[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 58.748874][ T26] audit: type=1800 audit(1573348362.170:25): pid=8789 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 58.792782][ T26] audit: type=1800 audit(1573348362.180:26): pid=8789 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 58.834316][ T26] audit: type=1800 audit(1573348362.180:27): pid=8789 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.1.57' (ECDSA) to the list of known hosts. 2019/11/10 01:12:52 fuzzer started 2019/11/10 01:12:54 dialing manager at 10.128.0.26:42265 2019/11/10 01:12:54 syscalls: 2566 2019/11/10 01:12:54 code coverage: enabled 2019/11/10 01:12:54 comparison tracing: enabled 2019/11/10 01:12:54 extra coverage: extra coverage is not supported by the kernel 2019/11/10 01:12:54 setuid sandbox: enabled 2019/11/10 01:12:54 namespace sandbox: enabled 2019/11/10 01:12:54 Android sandbox: /sys/fs/selinux/policy does not exist 2019/11/10 01:12:54 fault injection: enabled 2019/11/10 01:12:54 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/11/10 01:12:54 net packet injection: enabled 2019/11/10 01:12:54 net device setup: enabled 2019/11/10 01:12:54 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2019/11/10 01:12:54 devlink PCI setup: PCI device 0000:00:10.0 is not available 01:15:38 executing program 0: 01:15:38 executing program 1: syzkaller login: [ 235.543719][ T8954] IPVS: ftp: loaded support on port[0] = 21 [ 235.699366][ T8957] IPVS: ftp: loaded support on port[0] = 21 [ 235.723324][ T8954] chnl_net:caif_netlink_parms(): no params data found 01:15:39 executing program 2: [ 235.806009][ T8954] bridge0: port 1(bridge_slave_0) entered blocking state [ 235.814749][ T8954] bridge0: port 1(bridge_slave_0) entered disabled state [ 235.824628][ T8954] device bridge_slave_0 entered promiscuous mode [ 235.844082][ T8954] bridge0: port 2(bridge_slave_1) entered blocking state [ 235.854742][ T8954] bridge0: port 2(bridge_slave_1) entered disabled state [ 235.864886][ T8954] device bridge_slave_1 entered promiscuous mode [ 235.941074][ T8954] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 235.979300][ T8954] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 236.022118][ T8954] team0: Port device team_slave_0 added [ 236.034185][ T8957] chnl_net:caif_netlink_parms(): no params data found [ 236.056706][ T8954] team0: Port device team_slave_1 added [ 236.077086][ T8961] IPVS: ftp: loaded support on port[0] = 21 01:15:39 executing program 3: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$key(0xf, 0x3, 0x2) utimes(&(0x7f0000000300)='./file0\x00', &(0x7f0000000380)={{0x0, 0x2710}}) socket$inet6(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @rand_addr, 0x1}, 0xfc7a) r0 = openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCNOTTY(r0, 0x5422) setsockopt$inet_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, &(0x7f0000000880)=ANY=[@ANYBLOB="0400000000000000000000053882ab000000000000000040d5016c4d7c27e7095577242c6b91a402174ed685176be3f717a72df4c3e0c3d5e74a49f5b73e50f0d9416d332d7e100688c891679102ee28a6c52af0069a0ff5a6da40972f340cc089ad6f3749a4b5c1c8d48e7e2ee915634fed89c06b070035d0e6743bc1398a4de76b3e30b9adcda08606f00430b23486106796b8d266f20a1cd9f0684857bd089e15a1f9138ba01b5975b1c43691d5d3490aecdfedc74705e5e44d946ef46fb5470e57f0a28f410ae0cf87a5cd11640b2ad25cd99c232e9a5c6467dbeda96d79dc52fa4563b42bc67963fa66beaa34f407611253540a5cb8c0dee8"]) write$binfmt_misc(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[@ANYBLOB="73797a31a21e58b23404000000e578775057e76e9b0d369849c847f7dcf81bdc98ec01b6ec11bc3f90020096b6314656fbfc140bd39b4387876c1c523b0d4299e3746bd4bfd01db867aba87da9c207313adc547250112dca7a850bd144da749250f279d8bb516bef9d9364c90adec83cb4f582624abfb2e4d94603f5b64b2c4517ec8e45b5677a5be9741747c04b3052fc5f3709b0deef3a3fff2514be7ba5e9a4d3fce5a6095ac86b0d38b0af2d664e5bfba504bd316afea6d182b888ea8d6f6b1353e3c13aa8a15c559d0c1616187dd9f652bc59e14636e1c926f5b3aa71826b37401b79e4e79402c717cf9656495b2ea43d4464e483540bcd01ca7a81284771e98a3ef9394600"], 0x39) r1 = socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x3}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x5e) connect$inet(0xffffffffffffffff, 0x0, 0x5b) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000080)={0x750, {0x2, 0x0, @remote}, {0x2, 0x4e23, @remote}, {0x2, 0x0, @broadcast}, 0x0, 0x0, 0x2, 0x46a, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) splice(0xffffffffffffffff, 0x0, r2, 0x0, 0x19404, 0x0) ioctl$sock_SIOCADDDLCI(r2, 0x8980, 0x0) ioctl$UI_DEV_CREATE(r0, 0x5501) add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f00000002c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$set_timeout(0xf, 0x0, 0x80000001) write$P9_RSTAT(0xffffffffffffffff, &(0x7f0000000540)=ANY=[@ANYBLOB="700000807d0200000069412d1ccad951fbff016c50fa87a085adde26545f00010003000000040400000004000000a5a104fc00000700000000f7ffffffff0000002d560000001f0076626f786e656baf546019a1286b657972696e67656d312c08006b657972696e670008773f0286b347020941c4326873c9282615e8ee9a971230dbb5ed9df9f8ec21027c9ba420f85300000000000000ec1b859205a0b61f73e1e34b2f61c02130aa1e1a68faa1e95eac1c26b72a1754183f8798749b47b40053e27db08b35ffa8eb45d5469ff91d45d7452c86bba076bf9e9f4194c841cec88ccb5ca7bb0e30a4b8d08ad0803466a6aa544cf36a47a5951eba6b3a14a57abcb1c14ace77a58b8ee74d17dd384b692f4a3572deed625d2a31f7bf92f5e4449adbfc763397e54d57a577e5de5d323f9f9b1617c5ac2b4508a66cefdba48696c54b4e575121231cf24f96e89a0add2859ced9"], 0x70) unshare(0x60000000) [ 236.166183][ T8954] device hsr_slave_0 entered promiscuous mode [ 236.202980][ T8954] device hsr_slave_1 entered promiscuous mode [ 236.349983][ T8963] IPVS: ftp: loaded support on port[0] = 21 [ 236.363120][ T8957] bridge0: port 1(bridge_slave_0) entered blocking state [ 236.370213][ T8957] bridge0: port 1(bridge_slave_0) entered disabled state [ 236.378603][ T8957] device bridge_slave_0 entered promiscuous mode 01:15:39 executing program 4: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x1) execve(0x0, 0x0, 0x0) syz_open_dev$evdev(0x0, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0xff) dup2(r0, r1) [ 236.414624][ T8957] bridge0: port 2(bridge_slave_1) entered blocking state [ 236.421710][ T8957] bridge0: port 2(bridge_slave_1) entered disabled state [ 236.443658][ T8957] device bridge_slave_1 entered promiscuous mode [ 236.546175][ T8957] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 236.628057][ T8957] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 236.852136][ T8985] IPVS: ftp: loaded support on port[0] = 21 [ 236.900932][ T8957] team0: Port device team_slave_0 added [ 237.094513][ T8957] team0: Port device team_slave_1 added [ 237.281590][ T8954] 8021q: adding VLAN 0 to HW filter on device bond0 [ 237.395816][ T8957] device hsr_slave_0 entered promiscuous mode [ 237.466024][ T8957] device hsr_slave_1 entered promiscuous mode [ 237.513135][ T8957] debugfs: Directory 'hsr0' with parent '/' already present! [ 237.521272][ T8961] chnl_net:caif_netlink_parms(): no params data found [ 237.561127][ T8963] chnl_net:caif_netlink_parms(): no params data found 01:15:41 executing program 5: r0 = socket$inet6(0xa, 0x3, 0x3a) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @ipv4={[], [], @local}}, 0x1c) syz_emit_ethernet(0x66, &(0x7f0000000040)={@link_local={0x1, 0x80, 0xc2, 0x4888, 0x5800f000}, @dev, [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30, 0xffffff3a, 0x0, @remote, @mcast2, {[], @icmpv6=@time_exceed={0xffffff80, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, '\x00', 0x0, 0x0, 0x0, @empty, @local}}}}}}}, 0x0) [ 237.654769][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 237.678368][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 237.718429][ T8954] 8021q: adding VLAN 0 to HW filter on device team0 [ 237.935654][ T8959] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 237.953982][ T8959] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 238.001223][ T8959] bridge0: port 1(bridge_slave_0) entered blocking state [ 238.008605][ T8959] bridge0: port 1(bridge_slave_0) entered forwarding state [ 238.062961][ T8959] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 238.093250][ T8959] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 238.122653][ T8959] bridge0: port 2(bridge_slave_1) entered blocking state [ 238.129770][ T8959] bridge0: port 2(bridge_slave_1) entered forwarding state [ 238.240962][ T9004] IPVS: ftp: loaded support on port[0] = 21 [ 238.253092][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 238.262053][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 238.287533][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 238.325610][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 238.346290][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 238.385566][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 238.425479][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 238.455512][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 238.495422][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 238.547717][ T8963] bridge0: port 1(bridge_slave_0) entered blocking state [ 238.558117][ T8963] bridge0: port 1(bridge_slave_0) entered disabled state [ 238.585948][ T8963] device bridge_slave_0 entered promiscuous mode [ 238.609211][ T8954] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 238.635747][ T8954] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 238.709989][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 238.719142][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 238.757033][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 238.789923][ T8961] bridge0: port 1(bridge_slave_0) entered blocking state [ 238.807243][ T8961] bridge0: port 1(bridge_slave_0) entered disabled state [ 238.825201][ T8961] device bridge_slave_0 entered promiscuous mode [ 238.855165][ T8961] bridge0: port 2(bridge_slave_1) entered blocking state [ 238.862233][ T8961] bridge0: port 2(bridge_slave_1) entered disabled state [ 238.880595][ T8961] device bridge_slave_1 entered promiscuous mode [ 238.900082][ T8963] bridge0: port 2(bridge_slave_1) entered blocking state [ 238.908100][ T8963] bridge0: port 2(bridge_slave_1) entered disabled state [ 238.924800][ T8963] device bridge_slave_1 entered promiscuous mode [ 238.974285][ T8963] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 238.990274][ T8963] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 239.051424][ T8963] team0: Port device team_slave_0 added [ 239.069063][ T8963] team0: Port device team_slave_1 added [ 239.085897][ T8961] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 239.098630][ T8961] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 239.113413][ T8985] chnl_net:caif_netlink_parms(): no params data found [ 239.236393][ T8963] device hsr_slave_0 entered promiscuous mode [ 239.293587][ T8963] device hsr_slave_1 entered promiscuous mode [ 239.352708][ T8963] debugfs: Directory 'hsr0' with parent '/' already present! [ 239.363487][ T8961] team0: Port device team_slave_0 added [ 239.371939][ T8961] team0: Port device team_slave_1 added [ 239.396559][ T8985] bridge0: port 1(bridge_slave_0) entered blocking state [ 239.403875][ T8985] bridge0: port 1(bridge_slave_0) entered disabled state [ 239.411743][ T8985] device bridge_slave_0 entered promiscuous mode [ 239.419790][ T8985] bridge0: port 2(bridge_slave_1) entered blocking state [ 239.426988][ T8985] bridge0: port 2(bridge_slave_1) entered disabled state [ 239.435337][ T8985] device bridge_slave_1 entered promiscuous mode [ 239.447679][ T8959] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 239.455532][ T8959] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 239.536267][ T8961] device hsr_slave_0 entered promiscuous mode [ 239.594141][ T8961] device hsr_slave_1 entered promiscuous mode [ 239.632715][ T8961] debugfs: Directory 'hsr0' with parent '/' already present! [ 239.673891][ T8954] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 239.817199][ T8985] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 239.958676][ T8957] 8021q: adding VLAN 0 to HW filter on device bond0 [ 240.053813][ T8985] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 240.199508][ T8957] 8021q: adding VLAN 0 to HW filter on device team0 [ 240.263055][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 240.271133][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 240.411952][ T9004] chnl_net:caif_netlink_parms(): no params data found [ 240.453591][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 240.489481][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 240.508780][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 240.516007][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 240.674902][ T8985] team0: Port device team_slave_0 added [ 240.744426][ T8959] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 240.788065][ T8959] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 240.853469][ T8959] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 240.862001][ T8959] bridge0: port 2(bridge_slave_1) entered blocking state [ 240.869212][ T8959] bridge0: port 2(bridge_slave_1) entered forwarding state 01:15:44 executing program 0: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r1 = getpid() socket$nl_route(0x10, 0x3, 0x0) tkill(r1, 0x9) socket$packet(0x11, 0x3, 0x300) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) prctl$PR_MPX_DISABLE_MANAGEMENT(0x2c) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r0, r2, 0x0, 0xedc0) perf_event_open(0x0, 0x0, 0xa, 0xffffffffffffffff, 0x0) [ 241.036926][ T8985] team0: Port device team_slave_1 added [ 241.257793][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 241.285037][ C1] hrtimer: interrupt took 43731 ns [ 241.293534][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 241.362988][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 241.434119][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 241.483009][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 241.560391][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 241.653644][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 241.662276][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 241.839478][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 241.913427][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 241.999491][ T8963] 8021q: adding VLAN 0 to HW filter on device bond0 [ 242.074537][ T8957] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 242.123137][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 242.155722][ T8961] 8021q: adding VLAN 0 to HW filter on device bond0 [ 242.200116][ T9004] bridge0: port 1(bridge_slave_0) entered blocking state [ 242.229524][ T9004] bridge0: port 1(bridge_slave_0) entered disabled state [ 242.269653][ T9004] device bridge_slave_0 entered promiscuous mode [ 242.334631][ T9004] bridge0: port 2(bridge_slave_1) entered blocking state [ 242.341807][ T9004] bridge0: port 2(bridge_slave_1) entered disabled state [ 242.350510][ T9004] device bridge_slave_1 entered promiscuous mode [ 242.361698][ T8959] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 242.375962][ T8959] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 01:15:45 executing program 0: socket$alg(0x26, 0x5, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair(0x0, 0x1b4e20d9b2321cfa, 0x0, 0x0) r0 = socket$kcm(0x10, 0x3, 0x0) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="23000000420081aee405e9a4000000000000c6ff07d800400300"/35, 0x23}], 0x1}, 0x0) recvmsg$kcm(r0, &(0x7f0000001740)={0x0, 0xfffffffffffffd7c, &(0x7f0000000140)=[{&(0x7f0000000180)=""/101, 0x65}, {&(0x7f0000000280)=""/91, 0x5}, {&(0x7f0000000300)=""/4096, 0x1000}], 0x3}, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000019c0)='/dev/sequencer\x00', 0x1, 0x0) write$sndseq(r1, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @quote}], 0xff33) ioctl$KVM_PPC_ALLOCATE_HTAB(0xffffffffffffffff, 0xc004aea7, 0x0) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) socket$kcm(0xa, 0x6, 0x0) [ 242.436648][ T8985] device hsr_slave_0 entered promiscuous mode [ 242.493155][ T8985] device hsr_slave_1 entered promiscuous mode [ 242.532648][ T8985] debugfs: Directory 'hsr0' with parent '/' already present! [ 242.550380][ T8963] 8021q: adding VLAN 0 to HW filter on device team0 [ 242.603943][ T8957] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 242.621305][ T8961] 8021q: adding VLAN 0 to HW filter on device team0 [ 242.642699][ T9004] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link 01:15:46 executing program 0: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x50000}]}) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, 0x0, 0x0) [ 242.659360][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 242.680490][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 242.705594][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 242.733407][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 242.741280][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 242.761035][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 242.770456][ T9002] bridge0: port 1(bridge_slave_0) entered blocking state [ 242.777598][ T9002] bridge0: port 1(bridge_slave_0) entered forwarding state [ 242.803106][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 242.812025][ T9002] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 242.833323][ T9002] bridge0: port 2(bridge_slave_1) entered blocking state [ 242.840461][ T9002] bridge0: port 2(bridge_slave_1) entered forwarding state [ 242.864814][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 242.873442][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 242.899871][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 242.923447][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 242.930551][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 242.983798][ T9004] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 243.039436][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 243.053647][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready 01:15:46 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x1, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000440)='clear_refs\x00\xb0I\v8e\x84V\x1f\x13.\xd2e\xc6\xd1\x00x\xe6\fK\xa3/\xd7\xb9Iq\\\xcb\xe8\fW\xafYt|a\xa3\x16\x19\xcb\xaf\xea\x03O[k\xb1S2\x86\v\x9f\x14\xc6T\xd1\x01$\x84\xf5\xc9\xd8\xed\xca\xd2\xf0s\xe0\xcaPx\xfcd\xd3\x8d\x1e){\x9df\xa7\x14R\xb9,\xaegV\x96!n\b\xf2\x1e\x87\xb8\xb5M\xa0\xd1\xb5\xf3\xb4\xd6\xf8\xca\xf3J\x15\xed+,\xac\xfc\xbfX\x12\x97\xb3\x1b\xea\xfa\xff\xb7gx\xa1\x96\xad\x93\xaa=/\x89\x06r\b\'Ho\xf7\x88B7e\bU\'\x83\xf0\x9c\xbf\xdc7\xf8;\xea}\xa8\x9fvs\xc4\xd36\t\x1eu7L\xe0\xb0~?\xdb\xf9t]5\x0e\xe0\xad\xa2_\xadL\xe6\xc4\xed\\\x85:5\b\x9b\xa0.h|\x84\x05\x00\xdd5\x0e\xb1\x18\x06\xbf\xe2\xd61\xc1\xa0-\x18\x12\xba\xa2\xf1\xc2D\x92\xd4\xc5\xf7$\x18\x8a\b/\x8e\xa2\xf07\xa9\x05x\xa91\xd6\x9f\x15\x18vX\x9b\xa4\x95\x83\xd0\xee\x92\xb1\xcb&y\xa7F\xb2\x8fsp{\xb64\xd4!\xf5d_\xea ;\x11\a\xd0\x18\xa8\xba\x1f\x95\xa5\xa6{f\xb2\xd2\x9f') r1 = syz_open_procfs(0x0, 0x0) sendfile(r0, r1, &(0x7f0000000140)=0x1, 0x400000000040) openat$dlm_plock(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/dlm_plock\x00', 0xa0802, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='clear_refs\x00\xb0I\v8e\x84V\x1f\x13.\xd2e\xc6\xd1\x00x\xe6\fK\xa3/\xd7\xb9Iq\\\xcb\xe8\fW\xafYt|a\xa3\x16\x19\xcb\xaf\xea\x03O[k\xb1S2\x86\v\x9f\x14\xc6T\xd1\x01$\x84\xf5\xc9\xd8\xed\xca\xd2\xf0s\xe0\xcaPx\xfcd\xd3\x8d\x1e){\x9df\xa7\x14R\xb9,\xaegV\x96!n\b\xf2\x1e\x87\xb8\xb5M\xa0\xd1\xb5\xf3\xb4\xd6\xf8\xca\xf3J\x15\xed+,\xac\xfc\xbfX\x12\x97\xb3\x1b\xea\xfa\xff\xb7gx\xa1\x96\xad\x93\xaa=/\x89\x06r\b\'Ho\xf7\x88B7e\bU\'\x83\xf0\x9c\xbf\xdc7\xf8;\xea}\xa8\x9fvs\xc4\xd36\t\x1eu7L\xe0\xb0~?\xdb\xf9t]5\x0e\xe0\xad\xa2_\xadL\xe6\xc4\xed\\\x85:5\b\x9b\xa0.h|\x84\x05\x00\xdd5\x0e\xb1\x18\x06\xbf\xe2\xd61\xc1\xa0-\x18\x12\xba\xa2\xf1\xc2D\x92\xd4\xc5\xf7$\x18\x8a\b/\x8e\xa2\xf07\xa9\x05x\xa91\xd6\x9f\x15\x18vX\x9b\xa4\x95\x83\xd0\xee\x92\xb1\xcb&y\xa7F\xb2\x8fsp{\xb64\xd4!\xf5d_\xea ;\x11\a\xd0\x18\xa8\xba\x1f\x95\xa5\xa6{f\xb2\xd2\x9f') r3 = syz_open_procfs(0x0, &(0x7f0000000040)='oom_score\x00') sendfile(r2, r3, &(0x7f0000000140), 0x400000000040) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f00000006c0)={{{@in=@multicast1, @in6=@loopback}}, {{@in6}, 0x0, @in6=@dev}}, &(0x7f0000000240)=0xe8) ioctl$VIDIOC_S_EDID(0xffffffffffffffff, 0xc0285629, 0x0) open(0x0, 0x0, 0x0) getxattr(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)=@known='com.apple.FinderInfo\x00', &(0x7f0000000180)=""/38, 0x26) r4 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r5 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r5, 0xc0184900, &(0x7f0000000040)={0xa925, 0x2b, 0x0, 0xffffffffffffffff}) r7 = dup(r6) ioctl$PIO_SCRNMAP(0xffffffffffffffff, 0x4b41, &(0x7f00000001c0)="814be8c88c833c3723aecf61a319de93e444660561cb07afe83ab39eb98f80b6e99aaa95c9730ed9598633b8727f025e22a65390632c7275accf06748bc2442b0eadb04c74a50074dd6f0e480351ad0773d55aa22d2f") ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f00000000c0)={0x0, 0x0, r7}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000140)=0x1, 0x400000000040) socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'poly1305-simd\x00'}, 0x58) pipe(0x0) [ 243.118512][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 243.189044][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 243.229212][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 243.236390][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 243.292970][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 243.349334][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 243.369675][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 243.465869][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 243.493892][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready 01:15:47 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x1, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000440)='clear_refs\x00\xb0I\v8e\x84V\x1f\x13.\xd2e\xc6\xd1\x00x\xe6\fK\xa3/\xd7\xb9Iq\\\xcb\xe8\fW\xafYt|a\xa3\x16\x19\xcb\xaf\xea\x03O[k\xb1S2\x86\v\x9f\x14\xc6T\xd1\x01$\x84\xf5\xc9\xd8\xed\xca\xd2\xf0s\xe0\xcaPx\xfcd\xd3\x8d\x1e){\x9df\xa7\x14R\xb9,\xaegV\x96!n\b\xf2\x1e\x87\xb8\xb5M\xa0\xd1\xb5\xf3\xb4\xd6\xf8\xca\xf3J\x15\xed+,\xac\xfc\xbfX\x12\x97\xb3\x1b\xea\xfa\xff\xb7gx\xa1\x96\xad\x93\xaa=/\x89\x06r\b\'Ho\xf7\x88B7e\bU\'\x83\xf0\x9c\xbf\xdc7\xf8;\xea}\xa8\x9fvs\xc4\xd36\t\x1eu7L\xe0\xb0~?\xdb\xf9t]5\x0e\xe0\xad\xa2_\xadL\xe6\xc4\xed\\\x85:5\b\x9b\xa0.h|\x84\x05\x00\xdd5\x0e\xb1\x18\x06\xbf\xe2\xd61\xc1\xa0-\x18\x12\xba\xa2\xf1\xc2D\x92\xd4\xc5\xf7$\x18\x8a\b/\x8e\xa2\xf07\xa9\x05x\xa91\xd6\x9f\x15\x18vX\x9b\xa4\x95\x83\xd0\xee\x92\xb1\xcb&y\xa7F\xb2\x8fsp{\xb64\xd4!\xf5d_\xea ;\x11\a\xd0\x18\xa8\xba\x1f\x95\xa5\xa6{f\xb2\xd2\x9f') r1 = syz_open_procfs(0x0, 0x0) sendfile(r0, r1, &(0x7f0000000140)=0x1, 0x400000000040) openat$dlm_plock(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/dlm_plock\x00', 0xa0802, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='clear_refs\x00\xb0I\v8e\x84V\x1f\x13.\xd2e\xc6\xd1\x00x\xe6\fK\xa3/\xd7\xb9Iq\\\xcb\xe8\fW\xafYt|a\xa3\x16\x19\xcb\xaf\xea\x03O[k\xb1S2\x86\v\x9f\x14\xc6T\xd1\x01$\x84\xf5\xc9\xd8\xed\xca\xd2\xf0s\xe0\xcaPx\xfcd\xd3\x8d\x1e){\x9df\xa7\x14R\xb9,\xaegV\x96!n\b\xf2\x1e\x87\xb8\xb5M\xa0\xd1\xb5\xf3\xb4\xd6\xf8\xca\xf3J\x15\xed+,\xac\xfc\xbfX\x12\x97\xb3\x1b\xea\xfa\xff\xb7gx\xa1\x96\xad\x93\xaa=/\x89\x06r\b\'Ho\xf7\x88B7e\bU\'\x83\xf0\x9c\xbf\xdc7\xf8;\xea}\xa8\x9fvs\xc4\xd36\t\x1eu7L\xe0\xb0~?\xdb\xf9t]5\x0e\xe0\xad\xa2_\xadL\xe6\xc4\xed\\\x85:5\b\x9b\xa0.h|\x84\x05\x00\xdd5\x0e\xb1\x18\x06\xbf\xe2\xd61\xc1\xa0-\x18\x12\xba\xa2\xf1\xc2D\x92\xd4\xc5\xf7$\x18\x8a\b/\x8e\xa2\xf07\xa9\x05x\xa91\xd6\x9f\x15\x18vX\x9b\xa4\x95\x83\xd0\xee\x92\xb1\xcb&y\xa7F\xb2\x8fsp{\xb64\xd4!\xf5d_\xea ;\x11\a\xd0\x18\xa8\xba\x1f\x95\xa5\xa6{f\xb2\xd2\x9f') r3 = syz_open_procfs(0x0, &(0x7f0000000040)='oom_score\x00') sendfile(r2, r3, &(0x7f0000000140), 0x400000000040) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f00000006c0)={{{@in=@multicast1, @in6=@loopback}}, {{@in6}, 0x0, @in6=@dev}}, &(0x7f0000000240)=0xe8) ioctl$VIDIOC_S_EDID(0xffffffffffffffff, 0xc0285629, 0x0) open(0x0, 0x0, 0x0) getxattr(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)=@known='com.apple.FinderInfo\x00', &(0x7f0000000180)=""/38, 0x26) r4 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r5 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r5, 0xc0184900, &(0x7f0000000040)={0xa925, 0x2b, 0x0, 0xffffffffffffffff}) r7 = dup(r6) ioctl$PIO_SCRNMAP(0xffffffffffffffff, 0x4b41, &(0x7f00000001c0)="814be8c88c833c3723aecf61a319de93e444660561cb07afe83ab39eb98f80b6e99aaa95c9730ed9598633b8727f025e22a65390632c7275accf06748bc2442b0eadb04c74a50074dd6f0e480351ad0773d55aa22d2f") ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f00000000c0)={0x0, 0x0, r7}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000140)=0x1, 0x400000000040) socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'poly1305-simd\x00'}, 0x58) pipe(0x0) [ 243.553177][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 243.593285][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 243.633623][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 243.653569][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 243.662301][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 243.698049][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 243.725497][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 243.757969][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 243.777835][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 243.794464][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 243.815937][ T8963] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 243.869440][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 243.909140][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 243.927878][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 243.963300][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 244.004031][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready 01:15:47 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x1, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000440)='clear_refs\x00\xb0I\v8e\x84V\x1f\x13.\xd2e\xc6\xd1\x00x\xe6\fK\xa3/\xd7\xb9Iq\\\xcb\xe8\fW\xafYt|a\xa3\x16\x19\xcb\xaf\xea\x03O[k\xb1S2\x86\v\x9f\x14\xc6T\xd1\x01$\x84\xf5\xc9\xd8\xed\xca\xd2\xf0s\xe0\xcaPx\xfcd\xd3\x8d\x1e){\x9df\xa7\x14R\xb9,\xaegV\x96!n\b\xf2\x1e\x87\xb8\xb5M\xa0\xd1\xb5\xf3\xb4\xd6\xf8\xca\xf3J\x15\xed+,\xac\xfc\xbfX\x12\x97\xb3\x1b\xea\xfa\xff\xb7gx\xa1\x96\xad\x93\xaa=/\x89\x06r\b\'Ho\xf7\x88B7e\bU\'\x83\xf0\x9c\xbf\xdc7\xf8;\xea}\xa8\x9fvs\xc4\xd36\t\x1eu7L\xe0\xb0~?\xdb\xf9t]5\x0e\xe0\xad\xa2_\xadL\xe6\xc4\xed\\\x85:5\b\x9b\xa0.h|\x84\x05\x00\xdd5\x0e\xb1\x18\x06\xbf\xe2\xd61\xc1\xa0-\x18\x12\xba\xa2\xf1\xc2D\x92\xd4\xc5\xf7$\x18\x8a\b/\x8e\xa2\xf07\xa9\x05x\xa91\xd6\x9f\x15\x18vX\x9b\xa4\x95\x83\xd0\xee\x92\xb1\xcb&y\xa7F\xb2\x8fsp{\xb64\xd4!\xf5d_\xea ;\x11\a\xd0\x18\xa8\xba\x1f\x95\xa5\xa6{f\xb2\xd2\x9f') r1 = syz_open_procfs(0x0, 0x0) sendfile(r0, r1, &(0x7f0000000140)=0x1, 0x400000000040) openat$dlm_plock(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/dlm_plock\x00', 0xa0802, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='clear_refs\x00\xb0I\v8e\x84V\x1f\x13.\xd2e\xc6\xd1\x00x\xe6\fK\xa3/\xd7\xb9Iq\\\xcb\xe8\fW\xafYt|a\xa3\x16\x19\xcb\xaf\xea\x03O[k\xb1S2\x86\v\x9f\x14\xc6T\xd1\x01$\x84\xf5\xc9\xd8\xed\xca\xd2\xf0s\xe0\xcaPx\xfcd\xd3\x8d\x1e){\x9df\xa7\x14R\xb9,\xaegV\x96!n\b\xf2\x1e\x87\xb8\xb5M\xa0\xd1\xb5\xf3\xb4\xd6\xf8\xca\xf3J\x15\xed+,\xac\xfc\xbfX\x12\x97\xb3\x1b\xea\xfa\xff\xb7gx\xa1\x96\xad\x93\xaa=/\x89\x06r\b\'Ho\xf7\x88B7e\bU\'\x83\xf0\x9c\xbf\xdc7\xf8;\xea}\xa8\x9fvs\xc4\xd36\t\x1eu7L\xe0\xb0~?\xdb\xf9t]5\x0e\xe0\xad\xa2_\xadL\xe6\xc4\xed\\\x85:5\b\x9b\xa0.h|\x84\x05\x00\xdd5\x0e\xb1\x18\x06\xbf\xe2\xd61\xc1\xa0-\x18\x12\xba\xa2\xf1\xc2D\x92\xd4\xc5\xf7$\x18\x8a\b/\x8e\xa2\xf07\xa9\x05x\xa91\xd6\x9f\x15\x18vX\x9b\xa4\x95\x83\xd0\xee\x92\xb1\xcb&y\xa7F\xb2\x8fsp{\xb64\xd4!\xf5d_\xea ;\x11\a\xd0\x18\xa8\xba\x1f\x95\xa5\xa6{f\xb2\xd2\x9f') r3 = syz_open_procfs(0x0, &(0x7f0000000040)='oom_score\x00') sendfile(r2, r3, &(0x7f0000000140), 0x400000000040) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f00000006c0)={{{@in=@multicast1, @in6=@loopback}}, {{@in6}, 0x0, @in6=@dev}}, &(0x7f0000000240)=0xe8) ioctl$VIDIOC_S_EDID(0xffffffffffffffff, 0xc0285629, 0x0) open(0x0, 0x0, 0x0) getxattr(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)=@known='com.apple.FinderInfo\x00', &(0x7f0000000180)=""/38, 0x26) r4 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r5 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r5, 0xc0184900, &(0x7f0000000040)={0xa925, 0x2b, 0x0, 0xffffffffffffffff}) r7 = dup(r6) ioctl$PIO_SCRNMAP(0xffffffffffffffff, 0x4b41, &(0x7f00000001c0)="814be8c88c833c3723aecf61a319de93e444660561cb07afe83ab39eb98f80b6e99aaa95c9730ed9598633b8727f025e22a65390632c7275accf06748bc2442b0eadb04c74a50074dd6f0e480351ad0773d55aa22d2f") ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f00000000c0)={0x0, 0x0, r7}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000140)=0x1, 0x400000000040) socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'poly1305-simd\x00'}, 0x58) pipe(0x0) [ 244.063293][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 244.084586][ T8961] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 244.136072][ T9004] team0: Port device team_slave_0 added [ 244.196421][ T9004] team0: Port device team_slave_1 added [ 244.230894][ T9030] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 01:15:47 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x1, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000440)='clear_refs\x00\xb0I\v8e\x84V\x1f\x13.\xd2e\xc6\xd1\x00x\xe6\fK\xa3/\xd7\xb9Iq\\\xcb\xe8\fW\xafYt|a\xa3\x16\x19\xcb\xaf\xea\x03O[k\xb1S2\x86\v\x9f\x14\xc6T\xd1\x01$\x84\xf5\xc9\xd8\xed\xca\xd2\xf0s\xe0\xcaPx\xfcd\xd3\x8d\x1e){\x9df\xa7\x14R\xb9,\xaegV\x96!n\b\xf2\x1e\x87\xb8\xb5M\xa0\xd1\xb5\xf3\xb4\xd6\xf8\xca\xf3J\x15\xed+,\xac\xfc\xbfX\x12\x97\xb3\x1b\xea\xfa\xff\xb7gx\xa1\x96\xad\x93\xaa=/\x89\x06r\b\'Ho\xf7\x88B7e\bU\'\x83\xf0\x9c\xbf\xdc7\xf8;\xea}\xa8\x9fvs\xc4\xd36\t\x1eu7L\xe0\xb0~?\xdb\xf9t]5\x0e\xe0\xad\xa2_\xadL\xe6\xc4\xed\\\x85:5\b\x9b\xa0.h|\x84\x05\x00\xdd5\x0e\xb1\x18\x06\xbf\xe2\xd61\xc1\xa0-\x18\x12\xba\xa2\xf1\xc2D\x92\xd4\xc5\xf7$\x18\x8a\b/\x8e\xa2\xf07\xa9\x05x\xa91\xd6\x9f\x15\x18vX\x9b\xa4\x95\x83\xd0\xee\x92\xb1\xcb&y\xa7F\xb2\x8fsp{\xb64\xd4!\xf5d_\xea ;\x11\a\xd0\x18\xa8\xba\x1f\x95\xa5\xa6{f\xb2\xd2\x9f') r1 = syz_open_procfs(0x0, 0x0) sendfile(r0, r1, &(0x7f0000000140)=0x1, 0x400000000040) openat$dlm_plock(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/dlm_plock\x00', 0xa0802, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='clear_refs\x00\xb0I\v8e\x84V\x1f\x13.\xd2e\xc6\xd1\x00x\xe6\fK\xa3/\xd7\xb9Iq\\\xcb\xe8\fW\xafYt|a\xa3\x16\x19\xcb\xaf\xea\x03O[k\xb1S2\x86\v\x9f\x14\xc6T\xd1\x01$\x84\xf5\xc9\xd8\xed\xca\xd2\xf0s\xe0\xcaPx\xfcd\xd3\x8d\x1e){\x9df\xa7\x14R\xb9,\xaegV\x96!n\b\xf2\x1e\x87\xb8\xb5M\xa0\xd1\xb5\xf3\xb4\xd6\xf8\xca\xf3J\x15\xed+,\xac\xfc\xbfX\x12\x97\xb3\x1b\xea\xfa\xff\xb7gx\xa1\x96\xad\x93\xaa=/\x89\x06r\b\'Ho\xf7\x88B7e\bU\'\x83\xf0\x9c\xbf\xdc7\xf8;\xea}\xa8\x9fvs\xc4\xd36\t\x1eu7L\xe0\xb0~?\xdb\xf9t]5\x0e\xe0\xad\xa2_\xadL\xe6\xc4\xed\\\x85:5\b\x9b\xa0.h|\x84\x05\x00\xdd5\x0e\xb1\x18\x06\xbf\xe2\xd61\xc1\xa0-\x18\x12\xba\xa2\xf1\xc2D\x92\xd4\xc5\xf7$\x18\x8a\b/\x8e\xa2\xf07\xa9\x05x\xa91\xd6\x9f\x15\x18vX\x9b\xa4\x95\x83\xd0\xee\x92\xb1\xcb&y\xa7F\xb2\x8fsp{\xb64\xd4!\xf5d_\xea ;\x11\a\xd0\x18\xa8\xba\x1f\x95\xa5\xa6{f\xb2\xd2\x9f') r3 = syz_open_procfs(0x0, &(0x7f0000000040)='oom_score\x00') sendfile(r2, r3, &(0x7f0000000140), 0x400000000040) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f00000006c0)={{{@in=@multicast1, @in6=@loopback}}, {{@in6}, 0x0, @in6=@dev}}, &(0x7f0000000240)=0xe8) ioctl$VIDIOC_S_EDID(0xffffffffffffffff, 0xc0285629, 0x0) open(0x0, 0x0, 0x0) getxattr(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)=@known='com.apple.FinderInfo\x00', &(0x7f0000000180)=""/38, 0x26) r4 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r5 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r5, 0xc0184900, &(0x7f0000000040)={0xa925, 0x2b, 0x0, 0xffffffffffffffff}) r7 = dup(r6) ioctl$PIO_SCRNMAP(0xffffffffffffffff, 0x4b41, &(0x7f00000001c0)="814be8c88c833c3723aecf61a319de93e444660561cb07afe83ab39eb98f80b6e99aaa95c9730ed9598633b8727f025e22a65390632c7275accf06748bc2442b0eadb04c74a50074dd6f0e480351ad0773d55aa22d2f") ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f00000000c0)={0x0, 0x0, r7}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000140)=0x1, 0x400000000040) socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'poly1305-simd\x00'}, 0x58) pipe(0x0) [ 244.251456][ T9030] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 244.336073][ T8963] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 244.418681][ T9030] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 244.437695][ T9030] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 244.468796][ T8961] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 244.671843][ T9004] device hsr_slave_0 entered promiscuous mode 01:15:48 executing program 1: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_POWER(r0, 0x11, 0x9, 0x0, 0x0) [ 244.728959][ T9004] device hsr_slave_1 entered promiscuous mode [ 244.802773][ T9004] debugfs: Directory 'hsr0' with parent '/' already present! [ 244.830353][ T8985] 8021q: adding VLAN 0 to HW filter on device bond0 [ 244.910998][ T8985] 8021q: adding VLAN 0 to HW filter on device team0 [ 244.935949][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 244.950958][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 244.977736][ T9180] IPVS: ftp: loaded support on port[0] = 21 01:15:48 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x13102001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) poll(0x0, 0x0, 0x8000000000000200) r0 = memfd_create(&(0x7f0000000540)='\x97&\x89\\\xd0\xe7\xca\x16ZO\x94:\xe1\x01\xe5`iq@Nse;\xa8Fpj\x0e\x04!\xd5\xc5YBz\x94\xaf\x13\xe9\xd2\x0f\xc2G\x86Xe\xf1/V\x8cvS\xa6K&u\x9dX\xcc\r\x12\x11\x99\xe7\xce\xaeA\xb8-E\xa1\xf8\xe4~IS\xc1\x04\xf78\xf1\'\xdfv\x90\xbc\xd1\xda\x88j\x16\xeb>\x8c\xa1\x03\xf3\xaf\xfd\xf4&a?\xcaG\n\xe5j\x9b}\xc6G\x86\xb2\xdeY\x17yX $\xfcU\x9d\x80dX\xcc\xab\x84\xd1\x01_\x7f\xf4tW.\x81\n\xf3\v\x8d\x12pa\x91\x9b\x8cxd\x06\xa7k\n\x86\xc3\xb6\x910\xf2L\xf0\xaf\xe1jd\xda\x1f\x8bVrd\xa4\xb34\xfcUj\x1ad:#\x96\xf9\xd3\x1c]ImZlU\".\x18)\xcf\x1am\xd5\xe0\xdb\xdc\xd7\x8e\xe0\xa3\x82\xec\x9b\xfb\xc9\x81\x9c\xdc\xb7\x0f\xdd\xd3\xd7\xbe\x89\x7f3\x1d\x1c@\x8eu\x85\xces\x89\x95&3FX\xb1\xaf\xa6\x96\xa2\x13\x1f-\b\xcf', 0x0) fcntl$setown(0xffffffffffffffff, 0x8, 0x0) execveat(r0, &(0x7f0000000500)='\x00', 0x0, 0x0, 0x1000) ioperm(0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) socket(0x0, 0x0, 0x0) [ 245.071068][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 245.103391][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 245.112080][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 245.119224][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 245.250181][ T9127] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 245.267230][ T9127] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 245.286711][ T9209] ERROR: Domain ' /sbin/init /etc/init.d/rc /sbin/startpar /etc/init.d/ssh /sbin/start-stop-daemon /usr/sbin/sshd /usr/sbin/sshd /bin/bash /root/syz-fuzzer /root/syz-executor.2 proc:/self/fd/4' not defined. [ 245.328804][ T9127] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 245.354613][ T9127] bridge0: port 2(bridge_slave_1) entered blocking state [ 245.361717][ T9127] bridge0: port 2(bridge_slave_1) entered forwarding state [ 245.431242][ T9127] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 245.528929][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 245.550282][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 245.591611][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 245.631614][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 245.661748][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 245.688888][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 245.724690][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 245.767831][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 245.792292][ T9216] IPVS: ftp: loaded support on port[0] = 21 [ 245.815844][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 245.935766][ T8985] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 245.964307][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 246.136694][ T8985] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 246.180578][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 246.188675][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 246.279656][ T9004] 8021q: adding VLAN 0 to HW filter on device bond0 [ 246.361816][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 246.386653][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 246.428955][ T9004] 8021q: adding VLAN 0 to HW filter on device team0 [ 246.493451][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 246.502218][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 246.539675][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 246.546870][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 246.584479][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 246.632181][ T3609] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 246.642355][ T3609] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 246.658489][ T3609] bridge0: port 2(bridge_slave_1) entered blocking state [ 246.665659][ T3609] bridge0: port 2(bridge_slave_1) entered forwarding state [ 246.680983][ T3609] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 246.691267][ T3609] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 246.706829][ T3609] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 246.718407][ T3609] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 246.731631][ T3609] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 246.781073][ T9004] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 246.809001][ T9004] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 246.842269][ T9030] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 246.858266][ T9030] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 246.870140][ T9030] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 246.886161][ T9030] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 246.914758][ T9030] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 246.930989][ T9030] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 246.948720][ T9030] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 246.984581][ T9004] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 246.991863][ T9030] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 247.001244][ T9030] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready 01:15:52 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000000)='xfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x10, 0x0) 01:15:52 executing program 1: syz_open_dev$vcsa(0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000003f000/0x18000)=nil, &(0x7f0000000240)=[@textreal={0x8, &(0x7f0000000280)="f2a767f26e3ed9f526660f380ba70c00ba4200b000ee0f009a7c17f20f1c8700000f08b880038ed8b800038ee0", 0x2d}], 0x1, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc5e]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) listxattr(0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) 01:15:52 executing program 2: syz_open_dev$adsp(&(0x7f0000001340)='/dev/adsp#\x00', 0x1, 0x0) 01:15:52 executing program 0: r0 = socket$inet6(0xa, 0x3, 0x89) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@loopback, 0x0, 0x2b}, 0x0, @in=@loopback, 0x0, 0x0, 0x0, 0xfffffffffffffffe}}, 0xe8) connect$inet6(r0, &(0x7f0000000480)={0xa, 0x0, 0x0, @ipv4={[], [], @local}}, 0x1c) 01:15:52 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000600)={0x2, 0x4e20, @multicast1}, 0x10) connect$inet(r2, &(0x7f0000000000)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20008800, &(0x7f00000000c0)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r2, &(0x7f0000000180), 0x144, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f0000001a80)=[{{&(0x7f0000000300)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @broadcast}}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000480)=""/237, 0xed}, {&(0x7f0000000740)=""/146, 0x7a}], 0x2}}, {{0x0, 0x0, 0x0}}], 0x2, 0x10022, 0x0) 01:15:52 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x7) [ 249.003443][ T9255] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 249.015110][ T9256] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 249.066605][ T9259] sp0: Synchronizing with TNC 01:15:52 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000340)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302c75"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000000)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x26f) mount$9p_fd(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)='9p\x00', 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) chdir(&(0x7f0000000040)='./file0\x00') readv(r0, &(0x7f0000000100)=[{&(0x7f0000001480)=""/206, 0xce}, {&(0x7f0000000280)=""/180, 0xb4}], 0x2) open(&(0x7f0000000080)='./file0\x00', 0x40c5, 0x0) 01:15:52 executing program 2: syz_open_procfs(0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x4249, 0x0, 0xff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0xbcc, 0x40000) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000003f000/0x18000)=nil, &(0x7f0000000240)=[@textreal={0x8, &(0x7f0000000280)="f2a767f26e3ed9f526660f380ba70c00ba4200b000ee0f009a7c17f20f1c8700000f08b880038ed8b800038ee0", 0x2d}], 0x1, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc5e]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) listxattr(0x0, 0x0, 0x0) 01:15:52 executing program 4: setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x77, 0x1) ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000080)={0x0, 0x3, 0x1, 0x0, 0x0, 0x0, 0x0}) 01:15:52 executing program 1: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3, 0xfffffffffffffffe}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x98) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @empty}, 0x3f) sendmmsg$inet_sctp(r0, &(0x7f00000003c0), 0x3a301e0909ff6cd, 0x934) [ 249.334594][ T9262] XFS (loop3): Invalid superblock magic number 01:15:52 executing program 0: clock_gettime(0x6, 0x0) 01:15:52 executing program 5: socket$nl_route(0x10, 0x3, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x40c5, 0x0) open$dir(0x0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0) faccessat(r0, &(0x7f0000000180)='./file0\x00', 0x80200000001, 0x0) 01:15:53 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000003f000/0x18000)=nil, &(0x7f0000000240)=[@textreal={0x8, &(0x7f0000000280)="f2a767f26e3ed9f526660f380ba70c00ba4200b000ee0f009a7c17f20f1c8700000f08b880038ed8b800038ee0", 0x2d}], 0x1, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc5e]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 01:15:53 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000000)='xfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x10, 0x0) 01:15:53 executing program 5: ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(0xffffffffffffffff, 0xc05c5340, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0xffffff88, 0x0}}], 0x1, 0x0, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0xffffffffffffffba, 0x0, 0x0, 0xb2) r0 = syz_open_procfs(0x0, &(0x7f0000000600)='net/fib_trie\x00') preadv(r0, &(0x7f00000017c0), 0x199, 0x0) 01:15:53 executing program 0: syz_open_procfs(0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(0xffffffffffffffff, 0xc05c5340, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0xffffff88, 0x0}}], 0x1, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, 0x0, 0xffffffffffffffba, 0x0, 0x0, 0xb2) r1 = syz_open_procfs(0x0, &(0x7f0000000600)='net/fib_trie\x00') r2 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r2, 0x40087703, 0x100000002) dup2(r2, r0) preadv(r1, &(0x7f00000017c0), 0x199, 0x0) 01:15:53 executing program 1: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3, 0xfffffffffffffffe}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x98) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @empty}, 0x3f) sendmmsg$inet_sctp(r0, &(0x7f00000003c0), 0x3a301e0909ff6cd, 0x934) 01:15:53 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)) r1 = syz_open_pts(r0, 0x1) fcntl$setstatus(r1, 0x4, 0x102800) write(r1, &(0x7f0000000000)="d5", 0xfffffdc9) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r3, r2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000001c0)=0xf) dup3(r1, r0, 0x0) 01:15:53 executing program 0: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x98) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @empty}, 0x3f) sendmmsg$inet_sctp(r0, &(0x7f00000003c0), 0x3a301e0909ff6cd, 0x934) 01:15:53 executing program 2: syz_open_procfs(0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x4249, 0x0, 0xff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0xbcc, 0x40000) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000003f000/0x18000)=nil, &(0x7f0000000240)=[@textreal={0x8, &(0x7f0000000280)="f2a767f26e3ed9f526660f380ba70c00ba4200b000ee0f009a7c17f20f1c8700000f08b880038ed8b800038ee0", 0x2d}], 0x1, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc5e]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) listxattr(0x0, 0x0, 0x0) [ 250.244043][ T9319] XFS (loop3): Invalid superblock magic number 01:15:53 executing program 4: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x50000}]}) 01:15:54 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x2000107, 0x6031, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00002, 0x0, 0x0, 0x0, 0x2000000000002) 01:15:54 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_int(r0, 0x29, 0x35, 0x0, &(0x7f0000000000)) 01:15:54 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000000)='xfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x10, 0x0) 01:15:54 executing program 5: r0 = openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self//exe\x00', 0x3, 0x0) fchown(r0, 0x0, 0x0) 01:15:54 executing program 1: r0 = gettid() clone(0x13102001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) poll(0x0, 0x0, 0x8000000000000200) r1 = memfd_create(&(0x7f0000000540)='\x97&\x89\\\xd0\xe7\xca\x16ZO\x94:\xe1\x01\xe5`iq@Nse;\xa8Fpj\x0e\x04!\xd5\xc5YBz\x94\xaf\x13\xe9\xd2\x0f\xc2G\x86Xe\xf1/V\x8cvS\xa6K&u\x9dX\xcc\r\x12\x11\x99\xe7\xce\xaeA\xb8-E\xa1\xf8\xe4~IS\xc1\x04\xf78\xf1\'\xdfv\x90\xbc\xd1\xda\x88j\x16\xeb>\x8c\xa1\x03\xf3\xaf\xfd\xf4&a?\xcaG\n\xe5j\x9b}\xc6G\x86\xb2\xdeY\x17yX $\xfcU\x9d\x80dX\xcc\xab\x84\xd1\x01_\x7f\xf4tW.\x81\n\xf3\v\x8d\x12pa\x91\x9b\x8cxd\x06\xa7k\n\x86\xc3\xb6\x910\xf2L\xf0\xaf\xe1jd\xda\x1f\x8bVrd\xa4\xb34\xfcUj\x1ad:#\x96\xf9\xd3\x1c]ImZlU\".\x18)\xcf\x1am\xd5\xe0\xdb\xdc\xd7\x8e\xe0\xa3\x82\xec\x9b\xfb\xc9\x81\x9c\xdc\xb7\x0f\xdd\xd3\xd7\xbe\x89\x7f3\x1d\x1c@\x8eu\x85\xces\x89\x95&3FX\xb1\xaf\xa6\x96\xa2\x13\x1f-\b\xcf', 0x0) fcntl$setlease(r1, 0x400, 0x1) fcntl$setown(r1, 0x8, 0x0) execveat(r1, &(0x7f0000000500)='\x00', 0x0, 0x0, 0x1000) timer_create(0x0, &(0x7f0000000080)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000100)) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 01:15:54 executing program 2: syz_open_procfs(0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x4249, 0x0, 0xff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0xbcc, 0x40000) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000003f000/0x18000)=nil, &(0x7f0000000240)=[@textreal={0x8, &(0x7f0000000280)="f2a767f26e3ed9f526660f380ba70c00ba4200b000ee0f009a7c17f20f1c8700000f08b880038ed8b800038ee0", 0x2d}], 0x1, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc5e]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) listxattr(0x0, 0x0, 0x0) [ 251.234239][ T9359] XFS (loop3): Invalid superblock magic number 01:15:54 executing program 0: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x98) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @empty}, 0x3f) sendmmsg$inet_sctp(r0, &(0x7f00000003c0), 0x3a301e0909ff6cd, 0x934) 01:15:54 executing program 5: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x98) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @empty}, 0x3f) sendmmsg$inet_sctp(r0, &(0x7f00000003c0), 0x3a301e0909ff6cd, 0x934) [ 251.459715][ T9375] ERROR: Domain ' /sbin/init /etc/init.d/rc /sbin/startpar /etc/init.d/ssh /sbin/start-stop-daemon /usr/sbin/sshd /usr/sbin/sshd /bin/bash /root/syz-fuzzer /root/syz-executor.1 proc:/self/fd/3' not defined. 01:15:55 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000000)='xfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x10, 0x0) 01:15:55 executing program 1: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x98) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @empty}, 0x3f) sendmmsg$inet_sctp(r0, &(0x7f00000003c0), 0x3a301e0909ff6cd, 0x934) 01:15:55 executing program 5: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x98) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @empty}, 0x3f) sendmmsg$inet_sctp(r0, &(0x7f00000003c0), 0x3a301e0909ff6cd, 0x934) 01:15:55 executing program 0: write$P9_RATTACH(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0xffffff88, 0x0}}], 0x1, 0x0, 0x0) request_key(0x0, 0x0, 0x0, 0xfffffffffffffffd) socket$inet(0x2, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000600)='net/fib_trie\x00') preadv(r0, &(0x7f00000017c0), 0x199, 0x0) [ 252.022132][ T9395] XFS (loop3): Invalid superblock magic number 01:15:56 executing program 4: r0 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x77, 0x1) ioctl$USBDEVFS_CONTROL(r0, 0x551f, 0x0) 01:15:56 executing program 2: syz_open_procfs(0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x4249, 0x0, 0xff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0xbcc, 0x40000) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000003f000/0x18000)=nil, &(0x7f0000000240)=[@textreal={0x8, &(0x7f0000000280)="f2a767f26e3ed9f526660f380ba70c00ba4200b000ee0f009a7c17f20f1c8700000f08b880038ed8b800038ee0", 0x2d}], 0x1, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc5e]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) listxattr(0x0, 0x0, 0x0) 01:15:56 executing program 5: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x98) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @empty}, 0x3f) sendmmsg$inet_sctp(r0, &(0x7f00000003c0), 0x3a301e0909ff6cd, 0x934) 01:15:56 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f0000000140)={0x18, 0x0, {0x5, @local, 'bridge0\x00'}}, 0x1e) sendmmsg(r2, &(0x7f000000d180), 0x4000000000000eb, 0x0) 01:15:56 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r0, 0x0, r0) syz_mount_image$xfs(&(0x7f0000000000)='xfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x10, 0x0) 01:15:56 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) setxattr$trusted_overlay_origin(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000280)='trusted.overlay.origin\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$overlay(0x400003, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}, {@workdir={'workdir', 0x3d, './file0'}}]}) [ 253.176689][ T9436] XFS (loop3): Invalid superblock magic number [ 253.187174][ T9446] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 01:15:56 executing program 0: r0 = gettid() r1 = creat(&(0x7f0000000280)='./file0\x00', 0x1) prctl$PR_SET_PTRACER(0x59616d61, r0) write$binfmt_script(r1, &(0x7f0000000400)=ANY=[@ANYBLOB="2321202e2f66696c653020937b63707551657476626f786e6574307d9673656c6950"], 0x22) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(r1) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) add_key(0x0, 0x0, &(0x7f00000003c0)="1693a8771021180d9977dc118776", 0xe, 0xfffffffffffffffa) 01:15:56 executing program 4: r0 = openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self//exe\x00', 0x3, 0x0) fsetxattr$security_capability(r0, &(0x7f0000000240)='security.capability\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) fchown(r0, 0x0, 0x0) 01:15:56 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) setxattr$trusted_overlay_origin(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000280)='trusted.overlay.origin\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$overlay(0x400003, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}, {@workdir={'workdir', 0x3d, './file0'}}]}) 01:15:56 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @empty}, 0x3f) sendmmsg$inet_sctp(r0, &(0x7f00000003c0), 0x3a301e0909ff6cd, 0x0) 01:15:56 executing program 2: open(0x0, 0x0, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x99) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='stat\x00') r0 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = memfd_create(&(0x7f00000001c0)='\xb3', 0x0) write$FUSE_DIRENT(r1, &(0x7f0000000080)=ANY=[], 0x29) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x81, 0x11, r1, 0x0) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) pread64(r2, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x81, 0x8, 0x3f, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xc}}, 0x0, 0x0, r0, 0x0) 01:15:56 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r0, 0x0, r0) syz_mount_image$xfs(&(0x7f0000000000)='xfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x10, 0x0) 01:15:56 executing program 0: socket$inet6(0xa, 0x400000000001, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff001, 0x0, @perf_config_ext={0x0, 0x2}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0x9e, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x0, 0x70, 0xb8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) io_setup(0x0, &(0x7f0000000200)) clone(0x13102001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000002900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=""/28, 0x1c}}], 0x1, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/3\x00') preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) fstat(0xffffffffffffffff, &(0x7f00000002c0)) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40106614, &(0x7f0000000000)) kexec_load(0x0, 0x0, &(0x7f0000000080), 0x0) socket$inet6_udp(0xa, 0x2, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, 0xffffffffffffffff, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x101a06, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000004c0)={'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\r', 0x20000005002}) r4 = dup3(r2, r3, 0x80000) socket$inet6_udp(0xa, 0x2, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) bind$packet(r5, &(0x7f0000000640)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x14) getsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000000700)={{{@in=@local, @in6=@local}}, {{@in6=@remote}, 0x0, @in6=@ipv4={[], [], @initdev}}}, &(0x7f0000000800)=0xfffffffffffffe57) r6 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) socket$inet6_udp(0xa, 0x2, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) bind$packet(r7, &(0x7f0000000640)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x14) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000080)={@remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x8]}, 0x8}) getsockopt$inet_IP_XFRM_POLICY(r6, 0x0, 0x11, &(0x7f0000000700)={{{@in=@local, @in6=@local}}, {{@in6=@remote}, 0x0, @in6=@ipv4={[], [], @initdev}}}, 0x0) r8 = socket(0x0, 0x3, 0x0) sendto$unix(r8, 0x0, 0x0, 0x0, &(0x7f0000000040)=@abs, 0x6e) openat$tun(0xffffffffffffff9c, 0x0, 0x101a06, 0x0) syz_genetlink_get_family_id$team(&(0x7f0000000140)='team\x00') bind$inet6(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000000c0), 0xffffffeb, 0x0, 0x0, 0xfffffffffffffdf0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@dev, @in=@loopback}}, {{@in=@local}, 0x0, @in=@multicast2}}, &(0x7f00000003c0)=0xe8) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r9, 0x29, 0x2, &(0x7f00000000c0)=0xfef, 0x4) bind$inet6(r9, 0x0, 0x0) listen(r9, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000000c0), 0xffffffeb, 0x0, 0x0, 0xfffffffffffffdf0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r10, 0x29, 0x2, 0x0, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r11 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) bind$packet(r11, &(0x7f0000000640)={0x11, 0x0, r12, 0x1, 0x0, 0x6, @link_local}, 0x14) r13 = socket$packet(0x11, 0x3, 0x300) bind$packet(r13, &(0x7f0000000640)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x14) getsockname$packet(r13, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x14) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x3850f0d5951992c7, &(0x7f0000000c80)={@empty}, &(0x7f0000000cc0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000080)={@remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x8]}, 0x8}) sendmsg$TEAM_CMD_OPTIONS_GET(r8, 0x0, 0x20000000) write$P9_RWALK(r6, &(0x7f00000008c0)=ANY=[@ANYRESHEX, @ANYRESHEX, @ANYRESDEC=r1, @ANYRES32=r14, @ANYPTR], 0x40) perf_event_open(&(0x7f0000000180)={0x6, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 01:15:57 executing program 4: openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) pipe(0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0xffffff88, 0x0}}], 0x1, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, 0x0, 0xffffffffffffffba, 0x0, 0x0, 0xb2) r1 = syz_open_procfs(0x0, &(0x7f0000000600)='net/fib_trie\x00') r2 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r2, 0x40087703, 0x100000002) dup2(r2, r0) preadv(r1, &(0x7f00000017c0), 0x199, 0x0) 01:15:57 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) setxattr$trusted_overlay_origin(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000280)='trusted.overlay.origin\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$overlay(0x400003, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}, {@workdir={'workdir', 0x3d, './file0'}}]}) [ 253.844126][ T9474] XFS (loop3): Invalid superblock magic number 01:15:57 executing program 2: sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001100)=[{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000000)="7dcca5446229452f468f70d9738bc346d59400180c69283a1118f92c523bff48f7f4", 0x22}], 0x1}], 0x1, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe7000/0x18000)=nil, 0x0, 0xffffffffffffffbf, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)) bind$inet(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x20800, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r3 = getpid() tkill(r3, 0x9) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x119000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0xfefd, 0x0, 0x0, 0xfffffffffffffd9c) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 01:15:57 executing program 4: socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000140)='bridge_slave_0\x00', 0x10) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x42, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x40, 0x0) ioctl$GIO_SCRNMAP(0xffffffffffffffff, 0x4b40, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000040)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x3, 0x89) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@loopback, 0x0, 0x2b}, 0x0, @in=@loopback, 0x0, 0x0, 0x0, 0xfffffffffffffffe}}, 0xe8) connect$inet6(r1, &(0x7f0000000480)={0xa, 0x0, 0x0, @ipv4={[], [], @local}}, 0x1c) 01:15:57 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) setxattr$trusted_overlay_origin(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000280)='trusted.overlay.origin\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$overlay(0x400003, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}, {@workdir={'workdir', 0x3d, './file0'}}]}) 01:15:57 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r0, 0x0, r0) syz_mount_image$xfs(&(0x7f0000000000)='xfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x10, 0x0) 01:15:57 executing program 4: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x50000}]}) getresgid(0x0, &(0x7f0000000140)=0x0, 0x0) setfsgid(0x0) keyctl$chown(0x4, 0x0, 0x0, r0) 01:15:57 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r2, &(0x7f0000000000)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20008800, &(0x7f00000000c0)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x0, 0x0, 0x0) [ 254.463377][ T9516] XFS (loop3): Invalid superblock magic number 01:15:58 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) setxattr$trusted_overlay_origin(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000280)='trusted.overlay.origin\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400003, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}, {@workdir={'workdir', 0x3d, './file0'}}]}) [ 254.609115][ T9532] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 254.672759][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 254.678866][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 254.684738][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 254.690500][ C0] protocol 88fb is buggy, dev hsr_slave_1 01:15:58 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_LINKINFO={0x1c, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0xc, 0x2, [@IFLA_BOND_MODE={0x8, 0x1, 0x6}]}}}]}, 0x3c}}, 0x8000) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0xc01, 0x0, 0x0, {0x0, 0x0, 0x0, r3, 0x3}}, 0x20}}, 0x0) 01:15:58 executing program 3: socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000000)='xfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x10, 0x0) [ 254.868581][ T9538] overlayfs: failed to resolve './file0': -2 [ 254.992689][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 254.998545][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 255.122113][ T9545] netlink: 'syz-executor.5': attribute type 1 has an invalid length. [ 255.198616][ T9546] XFS (loop3): Invalid superblock magic number 01:15:58 executing program 0: socket$inet6(0xa, 0x400000000001, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff001, 0x0, @perf_config_ext={0x0, 0x2}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0x9e, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x0, 0x70, 0xb8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) io_setup(0x0, &(0x7f0000000200)) clone(0x13102001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000002900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=""/28, 0x1c}}], 0x1, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/3\x00') preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) fstat(0xffffffffffffffff, &(0x7f00000002c0)) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40106614, &(0x7f0000000000)) kexec_load(0x0, 0x0, &(0x7f0000000080), 0x0) socket$inet6_udp(0xa, 0x2, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, 0xffffffffffffffff, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x101a06, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000004c0)={'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\r', 0x20000005002}) r4 = dup3(r2, r3, 0x80000) socket$inet6_udp(0xa, 0x2, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) bind$packet(r5, &(0x7f0000000640)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x14) getsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000000700)={{{@in=@local, @in6=@local}}, {{@in6=@remote}, 0x0, @in6=@ipv4={[], [], @initdev}}}, &(0x7f0000000800)=0xfffffffffffffe57) r6 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) socket$inet6_udp(0xa, 0x2, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) bind$packet(r7, &(0x7f0000000640)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x14) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000080)={@remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x8]}, 0x8}) getsockopt$inet_IP_XFRM_POLICY(r6, 0x0, 0x11, &(0x7f0000000700)={{{@in=@local, @in6=@local}}, {{@in6=@remote}, 0x0, @in6=@ipv4={[], [], @initdev}}}, 0x0) r8 = socket(0x0, 0x3, 0x0) sendto$unix(r8, 0x0, 0x0, 0x0, &(0x7f0000000040)=@abs, 0x6e) openat$tun(0xffffffffffffff9c, 0x0, 0x101a06, 0x0) syz_genetlink_get_family_id$team(&(0x7f0000000140)='team\x00') bind$inet6(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000000c0), 0xffffffeb, 0x0, 0x0, 0xfffffffffffffdf0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@dev, @in=@loopback}}, {{@in=@local}, 0x0, @in=@multicast2}}, &(0x7f00000003c0)=0xe8) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r9, 0x29, 0x2, &(0x7f00000000c0)=0xfef, 0x4) bind$inet6(r9, 0x0, 0x0) listen(r9, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000000c0), 0xffffffeb, 0x0, 0x0, 0xfffffffffffffdf0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r10, 0x29, 0x2, 0x0, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r11 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) bind$packet(r11, &(0x7f0000000640)={0x11, 0x0, r12, 0x1, 0x0, 0x6, @link_local}, 0x14) r13 = socket$packet(0x11, 0x3, 0x300) bind$packet(r13, &(0x7f0000000640)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x14) getsockname$packet(r13, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x14) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x3850f0d5951992c7, &(0x7f0000000c80)={@empty}, &(0x7f0000000cc0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000080)={@remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x8]}, 0x8}) sendmsg$TEAM_CMD_OPTIONS_GET(r8, 0x0, 0x20000000) write$P9_RWALK(r6, &(0x7f00000008c0)=ANY=[@ANYRESHEX, @ANYRESHEX, @ANYRESDEC=r1, @ANYRES32=r14, @ANYPTR], 0x40) perf_event_open(&(0x7f0000000180)={0x6, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 01:15:58 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) setxattr$trusted_overlay_origin(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000280)='trusted.overlay.origin\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400003, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}, {@workdir={'workdir', 0x3d, './file0'}}]}) 01:15:58 executing program 4: r0 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r0, &(0x7f0000000140)={&(0x7f0000000040)=@nfc={0x3b, 0x3}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000200)="c1090004000000000033001aac141412e0", 0x11}], 0x1}, 0x0) 01:15:58 executing program 2: socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000140)='bridge_slave_0\x00', 0x10) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x42, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$GIO_SCRNMAP(0xffffffffffffffff, 0x4b40, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) chdir(0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000040)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x3, 0x89) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@loopback, 0x0, 0x2b}, 0x0, @in=@loopback, 0x0, 0x0, 0x0, 0xfffffffffffffffe}}, 0xe8) connect$inet6(r1, &(0x7f0000000480)={0xa, 0x0, 0x0, @ipv4={[], [], @local}}, 0x1c) creat(0x0, 0x0) 01:15:58 executing program 5: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f0000000340)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = timerfd_create(0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) [ 255.414941][ T9562] overlayfs: failed to resolve './file0': -2 01:15:58 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) setxattr$trusted_overlay_origin(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000280)='trusted.overlay.origin\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400003, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}, {@workdir={'workdir', 0x3d, './file0'}}]}) 01:15:58 executing program 4: socket$inet6_tcp(0xa, 0x1, 0x0) getpid() write(0xffffffffffffffff, &(0x7f0000000480)="b0a3cdef47f59ec515de0fcb5dfc761cf7120c4312b2054efdc0cf574f65329a05d03a2467", 0x25) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'sit0\x00', 0x0}) bind$packet(r0, &(0x7f0000000300)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @random="65ed59501ed8"}, 0x14) sendmmsg(r0, &(0x7f0000000d00), 0x400004e, 0x0) 01:15:59 executing program 3: socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000000)='xfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x10, 0x0) [ 255.577752][ T9572] overlayfs: failed to resolve './file0': -2 01:15:59 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_int(r1, 0x29, 0x4b, &(0x7f0000b67000), &(0x7f0000000000)=0x21d) 01:15:59 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") syz_mount_image$jfs(&(0x7f0000000040)='jfs\x00', &(0x7f0000000140)='./bus\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000840)={[{@discard_size={'discard'}}]}) 01:15:59 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) setxattr$trusted_overlay_origin(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000280)='trusted.overlay.origin\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$overlay(0x400003, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}, {@workdir={'workdir', 0x3d, './file0'}}]}) 01:15:59 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) r1 = creat(0x0, 0x0) ftruncate(r1, 0x208200) pipe(0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8000fffffffe) creat(0x0, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141442, 0x0) r3 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$P9_RREMOVE(r3, &(0x7f0000000000)={0x7}, 0x63f) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = dup3(0xffffffffffffffff, r4, 0x80000) ioctl$TIOCLINUX6(r5, 0x541c, 0x0) syncfs(r0) ftruncate(0xffffffffffffffff, 0x0) r6 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x8700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x800}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r7 = socket(0x0, 0x2, 0x0) dup2(r6, r7) r8 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r9 = socket(0x100000000011, 0x2, 0x0) dup2(r8, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'team_slave_1\x00'}) sendmsg$nl_route_sched(r7, 0x0, 0x0) [ 255.949327][ T9590] JFS: discard option not supported on device [ 255.970866][ T9583] XFS (loop3): Invalid superblock magic number [ 256.087068][ T9606] JFS: discard option not supported on device [ 256.134369][ T26] kauditd_printk_skb: 3 callbacks suppressed [ 256.134384][ T26] audit: type=1804 audit(1573348559.560:31): pid=9611 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir330369976/syzkaller.ALoANe/11/bus" dev="sda1" ino=16597 res=1 [ 256.200630][ T26] audit: type=1804 audit(1573348559.610:32): pid=9611 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir330369976/syzkaller.ALoANe/11/bus" dev="sda1" ino=16597 res=1 [ 256.306072][ T26] audit: type=1804 audit(1573348559.730:33): pid=9614 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir330369976/syzkaller.ALoANe/11/bus" dev="sda1" ino=16597 res=1 [ 256.351517][ T26] audit: type=1804 audit(1573348559.730:34): pid=9614 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir330369976/syzkaller.ALoANe/11/bus" dev="sda1" ino=16597 res=1 01:15:59 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r1 = openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000440)='/proc/self//exe\x00', 0x3, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) 01:15:59 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) setxattr$trusted_overlay_origin(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000280)='trusted.overlay.origin\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$overlay(0x400003, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}, {@workdir={'workdir', 0x3d, './file0'}}]}) 01:15:59 executing program 4: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3, 0xfffffffffffffffe}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x98) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000002c0)={0x0, @in={{0x2, 0x0, @multicast2}}}, 0x84) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @empty}, 0x3f) sendmmsg$inet_sctp(r0, &(0x7f00000003c0), 0x3a301e0909ff6cd, 0x934) 01:15:59 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") syz_mount_image$jfs(&(0x7f0000000040)='jfs\x00', &(0x7f0000000140)='./bus\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000840)={[{@discard_size={'discard'}}]}) 01:15:59 executing program 3: socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) syz_mount_image$xfs(&(0x7f0000000000)='xfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x10, 0x0) 01:15:59 executing program 2: pipe2(0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x50000}]}) fsetxattr(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) prctl$PR_GET_FPEXC(0xb, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) [ 256.622095][ T9633] JFS: discard option not supported on device 01:16:00 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) setxattr$trusted_overlay_origin(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000280)='trusted.overlay.origin\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$overlay(0x400003, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}, {@workdir={'workdir', 0x3d, './file0'}}]}) [ 256.699260][ T9628] XFS (loop3): Invalid superblock magic number 01:16:00 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") syz_mount_image$jfs(&(0x7f0000000040)='jfs\x00', &(0x7f0000000140)='./bus\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000840)={[{@discard_size={'discard'}}]}) 01:16:00 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0x0, 0xffffffff}) [ 256.816782][ C0] blk_update_request: I/O error, dev loop0, sector 2688 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 256.856858][ C0] blk_update_request: I/O error, dev loop0, sector 2688 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 256.868567][ C0] Buffer I/O error on dev loop0, logical block 1344, async page read [ 256.876755][ C0] blk_update_request: I/O error, dev loop0, sector 2690 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 256.887936][ C0] Buffer I/O error on dev loop0, logical block 1345, async page read [ 256.896146][ C0] blk_update_request: I/O error, dev loop0, sector 2692 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 256.908542][ C0] Buffer I/O error on dev loop0, logical block 1346, async page read 01:16:00 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x9d, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='projid_map\x00') setsockopt$inet_opts(r0, 0x0, 0x0, 0x0, 0x0) [ 256.916740][ C0] blk_update_request: I/O error, dev loop0, sector 2694 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 256.928302][ C0] Buffer I/O error on dev loop0, logical block 1347, async page read [ 257.028616][ T9657] JFS: discard option not supported on device [ 257.042410][ T9661] kasan: CONFIG_KASAN_INLINE enabled [ 257.068196][ T9661] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 257.092516][ T9661] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 257.099522][ T9661] CPU: 0 PID: 9661 Comm: syz-executor.2 Not tainted 5.4.0-rc6+ #0 [ 257.107330][ T9661] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 257.117416][ T9661] RIP: 0010:kvm_coalesced_mmio_init+0x67/0x120 [ 257.123587][ T9661] Code: 00 48 01 c3 48 89 fa 48 b8 00 00 00 00 80 88 ff ff 48 c1 fb 06 48 c1 ea 03 48 c1 e3 0c 48 01 c3 48 b8 00 00 00 00 00 fc ff df <80> 3c 02 00 0f 85 9a 00 00 00 49 89 9c 24 d8 96 00 00 48 c7 c2 60 [ 257.143199][ T9661] RSP: 0018:ffff88805f4d7c08 EFLAGS: 00010286 [ 257.149285][ T9661] RAX: dffffc0000000000 RBX: ffff8880a4c52000 RCX: ffffc9000a36f000 [ 257.157341][ T9661] RDX: 00000000000012db RSI: ffffffff8108569c RDI: 00000000000096d8 [ 257.165313][ T9661] RBP: ffff88805f4d7c18 R08: 0000000000000000 R09: ffffed1015d06b75 [ 257.173293][ T9661] R10: ffffed1015d06b74 R11: ffff8880ae835ba3 R12: 0000000000000000 [ 257.181284][ T9661] R13: dffffc0000000000 R14: ffffc90001995000 R15: ffff888057f00000 01:16:00 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$overlay(0x400003, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}, {@workdir={'workdir', 0x3d, './file0'}}]}) [ 257.189282][ T9661] FS: 00007f1eb3afd700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 [ 257.198360][ T9661] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 257.204955][ T9661] CR2: 00007ffbe6ee2000 CR3: 0000000098758000 CR4: 00000000001406f0 [ 257.212939][ T9661] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 257.221084][ T9661] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 257.229040][ T9661] Call Trace: [ 257.232523][ T9661] kvm_dev_ioctl+0x81e/0x1610 [ 257.237271][ T9661] ? kvm_debugfs_release+0x90/0x90 [ 257.242368][ T9661] ? kvm_debugfs_release+0x90/0x90 [ 257.247464][ T9661] do_vfs_ioctl+0xdb6/0x13e0 [ 257.252057][ T9661] ? ioctl_preallocate+0x210/0x210 [ 257.257159][ T9661] ? __fget+0x384/0x560 [ 257.261296][ T9661] ? ksys_dup3+0x3e0/0x3e0 [ 257.265865][ T9661] ? nsecs_to_jiffies+0x30/0x30 [ 257.270698][ T9661] ? tomoyo_file_ioctl+0x23/0x30 [ 257.275620][ T9661] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 257.281852][ T9661] ? security_file_ioctl+0x8d/0xc0 [ 257.287062][ T9661] ksys_ioctl+0xab/0xd0 [ 257.291194][ T9661] __x64_sys_ioctl+0x73/0xb0 [ 257.295774][ T9661] do_syscall_64+0xfa/0x760 [ 257.300420][ T9661] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 257.306296][ T9661] RIP: 0033:0x45a219 [ 257.310177][ T9661] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 257.329899][ T9661] RSP: 002b:00007f1eb3afcc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 257.338299][ T9661] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a219 [ 257.346253][ T9661] RDX: 0000000000000000 RSI: 000000000000ae01 RDI: 0000000000000003 [ 257.354216][ T9661] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 257.362185][ T9661] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1eb3afd6d4 [ 257.370139][ T9661] R13: 00000000004c348b R14: 00000000004d7708 R15: 00000000ffffffff [ 257.378112][ T9661] Modules linked in: [ 257.384902][ T9661] ---[ end trace 8f0ad12d4cb0b211 ]--- [ 257.386580][ T3900] kobject: 'loop3' (00000000c60fdd6e): kobject_uevent_env [ 257.390493][ T9661] RIP: 0010:kvm_coalesced_mmio_init+0x67/0x120 [ 257.398361][ C0] blk_update_request: I/O error, dev loop0, sector 2872 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 257.408332][ T9661] Code: 00 48 01 c3 48 89 fa 48 b8 00 00 00 00 80 88 ff ff 48 c1 fb 06 48 c1 ea 03 48 c1 e3 0c 48 01 c3 48 b8 00 00 00 00 00 fc ff df <80> 3c 02 00 0f 85 9a 00 00 00 49 89 9c 24 d8 96 00 00 48 c7 c2 60 01:16:00 executing program 4: syz_open_procfs(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3, 0xfffffffffffffffe}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x98) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000002c0)={0x0, @in={{0x2, 0x0, @multicast2}}}, 0x84) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @empty}, 0x3f) sendmmsg$inet_sctp(r0, &(0x7f00000003c0), 0x3a301e0909ff6cd, 0x934) [ 257.437610][ C0] blk_update_request: I/O error, dev loop0, sector 2872 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 257.446326][ T3900] kobject: 'loop3' (00000000c60fdd6e): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 257.448765][ C0] Buffer I/O error on dev loop0, logical block 1436, async page read [ 257.467075][ C0] blk_update_request: I/O error, dev loop0, sector 2874 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 257.467598][ T9661] RSP: 0018:ffff88805f4d7c08 EFLAGS: 00010286 [ 257.478225][ C0] Buffer I/O error on dev loop0, logical block 1437, async page read [ 257.478263][ C0] blk_update_request: I/O error, dev loop0, sector 2876 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 257.478271][ C0] Buffer I/O error on dev loop0, logical block 1438, async page read [ 257.478293][ C0] blk_update_request: I/O error, dev loop0, sector 2878 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 257.478301][ C0] Buffer I/O error on dev loop0, logical block 1439, async page read [ 257.478990][ C0] Buffer I/O error on dev loop0, logical block 0, async page read [ 257.510691][ T9661] RAX: dffffc0000000000 RBX: ffff8880a4c52000 RCX: ffffc9000a36f000 [ 257.511717][ C0] Buffer I/O error on dev loop0, logical block 1, async page read [ 257.525346][ T9661] RDX: 00000000000012db RSI: ffffffff8108569c RDI: 00000000000096d8 [ 257.565480][ T9657] kobject: 'loop5' (0000000025337643): kobject_uevent_env [ 257.576483][ T9657] kobject: 'loop5' (0000000025337643): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 257.599908][ T3900] kobject: 'loop1' (000000001bff7ca4): kobject_uevent_env [ 257.614464][ T9661] RBP: ffff88805f4d7c18 R08: 0000000000000000 R09: ffffed1015d06b75 [ 257.618295][ T3900] kobject: 'loop1' (000000001bff7ca4): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 257.629907][ T9661] R10: ffffed1015d06b74 R11: ffff8880ae835ba3 R12: 0000000000000000 [ 257.642279][ T9661] R13: dffffc0000000000 R14: ffffc90001995000 R15: ffff888057f00000 01:16:01 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00\xdf\xf2\x02x\x1a\x9cu\xa1\x1b\xdaN\x1c\xef\xe9\nJ\x93\xf2\xee\xe8W\xcd\xc4\xadG\x17e\xf1\xd7\xda\xf7\xa1\xcf\x1f\xa4\xd3\xe32\xa0\x8c\xd4\xd0\x9a\xbb\xe15\xf2E`\xc9SX7\x02HG\xbd.p\xf4m\x8a\xd5u\x9c\x8c\xc0\x1b\x11\xd1.C(R\x16B5_\x1cVY,M\x83x\x89\xbe\xfb\xa5\x99\x99s\xea(D\x8d0\xec\x06\x1d\xe4\x9fw\xe7\x06\x11m\xcfL\x10HW\xf3\xf7\xee_\",\a\'\x11;\x85\x8a\x80S\v\x90\xab\x13\xe4\xc93\x96\x16\'\xdc\xecq\xcdQ\x8d\xec\xe0 \x13\xbd\x1a\x1f0\xcf\xe0\n\xeds\x85\xf2\x7f\xf1\xa4\x1fam\xc7\x12\x90\xf1Z\xbf\x15\xf7t+!}B\x15\a\x13\xbf\xa7\x05\xb1M\x89\xd5\xc43\x94\x84,\xeeFw\xc8\xe7\xa9\x9a\xbe\x0f\x80\xb9\xef\xafg2\xd0\x11\x94\b`\x8apREK*\x19zq\xbcRZ\xb2\xfc#*\xdaG5}\xc0y\xb5B\xa1Aa=\xde\xb4W\xdbC\x82f\xbb\xa12\x8b\x96J\xfa.\xf3mekE\xa0\xf2\xcd\x89\xe3\x99\x9c', 0x275a, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00\xdf\xf2\x02x\x1a\x9cu\xa1\x1b\xdaN\x1c\xef\xe9\nJ\x93\xf2\xee\xe8W\xcd\xc4\xadG\x17e\xf1\xd7\xda\xf7\xa1\xcf\x1f\xa4\xd3\xe32\xa0\x8c\xd4\xd0\x9a\xbb\xe15\xf2E`\xc9SX7\x02HG\xbd.p\xf4m\x8a\xd5u\x9c\x8c\xc0\x1b\x11\xd1.C(R\x16B5_\x1cVY,M\x83x\x89\xbe\xfb\xa5\x99\x99s\xea(D\x8d0\xec\x06\x1d\xe4\x9fw\xe7\x06\x11m\xcfL\x10HW\xf3\xf7\xee_\",\a\'\x11;\x85\x8a\x80S\v\x90\xab\x13\xe4\xc93\x96\x16\'\xdc\xecq\xcdQ\x8d\xec\xe0 \x13\xbd\x1a\x1f0\xcf\xe0\n\xeds\x85\xf2\x7f\xf1\xa4\x1fam\xc7\x12\x90\xf1Z\xbf\x15\xf7t+!}B\x15\a\x13\xbf\xa7\x05\xb1M\x89\xd5\xc43\x94\x84,\xeeFw\xc8\xe7\xa9\x9a\xbe\x0f\x80\xb9\xef\xafg2\xd0\x11\x94\b`\x8apREK*\x19zq\xbcRZ\xb2\xfc#*\xdaG5}\xc0y\xb5B\xa1Aa=\xde\xb4W\xdbC\x82f\xbb\xa12\x8b\x96J\xfa.\xf3mekE\xa0\xf2\xcd\x89\xe3\x99\x9c', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000040)=ANY=[], 0x6db6e559) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r0, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x402c5828, &(0x7f00000003c0)) [ 257.651359][ T9650] kobject: 'loop0' (0000000030a7c7de): kobject_uevent_env [ 257.658980][ T9650] kobject: 'loop0' (0000000030a7c7de): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 257.676400][ T9661] FS: 00007f1eb3afd700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 [ 257.690806][ T3900] kobject: 'loop4' (000000004596e917): kobject_uevent_env 01:16:01 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$overlay(0x400003, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}, {@workdir={'workdir', 0x3d, './file0'}}]}) [ 257.706499][ T9661] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 257.718175][ T9661] CR2: 00000000004c6d82 CR3: 0000000098758000 CR4: 00000000001406f0 [ 257.726765][ T9661] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 257.735252][ T9661] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 257.743784][ T9661] Kernel panic - not syncing: Fatal exception [ 257.751351][ T9661] Kernel Offset: disabled [ 257.755686][ T9661] Rebooting in 86400 seconds..