ignore [ 442.471526][T13703] RIP: 0033:0x45c6c9 [ 442.471549][T13703] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 442.471558][T13703] RSP: 002b:00007f56595eac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000128 [ 442.471575][T13703] RAX: ffffffffffffffda RBX: 00007f56595eb6d4 RCX: 000000000045c6c9 [ 442.471584][T13703] RDX: 0000000000000001 RSI: 0000000020000080 RDI: 0000000000000003 [ 442.471603][T13703] RBP: 000000000076bf20 R08: 0000000000000000 R09: 0000000000000000 [ 442.535965][T13703] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 442.543951][T13703] R13: 0000000000000868 R14: 00000000004cb0c7 R15: 0000000000000000 [ 442.556804][T13695] CPU: 0 PID: 13695 Comm: syz-executor.2 Not tainted 5.6.0-rc1-syzkaller #0 [ 442.565495][T13695] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 442.575551][T13695] Call Trace: [ 442.577971][T13706] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 442.578871][T13695] dump_stack+0x11d/0x181 [ 442.578893][T13695] should_fail.cold+0x5/0x13 [ 442.578920][T13695] __should_failslab+0x86/0xb0 [ 442.578936][T13695] should_failslab+0x9/0x14 [ 442.578960][T13695] __kmalloc+0x53/0x690 [ 442.609625][T13695] ? drain_stock.isra.0+0x41/0x100 [ 442.614871][T13695] ? ext4_find_extent+0x548/0x610 [ 442.620009][T13695] ext4_find_extent+0x548/0x610 [ 442.624978][T13695] ? __rcu_read_unlock+0x77/0x3a0 [ 442.630106][T13695] ext4_ext_map_blocks+0xe9/0x2320 [ 442.635238][T13695] ? __this_cpu_preempt_check+0x45/0x140 [ 442.640906][T13695] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 442.647172][T13695] ? ext4_es_lookup_extent+0x241/0x580 [ 442.652666][T13695] ext4_da_get_block_prep+0x755/0xa60 [ 442.658055][T13695] ? _raw_spin_unlock+0x4b/0x60 [ 442.662953][T13695] ? create_empty_buffers+0x20c/0x3e0 [ 442.668384][T13695] ext4_block_write_begin+0x33e/0xba0 [ 442.673772][T13695] ? ext4_bmap+0x230/0x230 [ 442.678279][T13695] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 442.684120][T13710] overlayfs: option "workdir=." is useless in a non-upper mount, ignore [ 442.684195][T13695] ext4_da_write_begin+0x208/0x840 [ 442.694434][T13710] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 442.697669][T13695] generic_perform_write+0x136/0x320 [ 442.697710][T13695] ext4_buffered_write_iter+0x143/0x290 [ 442.716739][T13695] ext4_file_write_iter+0xfa/0xd70 [ 442.721873][T13695] ? common_file_perm+0x1d5/0x490 [ 442.726980][T13695] do_iter_readv_writev+0x487/0x5b0 [ 442.732196][T13695] ? security_file_permission+0x88/0x280 [ 442.737965][T13695] do_iter_write+0x13b/0x3c0 [ 442.742574][T13695] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 442.748541][T13695] vfs_iter_write+0x5c/0x80 [ 442.753051][T13695] ovl_write_iter+0x594/0x790 [ 442.757869][T13695] do_iter_readv_writev+0x487/0x5b0 [ 442.763095][T13695] ? security_file_permission+0x88/0x280 [ 442.768745][T13695] do_iter_write+0x13b/0x3c0 [ 442.773354][T13695] ? __read_once_size+0x5a/0xe0 [ 442.778216][T13695] vfs_writev+0x118/0x1c0 [ 442.782595][T13695] ? __fget_light+0xc4/0x1a0 [ 442.787200][T13695] do_pwritev+0x131/0x1d0 [ 442.791552][T13695] __x64_sys_pwritev+0x61/0x80 [ 442.796333][T13695] do_syscall_64+0xcc/0x3a0 [ 442.800851][T13695] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 442.806745][T13695] RIP: 0033:0x45c6c9 [ 442.810661][T13695] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 442.830363][T13695] RSP: 002b:00007f0943787c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000128 [ 442.839085][T13695] RAX: ffffffffffffffda RBX: 00007f09437886d4 RCX: 000000000045c6c9 12:28:31 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:31 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:31 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:31 executing program 3 (fault-call:10 fault-nth:1): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) [ 442.847158][T13695] RDX: 0000000000000001 RSI: 0000000020000080 RDI: 0000000000000003 [ 442.855128][T13695] RBP: 000000000076bf20 R08: 0000000000000000 R09: 0000000000000000 [ 442.863096][T13695] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 442.871067][T13695] R13: 0000000000000868 R14: 00000000004cb0c7 R15: 0000000000000001 12:28:31 executing program 4 (fault-call:9 fault-nth:1): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 443.138878][T13718] overlayfs: option "workdir=." is useless in a non-upper mount, ignore [ 443.156061][T13718] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent 12:28:31 executing program 0: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff00c}, {0x80000006}]}, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') 12:28:31 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:31 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 443.381058][T13727] overlayfs: unrecognized mount option "upper" or missing value [ 443.399524][T13723] FAULT_INJECTION: forcing a failure. [ 443.399524][T13723] name failslab, interval 1, probability 0, space 0, times 0 [ 443.471432][T13723] CPU: 0 PID: 13723 Comm: syz-executor.3 Not tainted 5.6.0-rc1-syzkaller #0 [ 443.480136][T13723] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 443.490200][T13723] Call Trace: [ 443.493511][T13723] dump_stack+0x11d/0x181 [ 443.497921][T13723] should_fail.cold+0x5/0x13 [ 443.502536][T13723] __should_failslab+0x86/0xb0 [ 443.507311][T13723] should_failslab+0x9/0x14 [ 443.511888][T13723] __kmalloc+0x53/0x690 [ 443.516063][T13723] ? drain_stock.isra.0+0x41/0x100 [ 443.521190][T13723] ? ext4_find_extent+0x548/0x610 [ 443.526271][T13723] ext4_find_extent+0x548/0x610 [ 443.531137][T13723] ? __rcu_read_unlock+0x77/0x3a0 [ 443.536272][T13723] ext4_ext_map_blocks+0xe9/0x2320 [ 443.541408][T13723] ? __this_cpu_preempt_check+0x45/0x140 [ 443.547066][T13723] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 443.553370][T13723] ? ext4_es_lookup_extent+0x241/0x580 [ 443.558875][T13723] ext4_da_get_block_prep+0x755/0xa60 [ 443.564285][T13723] ? _raw_spin_unlock+0x4b/0x60 [ 443.569154][T13723] ? create_empty_buffers+0x20c/0x3e0 [ 443.574657][T13723] ext4_block_write_begin+0x33e/0xba0 [ 443.580042][T13723] ? ext4_bmap+0x230/0x230 [ 443.584491][T13723] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 443.590470][T13723] ext4_da_write_begin+0x208/0x840 [ 443.595618][T13723] generic_perform_write+0x136/0x320 [ 443.600926][T13723] ext4_buffered_write_iter+0x143/0x290 [ 443.606477][T13723] ext4_file_write_iter+0xfa/0xd70 [ 443.611661][T13723] ? common_file_perm+0x1d5/0x490 [ 443.616708][T13723] do_iter_readv_writev+0x487/0x5b0 [ 443.621914][T13723] ? security_file_permission+0x88/0x280 [ 443.627563][T13723] do_iter_write+0x13b/0x3c0 [ 443.632170][T13723] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 443.638076][T13723] vfs_iter_write+0x5c/0x80 [ 443.642628][T13723] ovl_write_iter+0x594/0x790 [ 443.647322][T13723] do_iter_readv_writev+0x487/0x5b0 [ 443.652529][T13723] ? security_file_permission+0x88/0x280 [ 443.658225][T13723] do_iter_write+0x13b/0x3c0 [ 443.662827][T13723] ? __read_once_size+0x5a/0xe0 [ 443.667705][T13723] vfs_writev+0x118/0x1c0 [ 443.672058][T13723] ? __fget_light+0xc4/0x1a0 [ 443.676667][T13723] do_pwritev+0x131/0x1d0 [ 443.681169][T13723] __x64_sys_pwritev+0x61/0x80 [ 443.686117][T13723] do_syscall_64+0xcc/0x3a0 [ 443.690643][T13723] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 443.696542][T13723] RIP: 0033:0x45c6c9 [ 443.700453][T13723] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 443.720179][T13723] RSP: 002b:00007fe3643d4c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000128 [ 443.728606][T13723] RAX: ffffffffffffffda RBX: 00007fe3643d56d4 RCX: 000000000045c6c9 [ 443.736582][T13723] RDX: 0000000000000001 RSI: 0000000020000080 RDI: 0000000000000003 [ 443.744603][T13723] RBP: 000000000076bf20 R08: 0000000000000000 R09: 0000000000000000 [ 443.752596][T13723] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 443.760576][T13723] R13: 0000000000000868 R14: 00000000004cb0c7 R15: 0000000000000001 12:28:32 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000740)=@newlink={0x54, 0x10, 0x1, 0xc00, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x34, 0x12, 0x0, 0x1, @ip6gretap={{0xe, 0x1, 'ip6gretap\x00'}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GRE_ENCAP_DPORT={0x6}, @IFLA_GRE_LOCAL={0x14, 0x6, @remote}]}}}]}, 0x54}}, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/tty/drivers\x00', 0x0, 0x0) [ 443.894584][T13732] FAULT_INJECTION: forcing a failure. [ 443.894584][T13732] name failslab, interval 1, probability 0, space 0, times 0 [ 444.007996][T13732] CPU: 0 PID: 13732 Comm: syz-executor.4 Not tainted 5.6.0-rc1-syzkaller #0 [ 444.016711][T13732] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 444.026816][T13732] Call Trace: [ 444.030129][T13732] dump_stack+0x11d/0x181 [ 444.034477][T13732] should_fail.cold+0x5/0x13 [ 444.039090][T13732] __should_failslab+0x86/0xb0 [ 444.043865][T13732] should_failslab+0x9/0x14 [ 444.048376][T13732] __kmalloc+0x53/0x690 [ 444.052550][T13732] ? preempt_count_add+0x48/0xb0 [ 444.057508][T13732] ? kernel_init_free_pages+0x7b/0xb0 [ 444.062884][T13732] ? ext4_find_extent+0x548/0x610 [ 444.067923][T13732] ext4_find_extent+0x548/0x610 [ 444.072872][T13732] ? __rcu_read_unlock+0x77/0x3a0 [ 444.077921][T13732] ext4_ext_map_blocks+0xe9/0x2320 [ 444.083062][T13732] ? __this_cpu_preempt_check+0x45/0x140 [ 444.088705][T13732] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 444.094962][T13732] ? ext4_es_lookup_extent+0x241/0x580 [ 444.100446][T13732] ext4_da_get_block_prep+0x755/0xa60 [ 444.105826][T13732] ? _raw_spin_unlock+0x4b/0x60 [ 444.110685][T13732] ? create_empty_buffers+0x20c/0x3e0 [ 444.116079][T13732] ext4_block_write_begin+0x33e/0xba0 [ 444.121473][T13732] ? ext4_bmap+0x230/0x230 [ 444.125991][T13732] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 444.131939][T13732] ext4_da_write_begin+0x208/0x840 [ 444.137183][T13732] generic_perform_write+0x136/0x320 [ 444.142559][T13732] ext4_buffered_write_iter+0x143/0x290 [ 444.148227][T13732] ext4_file_write_iter+0xfa/0xd70 [ 444.153397][T13732] ? common_file_perm+0x1d5/0x490 [ 444.158427][T13732] ? check_stack_object+0xda/0x110 [ 444.163583][T13732] do_iter_readv_writev+0x487/0x5b0 [ 444.168792][T13732] ? security_file_permission+0x88/0x280 [ 444.174440][T13732] do_iter_write+0x13b/0x3c0 [ 444.179054][T13732] ? __read_once_size+0x5a/0xe0 [ 444.183893][T13732] vfs_writev+0x118/0x1c0 [ 444.188321][T13732] ? __fget_light+0xc4/0x1a0 [ 444.192920][T13732] do_pwritev+0x131/0x1d0 [ 444.197333][T13732] __x64_sys_pwritev+0x61/0x80 [ 444.202181][T13732] do_syscall_64+0xcc/0x3a0 [ 444.206700][T13732] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 444.212590][T13732] RIP: 0033:0x45c6c9 [ 444.216600][T13732] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 444.236316][T13732] RSP: 002b:00007f56595eac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000128 [ 444.244735][T13732] RAX: ffffffffffffffda RBX: 00007f56595eb6d4 RCX: 000000000045c6c9 12:28:32 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r4, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) setsockopt$EBT_SO_SET_ENTRIES(r6, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r6, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(0xffffffffffffffff, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:32 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:32 executing program 3 (fault-call:10 fault-nth:2): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) [ 444.252784][T13732] RDX: 0000000000000001 RSI: 0000000020000080 RDI: 0000000000000003 [ 444.260763][T13732] RBP: 000000000076bf20 R08: 0000000000000000 R09: 0000000000000000 [ 444.268828][T13732] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 444.276945][T13732] R13: 0000000000000868 R14: 00000000004cb0c7 R15: 0000000000000001 12:28:32 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000740)=@newlink={0x54, 0x10, 0x1, 0xc00, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x34, 0x12, 0x0, 0x1, @ip6gretap={{0xe, 0x1, 'ip6gretap\x00'}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GRE_ENCAP_DPORT={0x6}, @IFLA_GRE_LOCAL={0x14, 0x6, @remote}]}}}]}, 0x54}}, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/tty/drivers\x00', 0x0, 0x0) [ 444.377615][T13745] overlayfs: unrecognized mount option "upper" or missing value 12:28:32 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:33 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x2a9, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r4, @ANYBLOB="000000000000000028001200090001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="0000b20000000000"], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000007c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff000000000900010068667363000000f4070002006a9a0000288d519c57299b3d155c2570a2d21d6fb57ae343e52f06bc121d32feda1fd535d9367d878679fa565920430032b1cb1c87b8f8377c14bf836f02e676646fa6c0f938699e83937a159463d40f76a02ba92b384c9055976d90aecbfb1456b8009c3e63fee0455b0de7a7f510086ccae0d69f09424cb8b935825599bfdad2d2e3c5cf7aeb9a0cb6b4d69be5319112a020142b5fe8af2be1f682ad7a282b7ec0f2c5d3c79881d9f5544543"], 0x38}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000680)=@newtfilter={0x38, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x1200}, {}, {0xffe0}}, [@filter_kind_options=@f_rsvp={{0x9, 0x1, 'rsvp\x00'}, {0x8, 0x2, [@TCA_RSVP_ACT={0x4}]}}]}, 0x38}}, 0x0) 12:28:33 executing program 0: r0 = socket$kcm(0x29, 0x2, 0x0) close(r0) r1 = socket$kcm(0xa, 0x5, 0x0) sendmsg$kcm(r1, &(0x7f0000000240)={&(0x7f0000000140)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0xd}, 0x20}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000280)="9e", 0x1}], 0x1}, 0x20008844) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) close(r1) 12:28:33 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:33 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="03", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 444.787378][T13758] overlayfs: failed to resolve './bus': -2 [ 444.834988][T13765] overlayfs: unrecognized mount option "upper" or missing value [ 444.932342][T13764] FAULT_INJECTION: forcing a failure. [ 444.932342][T13764] name failslab, interval 1, probability 0, space 0, times 0 [ 444.945043][T13764] CPU: 1 PID: 13764 Comm: syz-executor.3 Not tainted 5.6.0-rc1-syzkaller #0 [ 444.953749][T13764] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 444.963817][T13764] Call Trace: [ 444.967138][T13764] dump_stack+0x11d/0x181 [ 444.971815][T13764] should_fail.cold+0x5/0x13 [ 444.976425][T13764] __should_failslab+0x86/0xb0 [ 444.981331][T13764] should_failslab+0x9/0x14 [ 444.985999][T13764] kmem_cache_alloc+0x29/0x5d0 [ 444.990771][T13764] ? _raw_spin_unlock_irq+0x68/0x80 [ 444.996033][T13764] ? finish_task_switch+0x7b/0x260 [ 445.001275][T13764] ? switch_mm_irqs_off+0x1fb/0x4f0 [ 445.006663][T13764] __es_insert_extent+0x1f0/0x880 [ 445.011734][T13764] ? should_fail+0x7d/0x2f9 [ 445.016266][T13764] ext4_es_insert_extent+0x1c0/0x5c0 [ 445.021804][T13764] ? ext4_es_find_extent_range+0x8d/0x260 [ 445.027542][T13764] ? ext4_find_extent+0x548/0x610 [ 445.032585][T13764] ext4_ext_put_gap_in_cache+0xb8/0xf0 [ 445.038153][T13764] ext4_ext_map_blocks+0x1157/0x2320 [ 445.043469][T13764] ? __this_cpu_preempt_check+0x45/0x140 [ 445.049180][T13764] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 445.055442][T13764] ? ext4_es_lookup_extent+0x241/0x580 [ 445.060937][T13764] ext4_da_get_block_prep+0x755/0xa60 [ 445.066324][T13764] ? _raw_spin_unlock+0x4b/0x60 [ 445.071201][T13764] ? create_empty_buffers+0x20c/0x3e0 [ 445.076596][T13764] ext4_block_write_begin+0x33e/0xba0 [ 445.082202][T13764] ? ext4_bmap+0x230/0x230 [ 445.086668][T13764] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 445.092636][T13764] ext4_da_write_begin+0x208/0x840 [ 445.097778][T13764] generic_perform_write+0x136/0x320 [ 445.103099][T13764] ext4_buffered_write_iter+0x143/0x290 [ 445.108875][T13764] ext4_file_write_iter+0xfa/0xd70 [ 445.114210][T13764] ? common_file_perm+0x1d5/0x490 [ 445.119434][T13764] ? check_stack_object+0xda/0x110 [ 445.124693][T13764] do_iter_readv_writev+0x487/0x5b0 [ 445.130013][T13764] ? security_file_permission+0x88/0x280 [ 445.135676][T13764] do_iter_write+0x13b/0x3c0 [ 445.140349][T13764] ? __read_once_size+0x5a/0xe0 [ 445.145430][T13764] vfs_writev+0x118/0x1c0 [ 445.149870][T13764] ? __fget_light+0xc4/0x1a0 [ 445.154602][T13764] do_pwritev+0x131/0x1d0 [ 445.159571][T13764] __x64_sys_pwritev+0x61/0x80 [ 445.164389][T13764] do_syscall_64+0xcc/0x3a0 [ 445.168932][T13764] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 445.174831][T13764] RIP: 0033:0x45c6c9 [ 445.178848][T13764] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 445.193962][T13749] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 445.198631][T13764] RSP: 002b:00007fe3643b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000128 [ 445.198650][T13764] RAX: ffffffffffffffda RBX: 00007fe3643b46d4 RCX: 000000000045c6c9 [ 445.198660][T13764] RDX: 0000000000000001 RSI: 0000000020000080 RDI: 0000000000000003 12:28:33 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:33 executing program 0: r0 = socket(0x40000000002, 0x3, 0x2) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, 0x0, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80081272, 0x0) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000000)=0x8005, 0x4) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000012c0)='syz_tun\x00', 0x10) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000040)=@abs={0x0, 0x0, 0x10000e0}, 0x6e) recvmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffec8}}], 0x4000000000002c5, 0x2, 0x0) [ 445.198670][T13764] RBP: 000000000076bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 445.198679][T13764] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 445.198689][T13764] R13: 0000000000000868 R14: 00000000004cb0c7 R15: 0000000000000002 [ 445.275053][T13775] overlayfs: filesystem on './file0' not supported as upperdir [ 445.289453][T13781] raw_sendmsg: syz-executor.0 forgot to set AF_INET. Fix it! [ 445.297174][T13749] FAT-fs (loop5): Filesystem has been set read-only [ 445.318514][T13749] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) 12:28:33 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r4, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) setsockopt$EBT_SO_SET_ENTRIES(r6, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r6, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(0xffffffffffffffff, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:33 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="04", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 445.376842][T13786] overlayfs: workdir and upperdir must be separate subtrees 12:28:33 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 445.580484][T13794] overlayfs: workdir and upperdir must be separate subtrees 12:28:34 executing program 3 (fault-call:10 fault-nth:3): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:28:34 executing program 0: r0 = socket(0x40000000002, 0x3, 0x2) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, 0x0, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80081272, 0x0) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000000)=0x8005, 0x4) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000012c0)='syz_tun\x00', 0x10) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000040)=@abs={0x0, 0x0, 0x10000e0}, 0x6e) recvmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffec8}}], 0x4000000000002c5, 0x2, 0x0) 12:28:34 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="03", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:34 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 445.738066][T13798] overlayfs: filesystem on './file0' not supported as upperdir 12:28:34 executing program 0: ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x89f1, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x2a9, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r4, @ANYBLOB="000000000000000028001200090001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="0000b20000000000"], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000007c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff000000000900010068667363000000f4070002006a9a0000288d519c57299b3d155c2570a2d21d6fb57ae343e52f06bc121d32feda1fd535d9367d878679fa565920430032b1cb1c87b8f8377c14bf836f02e676646fa6c0f938699e83937a159463d40f76a02ba92b384c9055976d90aecbfb1456b8009c3e63fee0455b0de7a7f510086ccae0d69f09424cb8b935825599bfdad2d2e3c5cf7aeb9a0cb6b4d69be5319112a020142b5fe8af2be1f682ad7a282b7ec0f2c5d3c79881d9f5544543"], 0x38}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0xf0ffffff, &(0x7f0000000180)={&(0x7f0000000680)=@newtfilter={0x74, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {}, {0xffe0}}, [@filter_kind_options=@f_rsvp={{0x9, 0x1, 'rsvp\x00'}, {0x3c, 0x2, [@TCA_RSVP_ACT={0x38, 0x6, [@m_csum={0x34, 0x1, 0x0, 0x0, {{0x9, 0x1, 'csum\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c}]}, {0x4}}}]}]}}, @TCA_RATE={0x6}]}, 0x74}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) [ 445.943229][T13808] overlayfs: filesystem on './file0' not supported as upperdir 12:28:34 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)='\a', 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:34 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x9, &(0x7f0000000080)={&(0x7f0000000740)=@newlink={0x54, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x34, 0x12, 0x0, 0x1, @ip6gretap={{0xe, 0x1, 'ip6gretap\x00'}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GRE_ENCAP_DPORT={0x6}, @IFLA_GRE_LOCAL={0x14, 0x6, @remote}]}}}]}, 0x54}}, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/tty/drivers\x00', 0x0, 0x0) [ 445.996878][T13820] overlayfs: workdir and upperdir must be separate subtrees 12:28:34 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="04", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 446.133504][T13823] FAULT_INJECTION: forcing a failure. [ 446.133504][T13823] name failslab, interval 1, probability 0, space 0, times 0 [ 446.146387][T13823] CPU: 0 PID: 13823 Comm: syz-executor.3 Not tainted 5.6.0-rc1-syzkaller #0 [ 446.155060][T13823] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 446.165203][T13823] Call Trace: [ 446.168605][T13823] dump_stack+0x11d/0x181 [ 446.173054][T13823] should_fail.cold+0x5/0x13 [ 446.177679][T13823] __should_failslab+0x86/0xb0 [ 446.182467][T13823] should_failslab+0x9/0x14 [ 446.187028][T13823] kmem_cache_alloc+0x29/0x5d0 [ 446.191904][T13823] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 446.197636][T13823] ? ext4_es_can_be_merged+0xfa/0x1b0 [ 446.203033][T13823] __es_insert_extent+0x1f0/0x880 [ 446.208122][T13823] ext4_es_insert_delayed_block+0x116/0x290 [ 446.214056][T13823] ? _raw_spin_unlock+0x4b/0x60 [ 446.218925][T13823] ext4_da_get_block_prep+0x4f1/0xa60 [ 446.224317][T13823] ? create_empty_buffers+0x20c/0x3e0 [ 446.229722][T13823] ext4_block_write_begin+0x33e/0xba0 [ 446.235114][T13823] ? ext4_bmap+0x230/0x230 [ 446.239553][T13823] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 446.245623][T13823] ext4_da_write_begin+0x208/0x840 [ 446.250777][T13823] generic_perform_write+0x136/0x320 [ 446.256158][T13823] ext4_buffered_write_iter+0x143/0x290 [ 446.261794][T13823] ext4_file_write_iter+0xfa/0xd70 [ 446.266921][T13823] ? common_file_perm+0x1d5/0x490 [ 446.271962][T13823] do_iter_readv_writev+0x487/0x5b0 [ 446.277334][T13823] ? security_file_permission+0x88/0x280 [ 446.283050][T13823] do_iter_write+0x13b/0x3c0 [ 446.287688][T13823] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 446.293593][T13823] vfs_iter_write+0x5c/0x80 [ 446.298114][T13823] ovl_write_iter+0x594/0x790 [ 446.302938][T13823] do_iter_readv_writev+0x487/0x5b0 [ 446.308311][T13823] ? security_file_permission+0x88/0x280 [ 446.313968][T13823] do_iter_write+0x13b/0x3c0 [ 446.318575][T13823] ? __read_once_size+0x5a/0xe0 [ 446.323432][T13823] vfs_writev+0x118/0x1c0 [ 446.327790][T13823] ? __fget_light+0xc4/0x1a0 [ 446.332392][T13823] do_pwritev+0x131/0x1d0 [ 446.336728][T13823] __x64_sys_pwritev+0x61/0x80 [ 446.341690][T13823] do_syscall_64+0xcc/0x3a0 [ 446.346218][T13823] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 446.352112][T13823] RIP: 0033:0x45c6c9 [ 446.356025][T13823] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 446.375737][T13823] RSP: 002b:00007fe3643d4c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000128 12:28:34 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x9, &(0x7f0000000080)={&(0x7f0000000740)=@newlink={0x54, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x34, 0x12, 0x0, 0x1, @ip6gretap={{0xe, 0x1, 'ip6gretap\x00'}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GRE_ENCAP_DPORT={0x6}, @IFLA_GRE_LOCAL={0x14, 0x6, @remote}]}}}]}, 0x54}}, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/tty/drivers\x00', 0x0, 0x0) [ 446.384178][T13823] RAX: ffffffffffffffda RBX: 00007fe3643d56d4 RCX: 000000000045c6c9 [ 446.392252][T13823] RDX: 0000000000000001 RSI: 0000000020000080 RDI: 0000000000000003 [ 446.400221][T13823] RBP: 000000000076bf20 R08: 0000000000000000 R09: 0000000000000000 [ 446.408296][T13823] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 446.416275][T13823] R13: 0000000000000868 R14: 00000000004cb0c7 R15: 0000000000000003 12:28:34 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r4, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) setsockopt$EBT_SO_SET_ENTRIES(r6, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r6, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(0xffffffffffffffff, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:34 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:34 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000500)='cpuacct.usage_sys\x00', 0x26e1, 0x0) r0 = socket$kcm(0xa, 0x1, 0x0) sendmsg$kcm(r0, &(0x7f0000000700)={&(0x7f0000000dc0)=@in6={0xa, 0x0, 0x0, @local, 0x6}, 0x80, 0x0}, 0x20004040) perf_event_open(&(0x7f0000000740)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$sock_attach_bpf(r0, 0x29, 0x6, &(0x7f0000000100), 0x4) [ 446.509497][T13837] overlayfs: failed to resolve './fil': -2 [ 446.550636][T13835] overlayfs: filesystem on './file0' not supported as upperdir 12:28:35 executing program 3 (fault-call:10 fault-nth:4): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:28:35 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:35 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x2, @perf_bp={0x0}, 0x0, 0x0, 0x2, 0x0, 0x4000001000, 0xfffffffc, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) preadv(r0, &(0x7f0000000540)=[{&(0x7f0000000300)=""/101, 0x65}], 0x1, 0x0) lremovexattr(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)=@random={'security.', '/dev/fuse\x00'}) lremovexattr(0x0, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="020300020c00000000421000000000000200080008010000e00000001b000000030006000000000002000000e000006f6ada0a73fe4325b897ce9f01000000000000000002000100000000000000060000000000000002000000"], 0x60}}, 0x0) getsockopt$IP_VS_SO_GET_VERSION(r1, 0x0, 0x480, 0x0, &(0x7f0000000380)) preadv(r0, &(0x7f0000000740)=[{&(0x7f0000000480)=""/164, 0xa4}], 0x1, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) vmsplice(r2, 0x0, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440)='nl80211\x00') r5 = socket(0x11, 0x800000003, 0x0) r6 = socket(0x11, 0x800000003, 0x0) bind(r6, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c58110308d9123127ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r6, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) setsockopt$packet_add_memb(r5, 0x107, 0x1, &(0x7f0000000240)={r7, 0x1, 0x6, @remote}, 0x10) sendmsg$NL80211_CMD_NEW_STATION(r3, &(0x7f0000000600)={&(0x7f0000000400), 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x1c, r4, 0x300, 0x70bd2c, 0x25dfdbfd, {}, [@NL80211_ATTR_STA_VLAN={0x8, 0x14, r7}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008040}, 0x4080) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f00000003c0), 0x4) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1e}}, 0x50) write$FUSE_DIRENTPLUS(r0, &(0x7f00000007c0)={0x10, 0x0, 0x2}, 0x10) 12:28:35 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)='\b', 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 446.694417][T13845] overlayfs: filesystem on './file0' not supported as upperdir [ 446.745050][T13854] overlayfs: failed to resolve './fil': -2 12:28:35 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:35 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)='\b', 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:35 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x0, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 446.952523][T13862] overlayfs: filesystem on './file0' not supported as upperdir [ 447.026486][T13871] overlayfs: failed to resolve './fil': -2 [ 447.046808][T13873] device lo entered promiscuous mode 12:28:35 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)='\n', 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:35 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 447.129651][T13869] FAULT_INJECTION: forcing a failure. [ 447.129651][T13869] name failslab, interval 1, probability 0, space 0, times 0 [ 447.168045][T13876] overlayfs: filesystem on './file0' not supported as upperdir [ 447.210459][T13869] CPU: 0 PID: 13869 Comm: syz-executor.3 Not tainted 5.6.0-rc1-syzkaller #0 [ 447.219172][T13869] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 447.229228][T13869] Call Trace: [ 447.232519][T13869] dump_stack+0x11d/0x181 [ 447.236846][T13869] should_fail.cold+0x5/0x13 [ 447.241447][T13869] __should_failslab+0x86/0xb0 [ 447.246205][T13869] should_failslab+0x9/0x14 [ 447.250711][T13869] kmem_cache_alloc+0x29/0x5d0 [ 447.255505][T13869] ? _raw_spin_unlock_irq+0x68/0x80 [ 447.260792][T13869] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 447.266699][T13869] ? __write_once_size+0x41/0xe0 [ 447.271651][T13869] ext4_init_io_end+0x4f/0x120 [ 447.276413][T13869] ext4_writepages+0x55b/0x1d40 [ 447.281307][T13869] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 447.287562][T13869] ? ext4_mark_inode_dirty+0x420/0x420 [ 447.293102][T13869] do_writepages+0x6b/0x170 [ 447.297617][T13869] ? do_writepages+0x6b/0x170 [ 447.302447][T13869] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 447.308696][T13869] ? wbc_attach_and_unlock_inode+0xdd/0x3b0 [ 447.314600][T13869] __filemap_fdatawrite_range+0x1c5/0x230 [ 447.320489][T13869] file_write_and_wait_range+0xfd/0x160 [ 447.326058][T13869] ext4_sync_file+0x266/0x8c0 [ 447.330742][T13869] ? generic_perform_write+0x274/0x320 [ 447.336205][T13869] ? __read_once_size.constprop.0+0x20/0x20 [ 447.342110][T13869] vfs_fsync_range+0x82/0x150 [ 447.346808][T13869] ext4_buffered_write_iter+0x222/0x290 [ 447.352364][T13869] ext4_file_write_iter+0xfa/0xd70 [ 447.357589][T13869] ? common_file_perm+0x1d5/0x490 [ 447.362827][T13869] do_iter_readv_writev+0x487/0x5b0 [ 447.368037][T13869] ? security_file_permission+0x88/0x280 [ 447.373749][T13869] do_iter_write+0x13b/0x3c0 [ 447.376237][T13888] overlayfs: failed to resolve './file': -2 [ 447.378372][T13869] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 447.378406][T13869] vfs_iter_write+0x5c/0x80 [ 447.394674][T13869] ovl_write_iter+0x594/0x790 [ 447.399372][T13869] do_iter_readv_writev+0x487/0x5b0 [ 447.404590][T13869] ? security_file_permission+0x88/0x280 [ 447.410305][T13869] do_iter_write+0x13b/0x3c0 [ 447.414910][T13869] ? __read_once_size+0x5a/0xe0 [ 447.419776][T13869] vfs_writev+0x118/0x1c0 [ 447.424123][T13869] ? __fget_light+0xc4/0x1a0 [ 447.428732][T13869] do_pwritev+0x131/0x1d0 [ 447.433077][T13869] __x64_sys_pwritev+0x61/0x80 [ 447.437858][T13869] do_syscall_64+0xcc/0x3a0 [ 447.442440][T13869] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 447.445958][T13887] overlayfs: filesystem on './file0' not supported as upperdir [ 447.448330][T13869] RIP: 0033:0x45c6c9 12:28:35 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 447.448354][T13869] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 447.448364][T13869] RSP: 002b:00007fe3643d4c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000128 [ 447.487861][T13869] RAX: ffffffffffffffda RBX: 00007fe3643d56d4 RCX: 000000000045c6c9 [ 447.495838][T13869] RDX: 0000000000000001 RSI: 0000000020000080 RDI: 0000000000000003 [ 447.504061][T13869] RBP: 000000000076bf20 R08: 0000000000000000 R09: 0000000000000000 12:28:36 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)='\r', 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:36 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)='\n', 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 447.512146][T13869] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 447.520174][T13869] R13: 0000000000000868 R14: 00000000004cb0c7 R15: 0000000000000004 12:28:36 executing program 3 (fault-call:10 fault-nth:5): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) [ 447.678284][T13858] device lo left promiscuous mode [ 447.795303][T13895] overlayfs: failed to resolve './file': -2 [ 447.798366][T13873] device lo entered promiscuous mode [ 447.848755][T13858] device lo left promiscuous mode [ 447.879635][T13896] overlayfs: filesystem on './file0' not supported as upperdir 12:28:36 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000740)=@newlink={0x54, 0x10, 0x1, 0x0, 0x0, {0x0, 0xc, 0x0, r1}, [@IFLA_LINKINFO={0x34, 0x12, 0x0, 0x1, @ip6gretap={{0xe, 0x1, 'ip6gretap\x00'}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GRE_ENCAP_DPORT={0x6}, @IFLA_GRE_LOCAL={0x14, 0x6, @remote}]}}}]}, 0x54}}, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/tty/drivers\x00', 0x0, 0x0) [ 447.962286][T13881] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 447.989363][T13881] FAT-fs (loop5): Filesystem has been set read-only 12:28:36 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="0f", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:36 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 448.010700][T13907] overlayfs: filesystem on './file0' not supported as upperdir [ 448.023054][T13881] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) [ 448.083056][T13906] FAULT_INJECTION: forcing a failure. [ 448.083056][T13906] name failslab, interval 1, probability 0, space 0, times 0 [ 448.108095][T13906] CPU: 0 PID: 13906 Comm: syz-executor.3 Not tainted 5.6.0-rc1-syzkaller #0 [ 448.116804][T13906] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 448.126874][T13906] Call Trace: [ 448.130241][T13906] dump_stack+0x11d/0x181 [ 448.134586][T13906] should_fail.cold+0x5/0x13 [ 448.139194][T13906] __should_failslab+0x86/0xb0 [ 448.143975][T13906] should_failslab+0x9/0x14 [ 448.148494][T13906] kmem_cache_alloc+0x29/0x5d0 [ 448.153330][T13906] ext4_init_io_end+0x4f/0x120 [ 448.158187][T13906] ext4_writepages+0x9b2/0x1d40 [ 448.163069][T13906] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 448.169320][T13906] ? ext4_mark_inode_dirty+0x420/0x420 [ 448.174785][T13906] do_writepages+0x6b/0x170 [ 448.179295][T13906] ? do_writepages+0x6b/0x170 [ 448.183982][T13906] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 448.190236][T13906] ? wbc_attach_and_unlock_inode+0xdd/0x3b0 [ 448.196144][T13906] __filemap_fdatawrite_range+0x1c5/0x230 [ 448.201933][T13906] file_write_and_wait_range+0xfd/0x160 [ 448.208534][T13906] ext4_sync_file+0x266/0x8c0 [ 448.213319][T13906] ? generic_perform_write+0x274/0x320 [ 448.218790][T13906] ? __read_once_size.constprop.0+0x20/0x20 [ 448.224698][T13906] vfs_fsync_range+0x82/0x150 12:28:36 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="0f", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 448.229392][T13906] ext4_buffered_write_iter+0x222/0x290 [ 448.235018][T13906] ext4_file_write_iter+0xfa/0xd70 [ 448.235909][T13915] overlayfs: filesystem on './file0' not supported as upperdir [ 448.240260][T13906] ? common_file_perm+0x1d5/0x490 [ 448.240290][T13906] do_iter_readv_writev+0x487/0x5b0 [ 448.258029][T13906] ? security_file_permission+0x88/0x280 [ 448.263799][T13906] do_iter_write+0x13b/0x3c0 [ 448.268406][T13906] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 448.274313][T13906] vfs_iter_write+0x5c/0x80 [ 448.278906][T13906] ovl_write_iter+0x594/0x790 12:28:36 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="10", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:36 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x0, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 448.283657][T13906] do_iter_readv_writev+0x487/0x5b0 [ 448.288858][T13906] ? security_file_permission+0x88/0x280 [ 448.294512][T13906] do_iter_write+0x13b/0x3c0 [ 448.299196][T13906] ? __read_once_size+0x5a/0xe0 [ 448.304067][T13906] vfs_writev+0x118/0x1c0 [ 448.308441][T13906] ? __fget_light+0xc4/0x1a0 [ 448.313043][T13906] do_pwritev+0x131/0x1d0 [ 448.317424][T13906] __x64_sys_pwritev+0x61/0x80 [ 448.322279][T13906] do_syscall_64+0xcc/0x3a0 [ 448.326795][T13906] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 448.332687][T13906] RIP: 0033:0x45c6c9 [ 448.336595][T13906] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 448.356288][T13906] RSP: 002b:00007fe3643d4c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000128 [ 448.364710][T13906] RAX: ffffffffffffffda RBX: 00007fe3643d56d4 RCX: 000000000045c6c9 [ 448.372686][T13906] RDX: 0000000000000001 RSI: 0000000020000080 RDI: 0000000000000003 12:28:36 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) rt_sigaction(0x27, &(0x7f0000000180)={0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000380)) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x21, &(0x7f0000000400), 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) close(r2) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000240)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000340), 0x106}}, 0xffffff8e) write$RDMA_USER_CM_CMD_LISTEN(r2, &(0x7f00000001c0)={0x7, 0xffffffffffffff95}, 0x10) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140)='/dev/fuse\x00', 0x2, 0x0) lstat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='fuse\x00', 0x10881, &(0x7f0000000540)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x1000}, 0x2c, {'user_id'}, 0x2c, {'group_id', 0x3d, r5}}) close(r4) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000240)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a8", 0x1}], 0x1, 0x81003) r6 = syz_open_dev$loop(&(0x7f0000000240)='/dev/loop#\x00', 0x0, 0x1100082) r7 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\xe7\xe2\xa4\xc5\x00\x8c\x00', 0x0) pwritev(r7, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r6, 0x4c00, r7) ioctl$LOOP_SET_STATUS64(r6, 0x4c04, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, "0eb61538a462ee812ba43ffc89bf1173dc3d06375d14638fb21b49d26972d96ef0b4b2e6d730ad6a7562b478c2974a9896747dccb30e7f63a1b51ec059554277", "1d0e47f158fae68f4d2aa224439c30eb3b3e468dfc3035d92c0929eeee707650bb008bd2cfa188d8954a0ede9661149d95659eff1ce2212f115951f98f736335", "3edea3fa98ed88e7de49fc2596c78e888e955cdca02efa85c8116766d8f71310", [0x0, 0x6]}) sendfile(0xffffffffffffffff, r6, 0x0, 0x4) getpid() getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0}, 0x0) setfsuid(r8) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000340), 0x2}}, 0x20) statx(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x2000, 0x558, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000180)=[@in6={0xa, 0x4e22, 0x0, @ipv4={[0x0, 0x0, 0x0, 0xfec0000000000000], [], @local}}, @in={0x2, 0x0, @remote}], 0x2c) write$RDMA_USER_CM_CMD_LISTEN(r1, &(0x7f0000000000)={0x7, 0x8}, 0x10) close(r1) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) 12:28:36 executing program 3 (fault-call:10 fault-nth:6): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) [ 448.373210][T13920] overlayfs: failed to resolve './file': -2 [ 448.380721][T13906] RBP: 000000000076bf20 R08: 0000000000000000 R09: 0000000000000000 [ 448.380733][T13906] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 448.380764][T13906] R13: 0000000000000868 R14: 00000000004cb0c7 R15: 0000000000000005 [ 448.676647][T13934] FAULT_INJECTION: forcing a failure. [ 448.676647][T13934] name failslab, interval 1, probability 0, space 0, times 0 [ 448.692150][T13934] CPU: 0 PID: 13934 Comm: syz-executor.3 Not tainted 5.6.0-rc1-syzkaller #0 [ 448.700844][T13934] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 448.711127][T13934] Call Trace: [ 448.714429][T13934] dump_stack+0x11d/0x181 [ 448.718840][T13934] should_fail.cold+0x5/0x13 12:28:37 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(0x0) creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 448.723491][T13934] __should_failslab+0x86/0xb0 [ 448.728279][T13934] should_failslab+0x9/0x14 [ 448.732790][T13934] kmem_cache_alloc+0x29/0x5d0 [ 448.737561][T13934] ? constant_test_bit+0x12/0x30 [ 448.742512][T13934] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 448.748760][T13934] ext4_alloc_io_end_vec+0x4e/0x160 [ 448.753960][T13934] ? ext4_writepages+0xab4/0x1d40 [ 448.758986][T13934] ? ext4_meta_trans_blocks+0x177/0x1b0 [ 448.764536][T13934] ext4_writepages+0xf2e/0x1d40 [ 448.769412][T13934] ? ext4_mark_inode_dirty+0x420/0x420 [ 448.776448][T13934] do_writepages+0x6b/0x170 [ 448.780950][T13934] ? do_writepages+0x6b/0x170 [ 448.785623][T13934] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 448.791867][T13934] ? wbc_attach_and_unlock_inode+0xdd/0x3b0 [ 448.797772][T13934] __filemap_fdatawrite_range+0x1c5/0x230 [ 448.803587][T13934] file_write_and_wait_range+0xfd/0x160 [ 448.809146][T13934] ext4_sync_file+0x266/0x8c0 [ 448.813825][T13934] ? generic_perform_write+0x274/0x320 [ 448.819328][T13934] ? __read_once_size.constprop.0+0x20/0x20 [ 448.825298][T13934] vfs_fsync_range+0x82/0x150 [ 448.829995][T13934] ext4_buffered_write_iter+0x222/0x290 [ 448.835550][T13934] ext4_file_write_iter+0xfa/0xd70 [ 448.840735][T13934] ? common_file_perm+0x1d5/0x490 [ 448.845763][T13934] do_iter_readv_writev+0x487/0x5b0 [ 448.850976][T13934] ? security_file_permission+0x88/0x280 [ 448.856662][T13934] do_iter_write+0x13b/0x3c0 [ 448.861373][T13934] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 448.867271][T13934] vfs_iter_write+0x5c/0x80 [ 448.871777][T13934] ovl_write_iter+0x594/0x790 [ 448.876469][T13934] do_iter_readv_writev+0x487/0x5b0 [ 448.881664][T13934] ? security_file_permission+0x88/0x280 [ 448.887366][T13934] do_iter_write+0x13b/0x3c0 [ 448.891955][T13934] ? __read_once_size+0x5a/0xe0 [ 448.896850][T13934] vfs_writev+0x118/0x1c0 [ 448.901256][T13934] ? __fget_light+0xc4/0x1a0 [ 448.905859][T13934] do_pwritev+0x131/0x1d0 [ 448.910199][T13934] __x64_sys_pwritev+0x61/0x80 [ 448.914976][T13934] do_syscall_64+0xcc/0x3a0 [ 448.919634][T13934] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 448.925515][T13934] RIP: 0033:0x45c6c9 [ 448.929421][T13934] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 448.949024][T13934] RSP: 002b:00007fe3643d4c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000128 [ 448.957437][T13934] RAX: ffffffffffffffda RBX: 00007fe3643d56d4 RCX: 000000000045c6c9 [ 448.965404][T13934] RDX: 0000000000000001 RSI: 0000000020000080 RDI: 0000000000000003 [ 448.973370][T13934] RBP: 000000000076bf20 R08: 0000000000000000 R09: 0000000000000000 [ 448.981333][T13934] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 448.989303][T13934] R13: 0000000000000868 R14: 00000000004cb0c7 R15: 0000000000000006 [ 449.007090][T13943] overlayfs: failed to resolve './file0': -2 [ 449.013417][T13946] overlayfs: filesystem on './file0' not supported as upperdir 12:28:37 executing program 3 (fault-call:10 fault-nth:7): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:28:37 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="10", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:37 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="e0", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 449.104720][T13947] overlayfs: './bus' not a directory 12:28:37 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(0x0) creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:37 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000280)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0x3) ioctl$TCXONC(r0, 0x540a, 0x0) [ 449.404170][T13960] FAULT_INJECTION: forcing a failure. [ 449.404170][T13960] name failslab, interval 1, probability 0, space 0, times 0 [ 449.460644][T13968] overlayfs: filesystem on './file0' not supported as upperdir [ 449.485708][T13960] CPU: 0 PID: 13960 Comm: syz-executor.3 Not tainted 5.6.0-rc1-syzkaller #0 [ 449.494474][T13960] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 449.504533][T13960] Call Trace: [ 449.507843][T13960] dump_stack+0x11d/0x181 [ 449.512191][T13960] should_fail.cold+0x5/0x13 [ 449.516798][T13960] __should_failslab+0x86/0xb0 [ 449.521570][T13960] should_failslab+0x9/0x14 [ 449.526082][T13960] __kmalloc+0x53/0x690 [ 449.530248][T13960] ? __read_once_size.constprop.0+0x12/0x20 [ 449.536158][T13960] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 449.541885][T13960] ? xas_find_marked+0x293/0x7a0 [ 449.546840][T13960] ? mem_cgroup_uncharge_list+0xa8/0xd0 [ 449.552450][T13960] ? ext4_find_extent+0x548/0x610 12:28:38 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x0, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:38 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(0x0) creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 449.557482][T13960] ext4_find_extent+0x548/0x610 [ 449.562391][T13960] ext4_ext_map_blocks+0xe9/0x2320 [ 449.567519][T13960] ? __this_cpu_preempt_check+0x45/0x140 [ 449.573165][T13960] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 449.579478][T13960] ? ext4_es_lookup_extent+0x241/0x580 [ 449.585036][T13960] ext4_map_blocks+0x23a/0xdb0 [ 449.589824][T13960] ? ext4_alloc_io_end_vec+0x124/0x160 [ 449.595435][T13960] ext4_writepages+0x108b/0x1d40 [ 449.600453][T13960] ? ext4_mark_inode_dirty+0x420/0x420 [ 449.605926][T13960] do_writepages+0x6b/0x170 [ 449.610634][T13960] ? do_writepages+0x6b/0x170 [ 449.616190][T13960] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 449.622442][T13960] ? wbc_attach_and_unlock_inode+0xdd/0x3b0 [ 449.628351][T13960] __filemap_fdatawrite_range+0x1c5/0x230 [ 449.634112][T13960] file_write_and_wait_range+0xfd/0x160 [ 449.639750][T13960] ext4_sync_file+0x266/0x8c0 [ 449.644442][T13960] ? generic_perform_write+0x274/0x320 [ 449.649930][T13960] ? __read_once_size.constprop.0+0x20/0x20 [ 449.655837][T13960] vfs_fsync_range+0x82/0x150 12:28:38 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="f0", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 449.660645][T13960] ext4_buffered_write_iter+0x222/0x290 [ 449.666194][T13960] ext4_file_write_iter+0xfa/0xd70 [ 449.671344][T13960] ? common_file_perm+0x1d5/0x490 [ 449.676395][T13960] do_iter_readv_writev+0x487/0x5b0 [ 449.681666][T13960] ? security_file_permission+0x88/0x280 [ 449.682672][T13966] overlayfs: filesystem on './file0' not supported as upperdir [ 449.687394][T13960] do_iter_write+0x13b/0x3c0 [ 449.699649][T13960] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 449.705635][T13960] vfs_iter_write+0x5c/0x80 12:28:38 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)='\x00', 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 449.710151][T13960] ovl_write_iter+0x594/0x790 [ 449.714848][T13960] do_iter_readv_writev+0x487/0x5b0 [ 449.720054][T13960] ? security_file_permission+0x88/0x280 [ 449.725713][T13960] do_iter_write+0x13b/0x3c0 [ 449.730312][T13960] ? __read_once_size+0x5a/0xe0 [ 449.735172][T13960] vfs_writev+0x118/0x1c0 [ 449.739516][T13960] ? __fget_light+0xc4/0x1a0 [ 449.744100][T13960] do_pwritev+0x131/0x1d0 [ 449.748420][T13960] __x64_sys_pwritev+0x61/0x80 [ 449.753287][T13960] do_syscall_64+0xcc/0x3a0 [ 449.757790][T13960] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 449.763664][T13960] RIP: 0033:0x45c6c9 [ 449.767547][T13960] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 449.787140][T13960] RSP: 002b:00007fe3643d4c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000128 [ 449.795643][T13960] RAX: ffffffffffffffda RBX: 00007fe3643d56d4 RCX: 000000000045c6c9 [ 449.803601][T13960] RDX: 0000000000000001 RSI: 0000000020000080 RDI: 0000000000000003 12:28:38 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) preadv(r0, &(0x7f0000000540)=[{&(0x7f0000000300)=""/101, 0x65}], 0x1, 0x0) lremovexattr(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)=@random={'security.', '/dev/fuse\x00'}) socket$key(0xf, 0x3, 0x2) preadv(r0, &(0x7f0000000740)=[{&(0x7f0000000480)=""/164, 0xa4}], 0x1, 0x0) pipe(&(0x7f0000000300)) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000100)={0x0, 0x5, 0x6, @local}, 0x10) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1e}}, 0x50) write$FUSE_DIRENTPLUS(r0, &(0x7f00000007c0)={0x10, 0x0, 0x2}, 0x10) [ 449.811569][T13960] RBP: 000000000076bf20 R08: 0000000000000000 R09: 0000000000000000 [ 449.819519][T13960] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 449.827478][T13960] R13: 0000000000000868 R14: 00000000004cb0c7 R15: 0000000000000007 12:28:38 executing program 3 (fault-call:10 fault-nth:8): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) [ 450.101318][T13995] overlayfs: filesystem on './file0' not supported as upperdir [ 450.181900][T14000] overlayfs: filesystem on './file0' not supported as upperdir 12:28:38 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(0x0, 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:38 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)='\x00', 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:38 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)='1', 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 450.392064][T13988] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 450.402498][T13988] FAT-fs (loop5): Filesystem has been set read-only [ 450.411649][T13988] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) [ 450.413843][T14010] FAULT_INJECTION: forcing a failure. [ 450.413843][T14010] name failslab, interval 1, probability 0, space 0, times 0 12:28:38 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(0x0, 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 450.500509][T14010] CPU: 0 PID: 14010 Comm: syz-executor.3 Not tainted 5.6.0-rc1-syzkaller #0 [ 450.509356][T14010] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 450.519453][T14010] Call Trace: [ 450.522759][T14010] dump_stack+0x11d/0x181 [ 450.527136][T14010] should_fail.cold+0x5/0x13 [ 450.531918][T14010] __should_failslab+0x86/0xb0 [ 450.536698][T14010] should_failslab+0x9/0x14 [ 450.541209][T14010] kmem_cache_alloc+0x29/0x5d0 [ 450.545982][T14010] ? should_fail+0x7d/0x2f9 12:28:39 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x0, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 450.550508][T14010] ext4_mb_new_blocks+0x343/0x1de0 [ 450.555633][T14010] ? __kmalloc+0x239/0x690 [ 450.560149][T14010] ? __read_once_size.constprop.0+0x12/0x20 [ 450.566056][T14010] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 450.571796][T14010] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 450.578040][T14010] ? ext4_cache_extents+0x1f4/0x210 [ 450.583243][T14010] ? ext4_find_extent+0x548/0x610 [ 450.587449][T14017] overlayfs: failed to resolve './file1': -2 [ 450.588286][T14010] ext4_ext_map_blocks+0x1c11/0x2320 12:28:39 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)='\x00', 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 450.588331][T14010] ext4_map_blocks+0x23a/0xdb0 [ 450.604381][T14010] ? ext4_alloc_io_end_vec+0x124/0x160 [ 450.609910][T14010] ext4_writepages+0x108b/0x1d40 [ 450.610817][T14017] overlayfs: './bus' not a directory [ 450.614903][T14010] ? ext4_mark_inode_dirty+0x420/0x420 [ 450.625652][T14010] do_writepages+0x6b/0x170 [ 450.630273][T14010] ? do_writepages+0x6b/0x170 [ 450.634979][T14010] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 450.641230][T14010] ? wbc_attach_and_unlock_inode+0xdd/0x3b0 [ 450.647132][T14010] __filemap_fdatawrite_range+0x1c5/0x230 [ 450.652876][T14010] file_write_and_wait_range+0xfd/0x160 [ 450.658439][T14010] ext4_sync_file+0x266/0x8c0 [ 450.663127][T14010] ? generic_perform_write+0x274/0x320 [ 450.668630][T14010] ? __read_once_size.constprop.0+0x20/0x20 [ 450.674544][T14010] vfs_fsync_range+0x82/0x150 [ 450.680258][T14010] ext4_buffered_write_iter+0x222/0x290 [ 450.685824][T14010] ext4_file_write_iter+0xfa/0xd70 [ 450.691004][T14010] ? common_file_perm+0x1d5/0x490 [ 450.696068][T14010] do_iter_readv_writev+0x487/0x5b0 [ 450.701305][T14010] ? security_file_permission+0x88/0x280 [ 450.707108][T14010] do_iter_write+0x13b/0x3c0 [ 450.711713][T14010] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 450.717753][T14010] vfs_iter_write+0x5c/0x80 [ 450.722272][T14010] ovl_write_iter+0x594/0x790 [ 450.727170][T14010] do_iter_readv_writev+0x487/0x5b0 [ 450.732399][T14010] ? security_file_permission+0x88/0x280 [ 450.738060][T14010] do_iter_write+0x13b/0x3c0 [ 450.742725][T14010] ? __read_once_size+0x5a/0xe0 12:28:39 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x2}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 450.747580][T14010] vfs_writev+0x118/0x1c0 [ 450.751583][T14021] overlayfs: filesystem on './file0' not supported as upperdir [ 450.752049][T14010] ? __fget_light+0xc4/0x1a0 [ 450.764282][T14010] do_pwritev+0x131/0x1d0 [ 450.768628][T14010] __x64_sys_pwritev+0x61/0x80 [ 450.773417][T14010] do_syscall_64+0xcc/0x3a0 [ 450.778058][T14010] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 450.783955][T14010] RIP: 0033:0x45c6c9 [ 450.787861][T14010] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 450.807563][T14010] RSP: 002b:00007fe3643d4c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000128 [ 450.816010][T14010] RAX: ffffffffffffffda RBX: 00007fe3643d56d4 RCX: 000000000045c6c9 [ 450.824026][T14010] RDX: 0000000000000001 RSI: 0000000020000080 RDI: 0000000000000003 [ 450.831987][T14010] RBP: 000000000076bf20 R08: 0000000000000000 R09: 0000000000000000 [ 450.839957][T14010] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 450.847955][T14010] R13: 0000000000000868 R14: 00000000004cb0c7 R15: 0000000000000008 12:28:39 executing program 3 (fault-call:10 fault-nth:9): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:28:39 executing program 0: [ 451.087899][T14031] overlayfs: filesystem on './file0' not supported as upperdir [ 451.144869][T14038] overlayfs: filesystem on './file0' not supported as upperdir 12:28:39 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(0x0, 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:39 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x3}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:39 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)='\x00', 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 451.416983][T14048] FAULT_INJECTION: forcing a failure. [ 451.416983][T14048] name failslab, interval 1, probability 0, space 0, times 0 [ 451.430156][T14048] CPU: 1 PID: 14048 Comm: syz-executor.3 Not tainted 5.6.0-rc1-syzkaller #0 [ 451.438967][T14048] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 451.449030][T14048] Call Trace: [ 451.452339][T14048] dump_stack+0x11d/0x181 [ 451.456691][T14048] should_fail.cold+0x5/0x13 [ 451.461329][T14048] __should_failslab+0x86/0xb0 [ 451.466115][T14048] should_failslab+0x9/0x14 [ 451.470649][T14048] kmem_cache_alloc+0x29/0x5d0 [ 451.475532][T14048] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 451.481267][T14048] ? ext4_es_can_be_merged+0xfa/0x1b0 [ 451.486653][T14048] __es_insert_extent+0x1f0/0x880 [ 451.491829][T14048] ? __this_cpu_preempt_check+0x45/0x140 [ 451.497481][T14048] ext4_es_insert_extent+0x1c0/0x5c0 [ 451.502876][T14048] ext4_map_blocks+0x3f5/0xdb0 [ 451.507670][T14048] ? ext4_alloc_io_end_vec+0x124/0x160 [ 451.513230][T14048] ext4_writepages+0x108b/0x1d40 [ 451.518342][T14048] ? ext4_mark_inode_dirty+0x420/0x420 [ 451.523910][T14048] do_writepages+0x6b/0x170 [ 451.528508][T14048] ? do_writepages+0x6b/0x170 [ 451.533193][T14048] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 451.539535][T14048] ? wbc_attach_and_unlock_inode+0xdd/0x3b0 [ 451.544268][T14029] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 451.545626][T14048] __filemap_fdatawrite_range+0x1c5/0x230 [ 451.545658][T14048] file_write_and_wait_range+0xfd/0x160 [ 451.545679][T14048] ext4_sync_file+0x266/0x8c0 [ 451.545701][T14048] ? generic_perform_write+0x274/0x320 [ 451.545719][T14048] ? __read_once_size.constprop.0+0x20/0x20 [ 451.545813][T14048] vfs_fsync_range+0x82/0x150 [ 451.545843][T14048] ext4_buffered_write_iter+0x222/0x290 [ 451.596126][T14048] ext4_file_write_iter+0xfa/0xd70 [ 451.608700][T14048] ? delay_tsc+0x8f/0xc0 [ 451.611491][T14029] FAT-fs (loop5): Filesystem has been set read-only [ 451.612954][T14048] ? __const_udelay+0x36/0x40 [ 451.612973][T14048] ? __udelay+0x10/0x20 [ 451.613020][T14048] do_iter_readv_writev+0x487/0x5b0 [ 451.642682][T14048] ? security_file_permission+0x88/0x280 [ 451.648350][T14048] do_iter_write+0x13b/0x3c0 [ 451.652969][T14048] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 451.658896][T14048] vfs_iter_write+0x5c/0x80 [ 451.662326][T14029] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) [ 451.680443][T14048] ovl_write_iter+0x594/0x790 [ 451.680535][T14048] do_iter_readv_writev+0x487/0x5b0 [ 451.680556][T14048] ? security_file_permission+0x88/0x280 [ 451.680587][T14048] do_iter_write+0x13b/0x3c0 [ 451.680608][T14048] ? __read_once_size+0x5a/0xe0 [ 451.680634][T14048] vfs_writev+0x118/0x1c0 [ 451.710815][T14048] ? __fget_light+0xc4/0x1a0 [ 451.715796][T14048] do_pwritev+0x131/0x1d0 [ 451.720143][T14048] __x64_sys_pwritev+0x61/0x80 [ 451.725091][T14048] do_syscall_64+0xcc/0x3a0 [ 451.729615][T14048] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 451.735551][T14048] RIP: 0033:0x45c6c9 [ 451.739543][T14048] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 451.759430][T14048] RSP: 002b:00007fe3643d4c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000128 12:28:40 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(0x0, 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:40 executing program 0: [ 451.768096][T14048] RAX: ffffffffffffffda RBX: 00007fe3643d56d4 RCX: 000000000045c6c9 [ 451.776731][T14048] RDX: 0000000000000001 RSI: 0000000020000080 RDI: 0000000000000003 [ 451.785021][T14048] RBP: 000000000076bf20 R08: 0000000000000000 R09: 0000000000000000 [ 451.793094][T14048] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 451.801173][T14048] R13: 0000000000000868 R14: 00000000004cb0c7 R15: 0000000000000009 12:28:40 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x0, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 451.850910][T14056] overlayfs: filesystem on './file0' not supported as upperdir [ 451.859803][T14055] overlayfs: filesystem on './file0' not supported as upperdir 12:28:40 executing program 3 (fault-call:10 fault-nth:10): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:28:40 executing program 0: 12:28:40 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="06", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:40 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x4}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:40 executing program 0: [ 452.343216][T14079] overlayfs: filesystem on './file0' not supported as upperdir 12:28:40 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(0x0, 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:40 executing program 0: [ 452.529043][T14085] FAULT_INJECTION: forcing a failure. [ 452.529043][T14085] name failslab, interval 1, probability 0, space 0, times 0 [ 452.538164][T14069] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 452.560946][T14069] FAT-fs (loop5): Filesystem has been set read-only [ 452.571761][T14069] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) [ 452.584682][T14085] CPU: 1 PID: 14085 Comm: syz-executor.3 Not tainted 5.6.0-rc1-syzkaller #0 [ 452.593375][T14085] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 452.603434][T14085] Call Trace: [ 452.606731][T14085] dump_stack+0x11d/0x181 [ 452.611065][T14085] should_fail.cold+0x5/0x13 [ 452.615831][T14085] ? mempool_free+0x1b0/0x1b0 [ 452.620613][T14085] __should_failslab+0x86/0xb0 [ 452.625633][T14085] should_failslab+0x9/0x14 [ 452.630153][T14085] kmem_cache_alloc+0x29/0x5d0 [ 452.635000][T14085] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 452.646314][T14085] ? __this_cpu_preempt_check+0x45/0x140 [ 452.653265][T14085] ? mempool_free+0x1b0/0x1b0 [ 452.658035][T14085] mempool_alloc_slab+0x27/0x40 [ 452.663021][T14085] mempool_alloc+0x8e/0x270 [ 452.668076][T14085] ? __unlock_page_memcg+0x47/0xa0 [ 452.673198][T14085] ? unlock_page_memcg+0x28/0x30 [ 452.682154][T14085] bio_alloc_bioset+0x223/0x3e0 [ 452.687144][T14085] ext4_bio_write_page+0x676/0xb79 [ 452.692272][T14085] mpage_submit_page+0xe4/0x1a0 [ 452.697142][T14085] mpage_map_and_submit_buffers+0x3c4/0x6c0 [ 452.703410][T14085] ? __const_udelay+0x36/0x40 [ 452.708138][T14085] ? __udelay+0x10/0x20 [ 452.712301][T14085] ext4_writepages+0x1176/0x1d40 [ 452.717382][T14085] ? ext4_mark_inode_dirty+0x420/0x420 [ 452.722851][T14085] do_writepages+0x6b/0x170 [ 452.727366][T14085] ? do_writepages+0x6b/0x170 [ 452.732113][T14085] ? wbc_attach_and_unlock_inode+0xdd/0x3b0 [ 452.738037][T14085] __filemap_fdatawrite_range+0x1c5/0x230 [ 452.743892][T14085] file_write_and_wait_range+0xfd/0x160 [ 452.749517][T14085] ext4_sync_file+0x266/0x8c0 [ 452.754200][T14085] ? generic_perform_write+0x274/0x320 [ 452.759702][T14085] ? __read_once_size.constprop.0+0x20/0x20 [ 452.765640][T14085] vfs_fsync_range+0x82/0x150 [ 452.770337][T14085] ext4_buffered_write_iter+0x222/0x290 [ 452.775902][T14085] ext4_file_write_iter+0xfa/0xd70 [ 452.783118][T14085] ? common_file_perm+0x1d5/0x490 [ 452.788154][T14085] ? check_stack_object+0xda/0x110 [ 452.793281][T14085] do_iter_readv_writev+0x487/0x5b0 [ 452.798488][T14085] ? security_file_permission+0x88/0x280 [ 452.804189][T14085] do_iter_write+0x13b/0x3c0 [ 452.808842][T14085] ? __read_once_size+0x5a/0xe0 [ 452.813813][T14085] vfs_writev+0x118/0x1c0 [ 452.818180][T14085] ? __fget_light+0xc4/0x1a0 [ 452.822791][T14085] do_pwritev+0x131/0x1d0 [ 452.827215][T14085] __x64_sys_pwritev+0x61/0x80 [ 452.832021][T14085] do_syscall_64+0xcc/0x3a0 [ 452.838831][T14085] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 452.844739][T14085] RIP: 0033:0x45c6c9 [ 452.848656][T14085] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 452.868427][T14085] RSP: 002b:00007fe3643d4c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000128 12:28:41 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="01", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 452.876850][T14085] RAX: ffffffffffffffda RBX: 00007fe3643d56d4 RCX: 000000000045c6c9 [ 452.884835][T14085] RDX: 0000000000000001 RSI: 0000000020000080 RDI: 0000000000000003 [ 452.892884][T14085] RBP: 000000000076bf20 R08: 0000000000000000 R09: 0000000000000000 [ 452.901658][T14085] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 452.909754][T14085] R13: 0000000000000868 R14: 00000000004cb0c7 R15: 000000000000000a 12:28:41 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x5}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:41 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x0, 0x0, 0x5, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:41 executing program 0: 12:28:41 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(0x0, 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:41 executing program 3 (fault-call:10 fault-nth:11): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) 12:28:41 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_hmac_sha1\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000007b00)=[{{&(0x7f00000026c0)=@hci, 0x80, &(0x7f00000003c0)=[{0x0}, {&(0x7f0000000200)=""/78, 0x4e}], 0x2}, 0x49bf}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000002980)=""/97, 0x61}, 0x4}, {{&(0x7f0000002a00)=@xdp, 0x80, &(0x7f0000002c00)=[{&(0x7f0000002ac0)=""/250, 0xfa}], 0x1}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5, 0x2060, 0x0) recvmmsg(r1, &(0x7f0000001280)=[{{&(0x7f0000000ec0)=@nl=@proc, 0x167, &(0x7f0000001180)=[{&(0x7f0000001080)=""/251, 0xfb}], 0x3ed, &(0x7f00000011c0)=""/157, 0x9d}}], 0x1500, 0x0, &(0x7f0000001380)={0x77359400}) syz_genetlink_get_family_id$batadv(&(0x7f00000000c0)='batadv\x00') shmctl$SHM_STAT(0x0, 0xd, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv0\x00'}) ioctl$GIO_UNISCRNMAP(0xffffffffffffffff, 0x4b69, 0x0) 12:28:41 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x0) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) [ 453.530888][T14122] overlayfs: filesystem on './file0' not supported as upperdir [ 453.605022][T14121] overlayfs: filesystem on './file0' not supported as upperdir 12:28:42 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_hmac_sha1\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000007b00)=[{{&(0x7f00000026c0)=@hci, 0x80, &(0x7f00000003c0)=[{0x0}, {&(0x7f0000000200)=""/78, 0x4e}], 0x2}, 0x49bf}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000002980)=""/97, 0x61}, 0x4}, {{&(0x7f0000002a00)=@xdp, 0x80, &(0x7f0000002c00)=[{&(0x7f0000002ac0)=""/250, 0xfa}], 0x1}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5, 0x2060, 0x0) recvmmsg(r1, &(0x7f0000001280)=[{{&(0x7f0000000ec0)=@nl=@proc, 0x167, &(0x7f0000001180)=[{&(0x7f0000001080)=""/251, 0xfb}], 0x3ed, &(0x7f00000011c0)=""/157, 0x9d}}], 0x1500, 0x0, &(0x7f0000001380)={0x77359400}) syz_genetlink_get_family_id$batadv(&(0x7f00000000c0)='batadv\x00') shmctl$SHM_STAT(0x0, 0xd, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv0\x00'}) ioctl$GIO_UNISCRNMAP(0xffffffffffffffff, 0x4b69, 0x0) 12:28:42 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="05", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:42 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x0) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:42 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x6}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:42 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) [ 454.027404][T14139] overlayfs: filesystem on './file0' not supported as upperdir [ 454.229030][T14149] overlayfs: filesystem on './file0' not supported as upperdir 12:28:42 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x0) open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) 12:28:42 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)='\x00', 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:42 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x0, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:42 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_hmac_sha1\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000007b00)=[{{&(0x7f00000026c0)=@hci, 0x80, &(0x7f00000003c0)=[{0x0}, {&(0x7f0000000200)=""/78, 0x4e}], 0x2}, 0x49bf}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000002980)=""/97, 0x61}, 0x4}, {{&(0x7f0000002a00)=@xdp, 0x80, &(0x7f0000002c00)=[{&(0x7f0000002ac0)=""/250, 0xfa}], 0x1}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5, 0x2060, 0x0) recvmmsg(r1, &(0x7f0000001280)=[{{&(0x7f0000000ec0)=@nl=@proc, 0x167, &(0x7f0000001180)=[{&(0x7f0000001080)=""/251, 0xfb}], 0x3ed, &(0x7f00000011c0)=""/157, 0x9d}}], 0x1500, 0x0, &(0x7f0000001380)={0x77359400}) syz_genetlink_get_family_id$batadv(&(0x7f00000000c0)='batadv\x00') shmctl$SHM_STAT(0x0, 0xd, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv0\x00'}) ioctl$GIO_UNISCRNMAP(0xffffffffffffffff, 0x4b69, 0x0) 12:28:42 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x7}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:43 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="03", 0x1}], 0x1, 0x0) [ 454.719207][T14165] overlayfs: failed to resolve './file0': -2 [ 454.849114][T14158] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 454.859012][T14158] FAT-fs (loop5): Filesystem has been set read-only [ 454.868816][T14158] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) [ 454.995227][T14176] overlayfs: filesystem on './file0' not supported as upperdir [ 455.032867][T14179] overlayfs: filesystem on './file0' not supported as upperdir [ 455.061606][ T27] kauditd_printk_skb: 9 callbacks suppressed [ 455.061626][ T27] audit: type=1800 audit(1581683323.540:556): pid=14182 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.3" name="bus" dev="overlay" ino=16561 res=0 12:28:43 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x3, 0x6) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000300)={@mcast2, 0x0, 0x0, 0x102, 0x8000003}, 0x20) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) dup3(r3, r2, 0x0) 12:28:43 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(0x0, 0x141042, 0x0) 12:28:43 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x0, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:43 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x8}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:43 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="0f", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:43 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="04", 0x1}], 0x1, 0x0) 12:28:43 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(0x0, 0x141042, 0x0) 12:28:43 executing program 0: r0 = io_uring_setup(0xd, &(0x7f0000000000)) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000080)=[r0], 0x1) [ 455.381820][T14197] overlayfs: filesystem on './file0' not supported as upperdir [ 455.431534][T14203] overlayfs: filesystem on './file0' not supported as upperdir [ 455.451083][T14196] overlayfs: filesystem on './file0' not supported as upperdir [ 455.493029][ T27] audit: type=1800 audit(1581683323.970:557): pid=14208 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.3" name="bus" dev="overlay" ino=16611 res=0 12:28:44 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(0x0, 0x141042, 0x0) 12:28:44 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x9}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:44 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)='\x00', 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:44 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)='\a', 0x1}], 0x1, 0x0) 12:28:44 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000480)=0x72e, 0x4) sendto$inet(r2, 0x0, 0x0, 0x0, &(0x7f0000000000)={0x2, 0x4e26}, 0x10) recvmmsg(r2, &(0x7f0000000040)=[{{0x0, 0xfffffffffffffe44, 0x0, 0x0, 0x0, 0x4}}], 0x4000000000001b8, 0x12001, 0x0) [ 456.009792][T14198] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 456.030655][T14198] FAT-fs (loop5): Filesystem has been set read-only [ 456.042789][T14198] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) [ 456.061907][T14238] overlayfs: filesystem on './file0' not supported as upperdir [ 456.087844][T14242] overlayfs: filesystem on './file0' not supported as upperdir 12:28:44 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x0, 0x8, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:44 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fcntl$setstatus(r1, 0x4, 0x102800) write(r1, &(0x7f0000000000)="d5", 0x1000001be) dup3(r1, r0, 0x0) 12:28:44 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="e0", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:44 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x0, 0x0) [ 456.106790][T14237] overlayfs: filesystem on './file0' not supported as upperdir [ 456.152079][ T27] audit: type=1800 audit(1581683324.630:558): pid=14237 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.3" name="bus" dev="overlay" ino=16611 res=0 12:28:44 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0xa}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:44 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)='\b', 0x1}], 0x1, 0x0) [ 456.354572][T14254] overlayfs: filesystem on './file0' not supported as upperdir 12:28:44 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="f0", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:44 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x0, 0x0) [ 456.458100][ T27] audit: type=1804 audit(1581683324.940:559): pid=14261 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir977795036/syzkaller.znnEcF/278/bus/bus" dev="overlay" ino=16532 res=1 12:28:45 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f000054eff8)='./file0\x00', 0x0, 0x0) getdents(r2, &(0x7f0000077000)=""/133, 0x85) 12:28:45 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x0, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:45 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_elf32(r2, &(0x7f00000000c0)=ANY=[@ANYPTR64], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r2, 0x0) ioctl$KVM_IRQ_LINE_STATUS(r1, 0xc008ae67, &(0x7f0000000280)) [ 456.727631][ T27] audit: type=1804 audit(1581683325.200:560): pid=14269 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir977795036/syzkaller.znnEcF/279/bus/bus" dev="overlay" ino=16723 res=1 [ 456.766723][T14270] overlayfs: filesystem on './file0' not supported as upperdir 12:28:45 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') creat(&(0x7f0000000200)='./bus\x00', 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x1000) open(&(0x7f0000000100)='./bus\x00', 0x0, 0x0) [ 456.850380][T14278] overlayfs: filesystem on './file0' not supported as upperdir [ 456.870908][T14277] overlayfs: './bus' not a directory 12:28:45 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)='\x00', 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 456.906484][ T27] audit: type=1800 audit(1581683325.380:561): pid=14278 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.3" name="bus" dev="overlay" ino=16881 res=0 12:28:45 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)='\n', 0x1}], 0x1, 0x0) 12:28:45 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0xb}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:45 executing program 0: r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0xce024b8b) link(&(0x7f0000000240)='./file0\x00', &(0x7f0000000000)='./file1/file0\x00') unlink(&(0x7f0000000180)='./file1/file0\x00') [ 457.160501][ T27] audit: type=1804 audit(1581683325.640:562): pid=14300 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir977795036/syzkaller.znnEcF/280/bus/bus" dev="overlay" ino=16645 res=1 12:28:45 executing program 1: r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000100)=0xbaa) perf_event_open(0x0, r0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x3, 0x0, 0x0, 0x0, 0x413e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x1, @perf_config_ext={0x7, 0x1}, 0x1a0a4, 0x0, 0x0, 0x0, 0x531}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) sendmsg$DEVLINK_CMD_PORT_SET(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getgroups(0x0, 0x0) fchdir(0xffffffffffffffff) wait4(0x0, 0x0, 0x0, 0x0) getpid() tkill(0x0, 0x9) socket$inet6(0xa, 0x0, 0x9) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000140)=0x31, 0x4) bind$inet(r1, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x32}}, 0x10) connect$inet(r1, &(0x7f0000000500)={0x2, 0x0, @broadcast}, 0x10) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r1, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) setuid(0x0) syz_open_procfs(0x0, 0x0) fstat(0xffffffffffffffff, 0x0) keyctl$chown(0x4, 0x0, 0x0, 0x0) prctl$PR_GET_SECCOMP(0x15) syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') read$FUSE(0xffffffffffffffff, 0x0, 0x0) write$FUSE_POLL(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) [ 457.475921][T14312] overlayfs: filesystem on './file0' not supported as upperdir [ 457.504043][T14313] overlayfs: filesystem on './file0' not supported as upperdir [ 457.563732][T14314] overlayfs: filesystem on './file0' not supported as upperdir 12:28:46 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="e0", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:46 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0xc}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:46 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="0f", 0x1}], 0x1, 0x0) 12:28:46 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x0, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:46 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x0, 0x3, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 458.236386][T14345] overlayfs: filesystem on './file0' not supported as upperdir [ 458.259209][T14348] overlayfs: filesystem on './file0' not supported as upperdir 12:28:46 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="f0", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:46 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0xf}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 458.337638][T14343] overlayfs: filesystem on './file0' not supported as upperdir [ 458.372518][ T27] audit: type=1800 audit(1581683326.850:563): pid=14353 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.3" name="bus" dev="overlay" ino=16641 res=0 12:28:47 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="10", 0x1}], 0x1, 0x0) 12:28:47 executing program 1: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDGKBSENT(r0, 0x4b48, &(0x7f00000004c0)={0x0, "2c9129d72f8404a9f1a08c14a14ea95392cf98fc47480b9752246830b1d015a7877a58d65120661b0d4c48ebb140882d3b0c68be395d617191d8eeb38b61d79b117bce9afa545c66ef18cbc5d6f8b8369eb7452b377ea14a82b0e260da7fe041e9bca554099bb6d7f6d2b61390ee2b603bb0ee762d57ebe4801e5bcd58192757b62ca4fd026d3c7c8eec761a024283e881184201e00164ba421ce2faf54a12ba15873db2a724443fb88465d0336d0dfb04dd619bfcb96615c3b1f63ca8f1237712bd1941013610507881c43ce3cbd401f63632791f0717f166b50c21d4bc4265bc1a1036badb6d4177abd3c5feac2c9f360245fb893868b983b1d10f3d491e38449d6179527da80294a3b5ad9c08054243748dba163db19a7557019f6ce96c9c2668eaa7e45e751667e59fb139ac5829586a0b007b083c2d4adecf5f96e488737e4efc8bc9f34f442f4d2460d3938fff1bbd92008317124d6059107076b7d1e7555a6ca2bcd1816b6a907db03b408c7190f41b2597e53b1b8570231b422d66f5177d743e082b68cd8b414eab1e34dc188abe1134e14b4ab0e44ea788091e764b83bb7b5b29dd4bc780c1ba1f167564de44c3f264044e2babffa73dfd9b6b3daa0ee2d2c53e0fdfda192e400686276361e4a91e85a04ef82cb258856ebcd7ed7bffb4d056cdc71702b0ab7af71128c86e9bb488804b3d91e41b3ad61ee4cc350a"}) 12:28:47 executing program 0: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r0 = getpid() tkill(r0, 0x9) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f000018efdc)="1400000052001f0214f9f4070009040081000710", 0x14) recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, 0x0}}], 0x344, 0x10122, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 458.932880][T14368] overlayfs: filesystem on './file0' not supported as upperdir [ 458.939557][T14357] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) 12:28:47 executing program 1: openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000040)) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x48) mount$bpf(0x20000000, 0x0, 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0xcfac39d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_opts(r0, 0x0, 0x0, 0x0, 0x0) r1 = add_key$keyring(&(0x7f0000000640)='keyring\x00', &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000180)='user\x00', &(0x7f00000001c0)={'syz', 0x3}, &(0x7f0000000200)='pptp\x00', r1) keyctl$clear(0x7, r1) r2 = add_key$keyring(&(0x7f0000000640)='keyring\x00', &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000180)='user\x00', &(0x7f00000001c0)={'syz', 0x3}, &(0x7f0000000200)='pptp\x00', r2) add_key$keyring(&(0x7f0000000240)='keyring\x00', 0x0, 0x0, 0x0, r2) r3 = add_key$keyring(&(0x7f0000000640)='keyring\x00', &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000180)='user\x00', &(0x7f00000001c0)={'syz', 0x3}, &(0x7f0000000200)='pptp\x00', 0x0) keyctl$clear(0x7, 0x0) request_key(&(0x7f00000002c0)='.dead\x00', &(0x7f0000000300)={'syz', 0x1}, &(0x7f0000000340)='/dev/kvm\x00', r3) socketpair$unix(0x1, 0x2, 0x0, 0x0) pivot_root(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0\x00') socket$packet(0x11, 0x3, 0x300) socket$packet(0x11, 0x2, 0x300) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)=ANY=[@ANYBLOB="580000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="000000000400000004001a8008001b0000000000080029000000000014001400626f6e645f736c6176655f300000000008000a00", @ANYRES32=0x0, @ANYBLOB="08001f00054f8ac672f2cdf437c8b0e4a1c3e3aa79a7189d812f1f4d39d0f0c09db9dcdff6dfc99771a89f29e75d6141bde8000000"], 0x58}}, 0x84) [ 458.974251][T14373] overlayfs: filesystem on './file0' not supported as upperdir 12:28:47 executing program 0: [ 459.022951][T14357] FAT-fs (loop5): Filesystem has been set read-only [ 459.049221][T14381] overlayfs: filesystem on './file0' not supported as upperdir [ 459.054862][T14357] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) 12:28:47 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x10}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 459.115306][ T27] audit: type=1800 audit(1581683327.590:564): pid=14386 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.3" name="bus" dev="overlay" ino=16486 res=0 12:28:47 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)='\x00', 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 459.158940][T14390] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 459.188318][T14390] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready 12:28:47 executing program 0: 12:28:47 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)='+', 0x1}], 0x1, 0x0) 12:28:47 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x0, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 459.223040][T14390] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 459.251985][T14390] device bridge_slave_0 left promiscuous mode 12:28:47 executing program 0: creat(&(0x7f00000008c0)='./file0\x00', 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$overlay(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f0000000080)={[{@nfs_export_on='nfs_export=on'}, {@xino_on='xino=on'}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@default_permissions='default_permissions'}, {@metacopy_off='metacopy=off'}]}) [ 459.290361][T14390] bridge0: port 1(bridge_slave_0) entered disabled state [ 459.405506][T14390] device bridge_slave_1 left promiscuous mode [ 459.470890][T14390] bridge0: port 2(bridge_slave_1) entered disabled state [ 459.516585][T14404] overlayfs: filesystem on './file0' not supported as upperdir [ 459.531370][T14413] overlayfs: missing 'lowerdir' [ 459.553701][T14414] overlayfs: filesystem on './file0' not supported as upperdir 12:28:48 executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet(0x10, 0x80003, 0x0) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000500)="240000001a000f041dfffd946f6105000200000a1f00000800100800080003002f9bdd5c", 0x24}], 0x1}, 0x0) 12:28:48 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="e0", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 459.571738][T14415] overlayfs: failed to resolve './bus': -2 [ 459.620331][T14390] bond0: (slave bond_slave_0): Releasing backup interface [ 459.714259][T14420] overlayfs: './bus' not a directory 12:28:48 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x23}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:48 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)='\x00', 0x1}], 0x1, 0x0) [ 459.753697][ T27] audit: type=1800 audit(1581683328.230:565): pid=14415 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.3" name="bus" dev="sda1" ino=16487 res=0 [ 459.786802][T14426] overlayfs: filesystem on './file0' not supported as upperdir [ 459.926522][T14390] bond0: (slave bond_slave_1): Releasing backup interface [ 460.059763][T14438] overlayfs: filesystem on './file0' not supported as upperdir [ 460.141111][T14444] overlayfs: filesystem on './file0' not supported as upperdir [ 460.240551][T14390] team0: Port device team_slave_0 removed [ 460.323062][T14390] team0: Port device team_slave_1 removed [ 460.334182][T14390] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 460.351183][T14390] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 460.369820][T14390] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 460.377379][T14390] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 460.430170][T14436] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 460.457218][T14436] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready 12:28:49 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000002540)={'hsr0\x00', 0x43732e53b8416f1a}) ioctl$TUNSETOWNER(r0, 0x400454cc, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000002540)={'hsr0\x00', 0x43732e53b8416f1a}) 12:28:49 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0x2, 0x4, 0x800, 0x9, 0x500}, 0x3c) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8011, r0, 0x0) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x0) 12:28:49 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="f0", 0x1}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:49 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)='\x00', 0x1}], 0x1, 0x0) 12:28:49 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x0, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:49 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x41}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 460.481961][T14436] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 12:28:49 executing program 1: [ 460.714877][T14457] overlayfs: failed to resolve './bus': -2 [ 460.720148][T14461] overlayfs: failed to resolve './bus': -2 12:28:49 executing program 0: [ 460.767502][T14462] overlayfs: filesystem on './file0' not supported as upperdir 12:28:49 executing program 1: [ 460.887301][T14468] overlayfs: './bus' not a directory [ 460.892795][ T27] audit: type=1800 audit(1581683329.370:566): pid=14475 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="overlay" ino=16895 res=0 12:28:49 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x2}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:49 executing program 0: 12:28:49 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x300}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:49 executing program 1: 12:28:49 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)='\x00', 0x1}], 0x1, 0x0) [ 461.105363][T14458] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 461.120338][T14458] FAT-fs (loop5): Filesystem has been set read-only [ 461.201246][T14458] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) 12:28:49 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x0, 0x0, "57b50edb"}, 0x0, 0x0, @userptr, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 461.272535][T14484] overlayfs: filesystem on './file0' not supported as upperdir 12:28:49 executing program 0: 12:28:49 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x3}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:49 executing program 1: [ 461.395421][T14491] overlayfs: filesystem on './file0' not supported as upperdir 12:28:50 executing program 0: [ 461.563867][T14501] overlayfs: filesystem on './file0' not supported as upperdir 12:28:50 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x500}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:50 executing program 1: 12:28:50 executing program 0: [ 461.704813][ T27] audit: type=1800 audit(1581683330.180:567): pid=14508 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.3" name="bus" dev="overlay" ino=16723 res=0 12:28:50 executing program 1: [ 461.873964][T14518] overlayfs: filesystem on './file0' not supported as upperdir 12:28:50 executing program 0: 12:28:50 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x2}], 0x1, 0x0) [ 461.988023][T14525] overlayfs: filesystem on './file0' not supported as upperdir 12:28:50 executing program 0: 12:28:50 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x0, 0x0, "57b50edb"}, 0x0, 0x0, @userptr, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 462.231872][T14505] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 462.240862][T14505] FAT-fs (loop5): Filesystem has been set read-only [ 462.249626][T14505] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) 12:28:50 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x1100}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:50 executing program 1: 12:28:50 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x4}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:50 executing program 0: 12:28:50 executing program 1: 12:28:50 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x3}], 0x1, 0x0) 12:28:51 executing program 0: [ 462.484453][T14548] overlayfs: filesystem on './file0' not supported as upperdir [ 462.493564][T14546] overlayfs: filesystem on './file0' not supported as upperdir 12:28:51 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x5}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:51 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x4000}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:51 executing program 0: [ 462.727124][T14561] overlayfs: filesystem on './file0' not supported as upperdir 12:28:51 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x6}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 463.065559][T14572] overlayfs: filesystem on './file0' not supported as upperdir [ 463.126241][T14569] overlayfs: filesystem on './file0' not supported as upperdir [ 463.144212][T14577] overlayfs: filesystem on './file0' not supported as upperdir [ 463.150504][T14555] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 463.161045][T14555] FAT-fs (loop5): Filesystem has been set read-only 12:28:51 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x0, 0x0, "57b50edb"}, 0x0, 0x0, @userptr, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 463.179804][T14555] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) 12:28:51 executing program 0: 12:28:51 executing program 1: 12:28:51 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x7}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:51 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x4}], 0x1, 0x0) 12:28:51 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x4100}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:51 executing program 1: 12:28:51 executing program 0: 12:28:51 executing program 1: 12:28:52 executing program 1: [ 463.503847][T14598] overlayfs: filesystem on './file0' not supported as upperdir 12:28:52 executing program 1: [ 463.645950][T14604] overlayfs: filesystem on './file0' not supported as upperdir 12:28:52 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x8}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 463.755011][T14609] overlayfs: filesystem on './file0' not supported as upperdir [ 463.804575][ T27] audit: type=1800 audit(1581683332.280:568): pid=14600 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.3" name="bus" dev="overlay" ino=16802 res=0 [ 464.031810][T14593] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 464.040976][T14593] FAT-fs (loop5): Filesystem has been set read-only [ 464.049804][T14593] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) 12:28:52 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x0, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x0, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:52 executing program 0: 12:28:52 executing program 1: 12:28:52 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x8100}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:52 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x5}], 0x1, 0x0) [ 464.153208][T14620] overlayfs: filesystem on './file0' not supported as upperdir 12:28:52 executing program 1: 12:28:52 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x9}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:52 executing program 0: [ 464.267057][T14628] overlayfs: filesystem on './file0' not supported as upperdir [ 464.286410][T14629] overlayfs: filesystem on './file0' not supported as upperdir [ 464.369677][ T27] audit: type=1800 audit(1581683332.850:569): pid=14632 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.3" name="bus" dev="overlay" ino=16532 res=0 12:28:52 executing program 1: 12:28:52 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0xda00}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:52 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='sit0\x00', 0x10) 12:28:52 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x6}], 0x1, 0x0) [ 464.777539][T14649] overlayfs: filesystem on './file0' not supported as upperdir [ 464.840551][T14654] overlayfs: filesystem on './file0' not supported as upperdir [ 464.971692][T14662] overlayfs: filesystem on './file0' not supported as upperdir [ 465.051069][T14641] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 465.069396][T14641] FAT-fs (loop5): Filesystem has been set read-only [ 465.080042][T14641] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) 12:28:53 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x0, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x0, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:53 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2}, 0x0) socket$inet6(0xa, 0x2, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl(r1, 0x0, &(0x7f0000000000)) r2 = io_uring_setup(0xd60, &(0x7f0000000380)={0x0, 0x0, 0x3}) r3 = eventfd(0x7) io_submit(0x0, 0x4, &(0x7f0000000600)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x8, 0x4b, r2, &(0x7f0000000480)="3acb340896cf386e310a6ca57228a1339c5298a070094755e689dd23f299cdd1b5170f540b944eff1292ec77fa4d5ce5761762e2c9e335d5f8cc397696c706c82490ecfbfc483128e644988a684f2bff53a2cb20952c7dce22f16a3e18e3f81540f48a33ae54648b8867b0e67bc8579eca4f00eff2300516b0225b866dd0606047163c9e31ada33ab1c4a1cdfff507fd95a2356b58d996cf80cc33c64f469a610a8e4f0f840660581ae5073abc0518f94b01d07e45d8bc9eff05e6b288c8b47df2c0cf7532424e55", 0xc8, 0x1, 0x0, 0x2, r3}, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x1, 0x4, 0xffffffffffffffff, &(0x7f0000000580)="0690c79bed4054bca973a3a6263da62cc7d1f21cf0ea0969cf54d72b483c24776363884aa1904b7624bf880f593bb819be3edd8ec8605eb903e22f48ff56e681f6c21e48d98be13c6718386bd38ae12fdd5428b516632462167f8fe1ca32bef31817bb7ef371f8e98b16f18a3c840972", 0x70, 0x6, 0x0, 0x2}]) socket$inet6(0xa, 0x800000003, 0xff) 12:28:53 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000940)='tmpfs\x00', 0x0, 0x0) chdir(&(0x7f0000000380)='./file0\x00') mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) creat(&(0x7f0000000640)='./file0/file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000100)='./bus/file1\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000500)=ANY=[@ANYBLOB="02000000010000dfffffffff03000000000000001000000000f5000020000000000000003f98708b702671b6dd3a2a87c1daaccd6ac5f369ff8cc2699c03ff575e599153497c07d5c3f11e56190d78e105edc5caecfcdbc1aeb7fc07903f72764315aef86afa499bc969a865c833ae6c"], 0x4, 0x0) 12:28:53 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0xf000}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:53 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0xa}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:53 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x7}], 0x1, 0x0) [ 465.243428][T14677] overlayfs: filesystem on './file0' not supported as upperdir [ 465.270760][T14676] overlayfs: filesystem on './file0' not supported as upperdir 12:28:53 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0xffffffffa0018000, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x2, 0x1, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @rand_addr="7f3db04fc19673e76227cb2fda9e4f6e"}}]}, 0x50}}, 0x0) 12:28:53 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000340)) write(0xffffffffffffffff, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r2 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$TIOCGPTPEER(r2, 0x5441, 0x400) r3 = socket$inet6(0xa, 0x800000003, 0xff) connect$inet6(r3, &(0x7f0000000000), 0x1c) r4 = dup(r3) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000100)=0x7fff) r5 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r4, r5, 0x0, 0x8000fffffffe) socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0x5) 12:28:53 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0xb}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 465.366026][T14689] overlayfs: filesystem on './file0' not supported as upperdir 12:28:53 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0xfdef}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:54 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x8}], 0x1, 0x0) [ 466.150164][T14714] overlayfs: filesystem on './file0' not supported as upperdir 12:28:54 executing program 0: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_elf32(r0, &(0x7f00000000c0)=ANY=[@ANYPTR64], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x10012, r0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2}, 0x0) 12:28:54 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x0, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x0, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), r5, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r7, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 466.226775][T14719] overlayfs: './bus' not a directory 12:28:54 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x20003041}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:54 executing program 1: syz_emit_ethernet(0x4a, &(0x7f0000000f40)={@broadcast, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "24f008", 0x14, 0x3a, 0x0, @dev, @mcast2, {[], @ndisc_ns={0x87, 0x0, 0x0, @mcast1}}}}}}, 0x0) 12:28:55 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0xc}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 466.532799][T14729] overlayfs: filesystem on './file0' not supported as upperdir 12:28:55 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x9}], 0x1, 0x0) 12:28:55 executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="700100002400cd4dd607efd3fc00000000000000", @ANYRES32, @ANYBLOB="00000000ffffffff00000000280008001c0001001000000000000000000000000000ff0f0000000000000000080002c60000020008000100726564001c01020004010200b205a34f0459cc6abb699f4e08e3b1b5f75780560a59a8480dae55818041c02d8471389f5a076eaa787f8246aef232f41fb4fd095e664069035a011afb427b4799dc17338322c9d91968a82836bcbba734486e4d3c392ec5c40433021f006b4ddf02645062bacedcbcd61e4be8eea0e577dae0a23161a078fedf38770e055341db2eca0ca565e8c92336422a57f6adad6ed581b27ccc9155e93c542353f1681423161cb1e44cc5b75a30512fff1d3a8f0d2bcb9e9ebfa6290dd5fd8cd5150410922c3f86a3cee1d9e807ad3428f51c99eb16018bf7a6cd83d4a6ff4af8a94fab0a1d86fded7a3835a987bd9f53499def9115ff45ce9d94aa0000000000000000140001000700000002f85894683c42a1525d70c4ee0f56245d2284505c555f4c2347e7c655a374fb5e5d65b2a005aa8e247772006318a8118af059bd41a34352a8ab7c39e011c146158ad31322b8f8a2cd30e3c5a51f8bd4e6ba30daac4fdae98f9221600b28a17d09aad749b9fcdd7e3efd51a7bcc91453368ebc307606b53326ffd17400"/467], 0x170}}, 0x0) r0 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r0, &(0x7f0000000180)=[{0x2, 0x1000000000000, &(0x7f0000000080), 0xe, &(0x7f0000000100)}], 0x492492492492642, 0x0) [ 466.859192][T14732] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) 12:28:55 executing program 0: r0 = socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6(0xa, 0x3, 0x2f) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000900)=ANY=[@ANYBLOB="66696c74657200000000000000000000000000000000000000000000000000000e00000004000000a00200007001000070010000700100009800000098000000080200000802000008020000080200000802000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000700098000000000000000000000000000000000000000000280052454a454354000000000000000000000000000000000000000000aa0d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b000d80000000000000000000000000000000000000000004000636f6e6e6c696d69740000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000280052454a4543540000000000000000000000000000000000000000000000000000000000000000ffffffffe000000100000000000000006c6170623000000000000000000000007465616d30000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000700098000000000000000000000000000000000000000000280052454a4543540000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000980000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff"], 0x1) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$inet_udp(0x2, 0x2, 0x0) write$char_usb(0xffffffffffffffff, &(0x7f0000000c00)="6bddbaddc8401e6d585dc6afbcfb36ee62bc092bebaf93e3219c56342344e4b120fe2c1d21f298ab00f96a954c7d77a72639b1d1ca6a1531a89123e4b39a529bd753fe9d56c0db23832c025725f0cbde6668fe80a013c2733baf6f73c5cb060492ad3ae1207c6a0e2fb3427a9106d80f827d6ccfa51d1ee55e498b7294cd4520446bed0bc2daa46dda0b990ac0fe07b6620bde2b8e598f05d59bc862bd89c6e2a17bb34c80476659d432cae2437ca8c38edeabec1b3b65b527714bab2a9cd3ad8ac6d968a9865b106e43e1aa47fcbc8cf7401e66077a3392fc454372080b3eb6cd0df2e1d3af88a344e66268f06cff5ee90585719467f2bc649c2f14f936dbf6fe22ae22bbd49dba40a3ecc89ee6784fb8c99e052dafd1bda0a1da7d3fdf1481387c69c935b33457d62f18c9e2c1f461c42a61b97b4d28a98ade921fd3e377ad2da5d0405d396be22eae948a46804c29b55a1037c2837956c5571fae4d18c7d3d2d30733747193a59c1f5f04be68337474658e3ca721f501610941d16e6e833db2e9c775dd95609017697ce9f9556368c159d3b5e777b5a44e6aa1436e3280b5149fc9a4a0fb57433fd98a2e96138978619ffe6d7395259ac9b87d853910373559486a2de94a4b3e2db44a7bba4b39534a9c590e1b07c1874ff33b5a06151240f96993c726369053cfad06b38fda3b73d3f86aa27cfe06ca3170bfa825d10fc4f5b700873478566c9977b39cb90aa6675934cd27d7bfcc04ca488045369d7ef6109b1b1c4ea08eacd1c8e8112db2101b6a0ba7023174b73ddbad45dcd03e29535d57dc9a6f225e98d4bda4b063ae3367f40088e43881cf681fc43954ead149b7076f38d978e0f1d1b38c06dca984072990dcfff2e30755b542f2538248a3195373a183b02f3fccf6fbcb9f8e4fe616aa7764ba91dff2c709213b4e2f834bf03bbbc0f62976c29a39d151c1c6333910e71e13206ab8626e93f2af4c50f99d181b259b811feadea4554e0b320e8b1120bab3c6180f4b072fa987b827df48006b7dbf37a81ce9bf749c92e8fdfb590ecb754cd8952221b63c65ef970fc33c56bddcef8645ebe9e257dbfdfc530324ce959da3a0a41cc2992d7ddde523de388cb7312d329d76ae33d03a47acf3c841f32a76362f02239681328bf1153bf01c6c69de285ded7bb2b917fc233d153548cf9d1358e2c9700262dec33404d19de63ea43289a22343b9d53c0f0c0b8cd83b62210180a57565884a9e91728e0a46bbbd053fa6f9a634a6185e2be45abc35443d04dd7dd45afffd57e957d48dea7372c793434f47a517cb4ad5f6b7b5c594afcf75a596cbf7b9adef196091f0ff0edefb0de3ba254794dc4c080ab351b30bb82d118c81b4d82840e0df055e8fdda17d0e4fd3a37b3bf6a5ab97471303a12134ac682dd692ed8f939e64c306332c6c2edac4e015167c351d79f97b3e79c6a6d7c5ce1e7ceef4b8810f7d20937a818c135c03eee60dce8e660dd85a322860de2a72e002cd8741b87e6fba1f2e8306f9dd543423e0caf7285926d50138f7c8caca57df3cd793006979b984496ce3e63b07589492cb596afde858cf783ae8a08ba88da6fe6757cafb0385da06578d50c376b958319d9cc2c30617f66f5a5b9f38f9ccd8704b4dfcd7a95d553ad92a378c746e9062355a6fca215cf0bd15783e4e21a52e8744d82cdd999ab3f4baf10aaf66f9877c15cea4709a9ec1cded97cca892e6249ec0ba182a9b31014afd07d4fcaed280842e056408680dd7dbd0fe1e2d8794b9c6375e0d1be96db5b9826133256c25e724edcdbb64522ed83614c7fa60a53ec1e2f3358035988c0deb2a8acac044efe1f4bafd0ddf972564cb2cc6890d9e3416b7b4fe1c199695b660135a08a9de96efa03975a42a78f20c4d082c7f5f08a9c9", 0x54f) close(r5) write$binfmt_misc(r4, &(0x7f0000000140)=ANY=[], 0x4240a2a0) socket$inet(0x2, 0x200000003, 0x84) connect$inet(r5, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x4}}, 0x10) splice(r3, 0x0, r5, 0x0, 0x19404, 0x0) [ 466.937261][T14732] FAT-fs (loop5): Filesystem has been set read-only [ 466.964586][T14732] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) [ 467.019499][T14751] overlayfs: filesystem on './file0' not supported as upperdir 12:28:55 executing program 1: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000008c0)=ANY=[@ANYBLOB="66696c74657200000000000000000000000000000000000000000000000000000e00000004000000800300000801000000000000d8010000d8010000d8010000b0020200b0020000b0020000b0020000b00200000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a80008010000000000000000000000000000000000000000000000006000484d41524b00000000000000000000000000000000000000000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000ea0000000000000000000000fe880000000000000000000000000001fe8800000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000726f73653000000000000000000000006e657464657673696d300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a800d000000000000000000000000000000000000000000000000000280052454a45435400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a800d8000000000000000000000000000000000000000000000000003000534554000000000000000000000000000000000000000000000000000002000006000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a800d0000000000000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff"], 0x1) sendmmsg$inet6(r0, &(0x7f0000001f40)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback}, 0x1c, 0x0}}], 0x1, 0x0) 12:28:55 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x0, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), 0xffffffffffffffff, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) setsockopt$EBT_SO_SET_ENTRIES(r6, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r6, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 467.125206][T14763] x_tables: duplicate underflow at hook 2 [ 467.156137][T14760] overlayfs: filesystem on './file0' not supported as upperdir 12:28:55 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0xf}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:55 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0xa}], 0x1, 0x0) [ 467.235389][T14771] x_tables: duplicate underflow at hook 2 [ 467.241457][ T27] audit: type=1800 audit(1581683335.710:570): pid=14767 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.3" name="bus" dev="overlay" ino=16543 res=0 [ 467.276050][T14771] x_tables: duplicate underflow at hook 2 12:28:55 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/ipv6_route\x00') r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000001000)={0x26, 'hash\x00', 0x0, 0x0, 'michael_mic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f00000000c0)='\x00\x00\x00\x00\x00\x00\x00\x00', 0x8) r4 = accept4$alg(r3, 0x0, 0x0, 0x0) sendfile(r4, r0, 0x0, 0x20000002) [ 467.553673][T14748] overlayfs: filesystem on './file0' not supported as upperdir [ 467.584036][T14773] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 467.593506][T14773] FAT-fs (loop5): Filesystem has been set read-only [ 467.603846][T14773] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) 12:28:56 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x0, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), 0xffffffffffffffff, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) setsockopt$EBT_SO_SET_ENTRIES(r6, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r6, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) 12:28:56 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x7ffff000}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:56 executing program 1: perf_event_open(&(0x7f0000000000)={0x1000000002, 0x70, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000340)={'bridge0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x6, 0x0, 0x20000000}}) [ 467.933806][T14789] overlayfs: filesystem on './file0' not supported as upperdir 12:28:56 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08418330e91000105ab071") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000180)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(md5)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) r2 = accept4$alg(r1, 0x0, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000001440)=[{0x0, 0x0, 0x0}], 0x1, 0x0) 12:28:56 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x0, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f0000000500)={0x5, 0x10, 0xfa00, {&(0x7f0000000300), 0xffffffffffffffff, 0x4}}, 0x18) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) setsockopt$EBT_SO_SET_ENTRIES(r6, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r6, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 468.150786][T14788] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 468.160019][T14788] FAT-fs (loop5): Filesystem has been set read-only [ 468.168908][T14788] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) 12:28:56 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x10}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 468.232549][T14805] overlayfs: filesystem on './file0' not supported as upperdir 12:28:56 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0xb}], 0x1, 0x0) 12:28:56 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="08418330e91000105ab071") bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x20, 0x20, 0x2, [@ptr={0x0, 0x0, 0x0, 0xa, 0x2}, @func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{0x0, 0x8}]}]}}, &(0x7f0000004600)=""/210, 0x3a, 0xd2, 0x8}, 0x20) 12:28:56 executing program 0: sendmsg(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000000c0)="5500000018007f5a480500b2a4a280930206000400a843096c2623692500160013140102", 0x24}], 0x1, 0x0, 0x0, 0x46020068}, 0x0) r0 = socket(0x10, 0x80002, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000000)={0x7}, 0x10) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001e005f0214ff040000000000000000000000000000000100", 0x1c) sendmmsg$alg(r0, &(0x7f0000000140)=[{0x0, 0x0, &(0x7f0000000100), 0x0, &(0x7f0000000100)}], 0x492492492492805, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl(r1, 0x1000008912, &(0x7f0000000080)="080db5050600000047b071") [ 468.461068][T14820] BPF:[2] FUNC_PROTO (anon) [ 468.476569][T14820] BPF:return=0 args=( [ 468.507265][T14820] BPF:8 (anon) [ 468.546459][T14823] overlayfs: filesystem on './file0' not supported as upperdir [ 468.556367][T14820] BPF:) [ 468.580034][ T27] audit: type=1800 audit(1581683337.060:571): pid=14828 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.3" name="bus" dev="overlay" ino=16628 res=0 [ 468.612366][T14820] BPF: [ 468.627994][T14820] BPF:Invalid arg#1 12:28:57 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl(r1, 0x1000008912, &(0x7f0000000080)="08418330e91000105ab071") setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x8001}, 0x10) write(r0, &(0x7f00000000c0)="240000001e005f0214fffffffffffff8070000000000000000000000080008000d000000", 0x24) [ 468.658006][T14820] BPF: [ 468.658006][T14820] [ 468.688525][T14832] BPF:[2] FUNC_PROTO (anon) 12:28:57 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0xc}], 0x1, 0x0) [ 468.713132][T14832] BPF:return=0 args=( [ 468.748042][T14832] BPF:8 (anon) [ 468.754616][T14832] BPF:) [ 468.784467][T14832] BPF: [ 468.798302][T14832] BPF:Invalid arg#1 [ 468.837421][T14832] BPF: [ 468.837421][T14832] 12:28:57 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) writev(r1, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r1, &(0x7f0000000400)=ANY=[@ANYBLOB="88bf2596a4ede63a447592f2d7922018418901fa42fddd618edb6818d0a7fe375671b8206eac7437da69f924999c01625a77006543cfc56c83e1e8f5460d62abd8ae69496a0fc78f284d1343ed64a835c967b9fc7735aeaad6717c226fe345499ea7195a32aa114c13dbc2ffc03d11fef924ec5d36080001000000000000e35876adf33b4086944003cf484a8c1daead95121cb613694b05000000653dc4ee32db1e7dae395ae2b576eadfcfb9460f476ac5bc0e61c68f1d108b1723fc020000004bb6398727028b00000098ceb4e5200fc75d0eb22e946386fa3791d4c5729e5706f9fb3d0abc055d44d8de30afd143acef3d19fbccdebf3103a6a8cdbe8535918dd65e71de57a47ab63c2f96f6890b2a3e6373e678231bdb1a8c3e5e6e45a23a8e687fc2bd298fd9dab5dca6b5a4e6ee86de138a688f42e482a3652d8ebcaaa549396be75f8b2b4ae5178b00000000000000000000fed297c8e294c88e50c5f7e7a657d539a92ff80786be0fe1c8c9c84fb3a01f2fc61a6944ecd1e1e156984442f02fd38ea1"], 0xa) sendmsg$DEVLINK_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) close(r2) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000040)={0x7ff}, 0x10) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl(r4, 0x1000008912, &(0x7f0000000080)="08418330e91000105ab071") write(0xffffffffffffffff, &(0x7f0000000180)="2000000012005f0214f9f407000000000a", 0x11) writev(r1, &(0x7f0000000600)=[{&(0x7f0000000380)="f98ac693ce6908", 0x7}], 0x1) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r0, 0x0, r2, 0x0, 0x80000001, 0x0) [ 468.944118][T14835] overlayfs: filesystem on './file0' not supported as upperdir 12:28:57 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x0, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, 0x0, 0x0) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) setsockopt$EBT_SO_SET_ENTRIES(r6, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r6, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 468.996005][T14816] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 469.005490][T14816] FAT-fs (loop5): Filesystem has been set read-only [ 469.014174][T14816] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) [ 469.271148][T14853] overlayfs: filesystem on './file0' not supported as upperdir [ 469.313581][ T27] audit: type=1800 audit(1581683337.790:572): pid=14860 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.3" name="bus" dev="overlay" ino=16485 res=0 [ 469.644481][T14864] overlayfs: filesystem on './file0' not supported as upperdir 12:28:58 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0xffff8000}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:58 executing program 1: r0 = socket(0x400000000010, 0x2, 0x0) recvmsg(r0, &(0x7f00000027c0)={0x0, 0x0, 0x0}, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40032, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000aa000/0x4000)=nil, 0x4000, 0x6, 0xa132, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x2, 0x132, 0xffffffffffffffff, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl(r1, 0x1000008912, &(0x7f0000000140)="08418330e91000105ab071") write(r0, &(0x7f0000000000)="2400000021002551071c0165ff00fc020200000000100f000ee1000c08000b0000000000", 0x24) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000100)={'syz_tun\x00', &(0x7f0000002fc0)=@ethtool_link_settings={0x3}}) 12:28:58 executing program 0: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x1420000a77, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000080)="080db5050600000047b071") r4 = socket(0x11, 0x800000003, 0x0) bind(r4, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="240800002a00290200"/20, @ANYRES32=r5], 0x2}}, 0x0) write$binfmt_elf64(r1, &(0x7f0000000000)=ANY=[], 0xfffffd88) 12:28:58 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x23}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:58 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0xf}], 0x1, 0x0) [ 469.778592][T14858] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 469.823287][T14858] FAT-fs (loop5): Filesystem has been set read-only [ 469.841630][T14858] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) [ 469.863829][T14872] overlayfs: filesystem on './file0' not supported as upperdir [ 469.870798][T14875] overlayfs: filesystem on './file0' not supported as upperdir 12:28:58 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGMRU(r2, 0x40047452, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) shutdown(0xffffffffffffffff, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfee4, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000240)={0x101, 0x0, 0x4, 0x0, 0x0, {0x77359400}, {0x9, 0x0, 0x5, 0x8, 0x0, 0x0, "57b50edb"}, 0x0, 0x0, @userptr=0x80000001, 0x2, 0x0, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, 0x0, 0x0) recvfrom$llc(r0, &(0x7f0000000040)=""/70, 0x46, 0x0, &(0x7f00000000c0)={0x1a, 0x7, 0xfa, 0x40, 0x0, 0x9, @random="407496812b77"}, 0x10) write$P9_RREADLINK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="3a258211f663a7724bdef6a53bfce1e775b740627227b101040000534aa6f5083067b0248878f000000100cc99e664ff0100000000000073e9c200351ccaefebd642492cfc5ead68cb6a05ee8d76ecced59e90560655a837ad411cb73394239fdd9e33efb5b63c5ff85708d8994e34841e04ec5f4962c4636b7fb34f186b86bb0467bdd13133ef429bda82f9b8e15eae491432dd2a52707c9ff0"], 0x91) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@empty, @in=@loopback, 0x4e21, 0x0, 0x4e21, 0x9, 0xa, 0x20, 0x0, 0x5e}, {0x7, 0x900000, 0x6, 0x1000, 0x4, 0xa480, 0x9, 0x80000001}, {0xff, 0x7fffffff, 0x8000, 0x8}, 0x5, 0x6e6bb1, 0x2, 0x0, 0x0, 0x2}, {{@in6=@ipv4={[], [], @loopback}, 0x4d5, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x3, 0xe9, 0x0, 0x8, 0x7ff}}, 0xe8) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) setsockopt$EBT_SO_SET_ENTRIES(r6, 0x0, 0x80, 0x0, 0x30b) inotify_add_watch(r6, &(0x7f0000000580)='./bus\x00', 0x1) bind$tipc(r4, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) [ 469.902078][ T27] audit: type=1800 audit(1581683338.380:573): pid=14876 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.3" name="bus" dev="overlay" ino=16721 res=0 12:28:58 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x300}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) 12:28:58 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x10}], 0x1, 0x0) 12:28:58 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="08418330e91000105ab071") r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f00000000c0), 0x4) syz_emit_ethernet(0xc0, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa0086dd60e9ff00000b2c00fe8000000000000000000000000000bbfe8000000000000000000000000000aa2c000000", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="54cc5b7971487911"], 0x0) 12:28:58 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000fdfdfff67a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040000010000400404000001000000b7050000020000006a0a00fe00000000850000000a000000b70000000000000095000000000000009cc6b3fcd62c7d1c6238975d43a4505f80fc889f3c530cf08e467b592f868ee3b0a434df0a0e8c1bf176db2a6b2feb4b6fd3d5707bfd2d84aaa3b1d4e984c46ea7e2a447a36f5662403e1b2be4cc7c2683908a0d411a9872971c7c56f0979bd10b97163c1d6d0e196bf02f46c7953ab1abda45cbe8f9de9ca3c00cb9bf4e418d07fa22f0610a70f2bdf4000000000000b0c2940dd8e263f63223b7b80197aa743f7555193161f45346b100000000000000000089e399f6609876b5887437a172fbc02a740675298b79dc194e533583412dff048fc21f28bdd3e26a5ab2728a0481e9f0da43bb6cfb851ce5a9ff19ffcafe3e64be033c9d2f972cc93c1c13caec04a347c24a9fb6a6991ddb737d527d6acb15426415b6e8b14f822e86067a5e991c3bd14984dfa2c6e94bd0339454c13ad3c328a182c15dc760a313"], &(0x7f0000000340)='GPL\x00'}, 0x48) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl(r1, 0x1000008912, &(0x7f0000000080)="080db5050600000047b071") bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000100)={r0, 0x0, 0x10, 0x0, &(0x7f0000000540)="8d14fb003092bd81ed4e5b534c5747c8", 0x0, 0x1000}, 0x28) [ 470.350143][T14901] overlayfs: filesystem on './file0' not supported as upperdir [ 470.371669][T14896] overlayfs: filesystem on './file0' not supported as upperdir 12:28:58 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="08418330e91000105ab071") bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x4c}, [@ldst={0x7}]}, &(0x7f0000003ff6)='GPL\x00', 0x1, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffdee}, 0x48) [ 470.402027][ T27] audit: type=1800 audit(1581683338.880:574): pid=14908 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="overlay" ino=16705 res=0 12:28:58 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000003040)="02", 0x500}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 470.727414][T14890] ================================================================== [ 470.735576][T14890] BUG: KCSAN: data-race in __mark_inode_dirty / inode_sync_complete [ 470.743545][T14890] [ 470.745891][T14890] write to 0xffff888125761440 of 8 bytes by task 8084 on cpu 1: [ 470.753530][T14890] inode_sync_complete+0x3a/0x70 [ 470.758471][T14890] writeback_sb_inodes+0x791/0xa50 [ 470.763589][T14890] wb_writeback+0x1f9/0x6a0 [ 470.768091][T14890] wb_workfn+0x23e/0x9b0 [ 470.772340][T14890] process_one_work+0x413/0x8f0 [ 470.777204][T14890] worker_thread+0xa0/0x800 [ 470.781710][T14890] kthread+0x1d4/0x200 [ 470.785777][T14890] ret_from_fork+0x1f/0x30 [ 470.790179][T14890] [ 470.792515][T14890] read to 0xffff888125761440 of 8 bytes by task 14890 on cpu 0: [ 470.800146][T14890] __mark_inode_dirty+0xb8/0x940 [ 470.805088][T14890] mark_buffer_dirty+0x29c/0x2c0 [ 470.810033][T14890] __block_commit_write.isra.0+0x11f/0x170 [ 470.815843][T14890] block_write_end+0x6d/0x140 [ 470.820528][T14890] generic_write_end+0x8a/0x1f0 [ 470.825395][T14890] ext4_da_write_end+0x158/0x620 [ 470.826088][T14892] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 470.830337][T14890] generic_perform_write+0x1d3/0x320 [ 470.830356][T14890] ext4_buffered_write_iter+0x143/0x290 [ 470.830377][T14890] ext4_file_write_iter+0xfa/0xd70 [ 470.830394][T14890] do_iter_readv_writev+0x487/0x5b0 [ 470.830417][T14890] do_iter_write+0x13b/0x3c0 [ 470.850987][T14892] FAT-fs (loop5): Filesystem has been set read-only [ 470.854879][T14890] vfs_iter_write+0x5c/0x80 [ 470.854898][T14890] ovl_write_iter+0x594/0x790 [ 470.854913][T14890] do_iter_readv_writev+0x487/0x5b0 [ 470.854936][T14890] do_iter_write+0x13b/0x3c0 [ 470.875068][T14892] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) [ 470.875787][T14890] vfs_writev+0x118/0x1c0 [ 470.875803][T14890] do_pwritev+0x131/0x1d0 [ 470.875820][T14890] __x64_sys_pwritev+0x61/0x80 [ 470.875851][T14890] do_syscall_64+0xcc/0x3a0 [ 470.893641][T14920] overlayfs: filesystem on './file0' not supported as upperdir [ 470.898237][T14890] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 470.898241][T14890] [ 470.898255][T14890] Reported by Kernel Concurrency Sanitizer on: [ 470.937992][T14890] CPU: 0 PID: 14890 Comm: syz-executor.4 Not tainted 5.6.0-rc1-syzkaller #0 [ 470.946661][T14890] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 470.956710][T14890] ================================================================== [ 470.964769][T14890] Kernel panic - not syncing: panic_on_warn set ... [ 470.971362][T14890] CPU: 0 PID: 14890 Comm: syz-executor.4 Not tainted 5.6.0-rc1-syzkaller #0 [ 470.980558][T14890] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 470.990619][T14890] Call Trace: [ 470.993895][T14890] dump_stack+0x11d/0x181 [ 470.998212][T14890] panic+0x210/0x640 [ 471.002094][T14890] ? vprintk_func+0x8d/0x140 [ 471.006668][T14890] kcsan_report.cold+0xc/0x1a [ 471.011348][T14890] kcsan_setup_watchpoint+0x3a3/0x3e0 [ 471.016707][T14890] __tsan_read8+0xc6/0x100 [ 471.021146][T14890] __mark_inode_dirty+0xb8/0x940 [ 471.026068][T14890] ? __unlock_page_memcg+0x47/0xa0 [ 471.031166][T14890] mark_buffer_dirty+0x29c/0x2c0 [ 471.036089][T14890] __block_commit_write.isra.0+0x11f/0x170 [ 471.041882][T14890] block_write_end+0x6d/0x140 [ 471.046556][T14890] generic_write_end+0x8a/0x1f0 [ 471.051409][T14890] ext4_da_write_end+0x158/0x620 [ 471.056331][T14890] ? ext4_write_end+0x800/0x800 [ 471.061166][T14890] generic_perform_write+0x1d3/0x320 [ 471.066455][T14890] ext4_buffered_write_iter+0x143/0x290 [ 471.071984][T14890] ext4_file_write_iter+0xfa/0xd70 [ 471.077078][T14890] ? common_file_perm+0x1d5/0x490 [ 471.082088][T14890] do_iter_readv_writev+0x487/0x5b0 [ 471.087267][T14890] ? security_file_permission+0x88/0x280 [ 471.092900][T14890] do_iter_write+0x13b/0x3c0 [ 471.098479][T14890] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 471.104367][T14890] vfs_iter_write+0x5c/0x80 [ 471.108869][T14890] ovl_write_iter+0x594/0x790 [ 471.113537][T14890] do_iter_readv_writev+0x487/0x5b0 [ 471.118731][T14890] ? security_file_permission+0x88/0x280 [ 471.124355][T14890] do_iter_write+0x13b/0x3c0 [ 471.128937][T14890] ? __read_once_size+0x5a/0xe0 [ 471.133773][T14890] vfs_writev+0x118/0x1c0 [ 471.138101][T14890] ? __fget_light+0xc4/0x1a0 [ 471.142676][T14890] do_pwritev+0x131/0x1d0 [ 471.146993][T14890] __x64_sys_pwritev+0x61/0x80 [ 471.151745][T14890] do_syscall_64+0xcc/0x3a0 [ 471.156236][T14890] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 471.162111][T14890] RIP: 0033:0x45c6c9 [ 471.166032][T14890] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 471.185617][T14890] RSP: 002b:00007f56595eac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000128 [ 471.194009][T14890] RAX: ffffffffffffffda RBX: 00007f56595eb6d4 RCX: 000000000045c6c9 [ 471.201975][T14890] RDX: 0000000000000001 RSI: 0000000020000080 RDI: 0000000000000003 [ 471.209939][T14890] RBP: 000000000076bf20 R08: 0000000000000000 R09: 0000000000000000 [ 471.217903][T14890] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 471.225876][T14890] R13: 0000000000000868 R14: 00000000004cb0c7 R15: 000000000076bf2c [ 471.235240][T14890] Kernel Offset: disabled [ 471.239566][T14890] Rebooting in 86400 seconds..