0f38b66da835af18791ab2c9113e8984a250b617b117076f4201d1baa852c46217e7b698ae7e44a464b87da1eaaf911c1b448d29a947f41706c4fd1248c62d81c416ef8ccbb4b473b83660cd66f869c97680c7e1c9e5d87d8162bf80bdb3d2f203605a605ee95ea51ee15b69bd9f604968059d3adc88e54f3e61344ea4968199fe999370acad8479efd5b7ac6bdafadf54663a7d8fd6662f992c2e52ef12c08ee3e135c08787a615698ef9b4128d9721782e781f560d52853ce48c5606fb519508645bb3715d58f57e5541101e3e0d37aa7162c565be758d98a324cc971c47816e554165516c26c06cbdf38512ef4b934abd98160027f602c44cb7e97933ceea7b83622addcbcbe03dc343b8260321a8d03f4253f2e1ecadd9d93d97004068a390fafa36496d579b845beaf43d8c3286228f4a5f9977b3c64df4c12353cd4653af3fb75519ad5a72aa86a1cb533126bd1f28df284a9692270c1ef32799572e5818e975fb4db2f54e8242a0bacd2bd75a0f095748de32f81e27cd8cf4f67bc9247fa50b6dfe28aa523787928c340870b3991c60753584fea96835ca38afe0f54abd1a70714deeb12ecb72a4a411511e7e8071418ca5eecc9f3ec972a23f4be225673fd111430ade16fa00dc21c0d388844b71b8acc1bcf63bfc14960cb500a179d46d7ff950a3d86a48d419ebd63516de12b189e340899afa09069d96d1dd34d84008f96b0109b9d8898475a9a1b8ad9836e27ac0a9f34e08e84ba88de808d67c091965020fd66f966cb1b86ffb10be1f0a5f85f23aea93f16ee5af9891b02df405a0e432790ed2ea1aeccbec92babd4d88e0327950afe200db9c7b067184a036f6d595875ef9af0c42bee8046623dbd1a9ce0026135421384f53fc480c928eef41c5a106c622d75cd6a46f77a38897e5690dcfb5b5f23fb0173599db52618a34ca88a82c2aeaf7b7dfc903313119aa6bcb85fb3957266c33918af26257e44421dedbd1a0750394eb809a322f42a0954b2a0579ae9a285a1c782f4e80b8416d871ddfe2645a4536e511"}, &(0x7f0000000180)=0x1024) statx(r1, &(0x7f00000001c0)='./file0\x00', 0x2500, 0x7ff, &(0x7f00000013c0)) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = creat(&(0x7f0000001380)='./file0\x00', 0x0) ioctl$KVM_SET_SIGNAL_MASK(r2, 0x4004ae8b, &(0x7f0000000200)={0x28, "5079538ff6bd15db7ca5f34eb5fc9195ec1e01e9cd5e295bc7cbf64080ed6bdecbc18564083a907e"}) openat$uinput(0xffffffffffffff9c, &(0x7f0000000240)='/dev/uinput\x00', 0x4000, 0x0) ioctl(r2, 0x1ff, &(0x7f0000000100)="31ab48c7153c89530988252ebcbcfe11efeb55c9acbe426ed95d85018c9ee096fa71615fb02b3eb159b107adc2bcf60846114a0c99f68e34a0b1f82bc935bb9bff09a3a31e7d4765e67f4d2ed28385714f1ba03897061d54c8bfd9207f1a693aff8ccfe2f99841ec48b158364187f7f7c72289d0394b97b6fc639cb12e") ioctl$fiemap(r2, 0x40086602, &(0x7f0000000080)=ANY=[@ANYBLOB="8b59"]) write$cgroup_type(r2, &(0x7f0000000000)='threaded\x00', 0xfe63) truncate(&(0x7f00000000c0)='./file0\x00', 0x8600) 16:56:31 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000080)="2957e1311f16f477671070") r1 = gettid() mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) bind$nfc_llcp(0xffffffffffffffff, &(0x7f00000001c0)={0x27, 0x1, 0x0, 0x7, 0x7fff, 0x4, "a3b1abc5ed0cbedb2e12792bad4b1f93db0d23ba57c630387955860e44b898119686b6ef324ab8e65d46e19dd2a9715682edfff4849f3e22c6dc59bbd78ee5", 0x39}, 0x60) nanosleep(&(0x7f0000000100), &(0x7f0000000140)) process_vm_writev(r1, &(0x7f0000000000)=[{&(0x7f00008f9f09)=""/247, 0xf7}], 0x1, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xffffff4e}], 0x23a, 0x0) mmap(&(0x7f00006ca000/0x4000)=nil, 0x4000, 0x1fffffa, 0x10008031, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000a45000/0x4000)=nil, 0x4000}, 0x1}) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000040)=0xfffffffffffffff9, 0x4) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0xfffffffffffffffa, 0x4c832, 0xffffffffffffffff, 0x8000000000) 16:56:31 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:31 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c40000000000000020d740000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 273.900865] binder: 19274:19276 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 273.909706] binder: 19274:19276 unknown command 4743953 [ 273.915220] binder: 19274:19276 ioctl c0306201 20000000 returned -22 [ 273.926769] binder: 19274:19276 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 273.935530] binder: 19274:19276 unknown command 4743953 [ 273.941087] binder: 19274:19276 ioctl c0306201 20000000 returned -22 [ 274.083306] binder: 19297:19301 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 274.092761] binder: 19297:19301 unknown command 4743953 [ 274.098324] binder: 19297:19301 ioctl c0306201 20000000 returned -22 16:56:31 executing program 4: r0 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$restrict_keyring(0x17, r0, 0x0, &(0x7f00000002c0)='\x00') socketpair$inet6(0xa, 0x5, 0x7ff, &(0x7f0000000200)={0xffffffffffffffff}) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r1, 0x84, 0x4, &(0x7f0000000300)=0x7ff, 0x4) r2 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x0, 0x2) setsockopt$ALG_SET_AEAD_AUTHSIZE(r2, 0x117, 0x5, 0x0, 0x9) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x0, 0x0) creat(&(0x7f0000001340)='./file0\x00', 0x5) sysfs$2(0x2, 0x3ff, &(0x7f0000000340)=""/4096) sysfs$2(0x2, 0x3ff, &(0x7f0000000100)=""/217) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000001380)=@assoc_value, &(0x7f00000013c0)=0x8) 16:56:31 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)=ANY=[], 0x1, 0x0, &(0x7f0000000040)="b0"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[], @ANYPTR=&(0x7f00000000c0)=ANY=[], @ANYBLOB="388e13d429cba4b7"], 0x0, 0x0, &(0x7f0000000440)}) 16:56:31 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:31 executing program 6: socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip6_mr_cache\x00') sendfile(r0, r1, &(0x7f0000000340), 0x800009) setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f0000000040)=@req={0x1, 0xc574, 0x7fffffff, 0x8}, 0x10) 16:56:31 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x1f) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f0000000000)=0x2, 0x4) bind$inet6(r1, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) listen(r1, 0x80000000) ioctl$sock_inet_SIOCGIFPFLAGS(r1, 0x8935, &(0x7f0000000100)={'lo\x00', 0x100000001}) r2 = accept4(r1, &(0x7f0000000340)=@alg, &(0x7f0000000040)=0x80, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r3, &(0x7f0000000080)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) write$binfmt_misc(r3, &(0x7f0000000240)=ANY=[@ANYBLOB], 0x34000) sendmsg$netlink(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000ac0)={0x10}, 0x10}], 0x1, &(0x7f0000000280)}, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f0000000140)={0x1, 0x6, 0x1000, 0x6, 0x0, 0xffffffffffffffc1, 0x8, 0x7, 0x4f6410c0, 0x3f, 0x8}, 0xb) getpeername$netlink(r0, &(0x7f0000000180), &(0x7f00000001c0)=0x11) setsockopt$inet6_MRT6_DEL_MFC(r3, 0x29, 0xcd, &(0x7f0000000200)={{0xa, 0x4, 0x2, @remote={0xfe, 0x80, [], 0xbb}, 0x3}, {0xa, 0x4e22, 0xc02, @loopback={0x0, 0x1}, 0x6}, 0x1b0, [0xffffffff, 0xffffffff816309d7, 0x8001, 0x1ff, 0x67bd79f1, 0xf9, 0xfffffffffffffffd, 0x4]}, 0x5c) setsockopt$sock_void(r3, 0x1, 0x24, 0x0, 0x0) 16:56:31 executing program 2: syz_mount_image$ext4(&(0x7f0000000380)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x2, 0x1, &(0x7f0000000400)=[{&(0x7f0000000740)="800000000002000019000000e60100006c000000000000000100000001000000004000000040000080000000006a88b2a968752cfe00ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000440)={[{@init_itable='init_itable', 0x2c}, {@dax='dax', 0x2c}]}) syz_mount_image$ceph(&(0x7f0000000000)='ceph\x00', &(0x7f0000000040)='.\x00', 0x3, 0x0, &(0x7f0000000080), 0x1400, &(0x7f00000000c0)='\x00') 16:56:31 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000050000000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:31 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000006000)='/dev/snd/controlC#\x00', 0x0, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/dsp\x00', 0x200, 0x0) write$P9_RRENAMEAT(r1, &(0x7f0000000780)={0x7, 0x4b, 0x1}, 0x7) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f000000affc)) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000009000)='/dev/audio\x00', 0x40202, 0x0) r3 = dup2(0xffffffffffffffff, r2) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r2, 0x84, 0xf, &(0x7f0000000040)={0x0, @in6={{0xa, 0x4e21, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x400}}, 0x8, 0x1, 0x200, 0xfff, 0xfffffffffffffffb}, &(0x7f0000000100)=0x98) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000140)={r4, @in={{0x2, 0x4e21, @loopback=0x7f000001}}, 0x2, 0x8001, 0x4ee, 0x1, 0xe}, &(0x7f0000000200)=0x98) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000280)=0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r2, 0xc1105517, &(0x7f0000000300)={{0x6, 0x1, 0x800, 0x9, 'syz0\x00', 0xe3a}, 0x2, 0x23, 0x7, r5, 0x5, 0x0, 'syz0\x00', &(0x7f00000002c0)=['/dev/snd/pcmC#D#p\x00', '/dev/snd/pcmC#D#p\x00', '}eth0wlan1-:nodev/\x00', '\x00', '](,&^!\x00'], 0x3f, [], [0x2, 0x3, 0x7, 0x600000000]}) poll(&(0x7f0000000000)=[{r2}], 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r2, 0xc0505510, &(0x7f0000000700)={0x1, 0xa, 0x914, 0x10000, &(0x7f0000000480)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}) fgetxattr(r3, &(0x7f00000007c0)=@random={'trusted.', '\x00'}, &(0x7f0000000800)=""/125, 0x7d) connect$inet6(r2, &(0x7f0000000440)={0xa, 0x4e20, 0x8, @dev={0xfe, 0x80, [], 0x11}, 0xe6f}, 0x1c) 16:56:31 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:31 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000040)={0x10, 0x34000}, 0xc, &(0x7f0000000100)={&(0x7f00000001c0)={0x14, 0x29, 0x82d, 0x0, 0x0, {0x1}}, 0x14}, 0x1}, 0x0) r1 = accept4$inet(0xffffffffffffff9c, &(0x7f00000000c0)={0x0, 0x0, @multicast1}, &(0x7f0000000140)=0x10, 0x80000) ioctl$sock_inet_SIOCDARP(r1, 0x8953, &(0x7f0000000200)={{0x2, 0x4e24, @multicast1=0xe0000001}, {0x7, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x4a, {0x2, 0x4e20, @rand_addr=0xcef}, 'bcsh0\x00'}) signalfd4(r0, &(0x7f0000000080)={0xffffffffffffffff}, 0x8, 0x80800) [ 274.362915] binder: 19315:19323 BC_REQUEST_DEATH_NOTIFICATION invalid ref 327680 [ 274.371233] binder: 19315:19323 unknown command 4743953 [ 274.377193] binder: 19315:19323 ioctl c0306201 20000000 returned -22 [ 274.400078] binder: BINDER_SET_CONTEXT_MGR already set 16:56:31 executing program 0: r0 = socket$inet(0x2, 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) set_tid_address(&(0x7f0000000000)) r2 = dup3(r0, r1, 0x80000) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000140)=@sack_info={0x0, 0x80, 0x9}, &(0x7f0000000180)=0xc) getsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x11, &(0x7f0000000380)={r3, 0x2}, &(0x7f00000003c0)=0x8) ioctl(r0, 0x80, &(0x7f0000000300)="2f54631ad11eb4948cd7ff09b1a9b1f099a220254c1263779ca686439e74b9134b15a7fdb1983f53118fbd04834b60f9ed4c13aa5a248b59bf56042ee0508e5ad112329dd3a9fc235abd2afdbe78071be6db87b3632f7210ebb27637357c") getsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x11, &(0x7f00000001c0)={r3, 0x401}, &(0x7f0000000280)=0x8) get_thread_area(&(0x7f0000000040)={0xb7, 0xffffffffffffffff, 0x1000, 0x2, 0x5, 0x7, 0x81, 0xffffffff, 0x5, 0x3}) socketpair$packet(0x11, 0x3, 0x300, &(0x7f00000002c0)) r4 = fcntl$getown(r1, 0x9) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r2, 0xc008551c, &(0x7f0000000400)={0x0, 0x1c, [0x6c, 0xb0d9, 0x100, 0x6, 0x8, 0x80000000, 0x8]}) perf_event_open(&(0x7f00000000c0)={0x4, 0x70, 0x80000000, 0x63d0, 0x5, 0x10001, 0x0, 0x40, 0x40080, 0x4, 0x3f, 0x8, 0x7, 0x20, 0x100000000, 0x3, 0x45, 0x2, 0xf10c, 0x1, 0x3, 0x4, 0x0, 0x81, 0x8, 0x80, 0x101, 0x3, 0x1, 0x3, 0x7ff, 0x0, 0x81, 0x3ff, 0x3, 0x7bf, 0x3, 0x20, 0x0, 0x7, 0x4, @perf_bp={&(0x7f0000000080), 0xf}, 0x920, 0x355dc690, 0x6, 0x1, 0x7ff, 0x0, 0xfff}, r4, 0x5, r1, 0x2) getsockopt$IP_VS_SO_GET_TIMEOUT(r0, 0x0, 0x486, &(0x7f0000000900), &(0x7f0000000940)=0x8e8edf798eff5bbf) 16:56:31 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c4000006c0000000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 274.400450] EXT4-fs (loop2): DAX enabled. Warning: EXPERIMENTAL, use at your own risk [ 274.410248] binder: 19315:19323 ioctl 40046207 0 returned -16 [ 274.413559] EXT4-fs (loop2): DAX unsupported by block device. Turning off DAX. [ 274.428116] EXT4-fs (loop2): bad geometry: block count 512 exceeds size of device (1 blocks) 16:56:31 executing program 2: r0 = socket$inet6(0xa, 0x4000000001, 0x8010000000000084) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x200, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f00000000c0)={0x0, 0x6, 0x3, 0x0, 0x4, 0x3}, &(0x7f00000001c0)=0x14) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000200)={r2, 0xff}, &(0x7f0000000240)=0x8) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) listen(r0, 0xffffffffffffff7f) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = accept4(r0, &(0x7f0000000340)=@in={0x0, 0x0, @multicast1}, &(0x7f00000002c0)=0x80, 0x80000) sendto$inet6(r3, &(0x7f0000000080)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) ioctl$SG_SCSI_RESET(r1, 0x2284, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r1, &(0x7f00000002c0), &(0x7f0000000440)=""/220}, 0x18) setsockopt$IP_VS_SO_SET_DEL(r4, 0x0, 0x484, &(0x7f0000000280)={0x0, @loopback=0x7f000001, 0x4e23, 0x1, 'wlc\x00', 0x18, 0x40, 0x78}, 0x2c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000100)={0x0, @in={{0x2}}, 0x0, 0x0, 0x0, 0x0, 0x14}, 0x98) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000005c0)={0x0, @in={{0x2}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) [ 274.465371] EXT4-fs (loop2): DAX enabled. Warning: EXPERIMENTAL, use at your own risk [ 274.473483] EXT4-fs (loop2): DAX unsupported by block device. Turning off DAX. [ 274.481726] EXT4-fs (loop2): bad geometry: block count 512 exceeds size of device (1 blocks) 16:56:31 executing program 4: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) fcntl$F_SET_FILE_RW_HINT(r0, 0x40e, &(0x7f0000000180)=0x2) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x3, &(0x7f0000000080), 0x25) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000080)=[@in6={0xa, 0x4e23, 0x1, @local={0xfe, 0x80, [], 0xaa}, 0xffffffffffffdbf8}, @in6={0xa, 0x4e20, 0x2, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}, 0x5dd628e5}, @in={0x2, 0x4e20}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x4e24, 0x2000000000000000, @loopback={0x0, 0x1}, 0xc83}, @in={0x2, 0x4e22, @multicast1=0xe0000001}, @in6={0xa, 0x4e20, 0x1, @dev={0xfe, 0x80, [], 0xf}, 0x9}, @in6={0xa, 0x4e24, 0x4, @loopback={0x0, 0x1}, 0x826}], 0xbc) ioctl$sock_inet_SIOCGIFDSTADDR(r0, 0x8917, &(0x7f0000000200)={'syz_tun\x00', {0x2, 0x4e22, @broadcast=0xffffffff}}) socketpair$inet_smc(0x2b, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$F_SET_RW_HINT(r1, 0x40c, &(0x7f0000000240)=0x4) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e22, @multicast2=0xe0000002}, 0x10) ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000140)) sched_yield() signalfd4(r1, &(0x7f00000001c0)={0x9}, 0x8, 0x80000) 16:56:31 executing program 6: r0 = socket$inet_sctp(0x2, 0x1, 0x84) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0xfffffffffffffffd, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000000), 0x4) close(r0) 16:56:31 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 274.579828] binder: BINDER_SET_CONTEXT_MGR already set [ 274.587174] binder: 19354:19360 ioctl 40046207 0 returned -16 [ 274.603299] binder: 19354:19360 BC_REQUEST_DEATH_NOTIFICATION invalid ref 7077888 [ 274.617745] binder: 19354:19360 unknown command 4743953 16:56:31 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c4000cc070000000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 274.625093] binder: 19354:19360 ioctl c0306201 20000000 returned -22 [ 274.637315] binder: BINDER_SET_CONTEXT_MGR already set [ 274.642814] binder: 19354:19360 ioctl 40046207 0 returned -16 [ 274.773844] binder: BINDER_SET_CONTEXT_MGR already set [ 274.782869] binder: 19384:19387 ioctl 40046207 0 returned -16 [ 274.799182] binder: 19384:19387 BC_REQUEST_DEATH_NOTIFICATION invalid ref 510976 [ 274.812090] binder: 19384:19387 unknown command 4743953 [ 274.818737] binder: 19384:19387 ioctl c0306201 20000000 returned -22 [ 274.852783] binder: BINDER_SET_CONTEXT_MGR already set [ 274.869884] binder: 19384:19387 ioctl 40046207 0 returned -16 [ 275.163889] binder_alloc: 19317: binder_alloc_buf size -5213819088076042696 failed, no address space [ 275.173252] binder_alloc: allocated: 8 (num: 1 largest: 8), free: 12280 (num: 1 largest: 12280) [ 275.182150] binder: 19317:19394 transaction failed 29201/-28, size 0-0 line 2967 [ 275.296350] binder_alloc: binder_alloc_mmap_handler: 19317 20001000-20004000 already mapped failed -16 [ 275.308158] binder: BINDER_SET_CONTEXT_MGR already set [ 275.313556] binder: 19317:19394 ioctl 40046207 0 returned -16 [ 275.313605] binder_alloc: 19317: binder_alloc_buf, no vma [ 275.325076] binder: 19317:19397 transaction failed 29189/-3, size 0-0 line 2967 16:56:32 executing program 7: clone(0x200, &(0x7f0000fbf000), &(0x7f0000744000), &(0x7f0000f8b000), &(0x7f0000804000)) mknod(&(0x7f0000000000)='./file0\x00', 0x1040, 0x3) execve(&(0x7f0000000080)='./file0\x00', &(0x7f0000000280), &(0x7f00000001c0)) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='attr/fscreate\x00') writev(r0, &(0x7f0000000340)=[{&(0x7f00000002c0)="8e", 0x1}], 0x1) execve(&(0x7f0000000140)='./file0\x00', &(0x7f0000000000), &(0x7f0000000200)) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r0) creat(&(0x7f0000000040)='./file0\x00', 0x0) 16:56:32 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="025cc83d6d345f8f762070") r1 = socket(0x10, 0x80001, 0x0) sendmsg$nl_route(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10}, 0xffffffffffffff67, &(0x7f00000000c0)={&(0x7f0000000340)=@bridge_delneigh={0x30, 0x1d, 0xd01, 0x0, 0x0, {}, [@NDA_DST_IPV6={0x14, 0x1, @mcast2={0xff, 0x2, [], 0x1}}]}, 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmmsg$alg(r1, &(0x7f0000000140)=[{0x0, 0x0, &(0x7f0000000100), 0x0, &(0x7f0000000100)}], 0x492492492492805, 0x0) 16:56:32 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000131d00ffff000000000000000005000000"], 0x14}, 0x1}, 0x0) 16:56:32 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:32 executing program 4: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000100)={0x0, @in={{0x2}}}, 0x98) r1 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x54, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffff9c, 0x84, 0x18, &(0x7f0000000080)={0x0, 0x1}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f00000001c0)={r2, 0xd0, "ce2248030924dba74852d5ce090eb1b3e06b8a1d3bf1b9f78e538c91a60afcaed3c9153f8daa099cfe038eba84186c9391053b6855485ba7256d5928d815b9eab5aba25e194cc55574d6b9a17a16945cbdb541d1ea9d699c74d037b4758f0941ba1ff3c81a191a22097df2d37599d80f910839cb7a7cfc00d2729522c4486a1f7ffbcaff3add6836eeed96227f4d4ab755d85b9fd979fc84005d0cc988cd91392777a8bf172dc6ba944dc13c1db0c52bfe31ba1f019433163e64e1767a0abbfa613ff7340b402980526380bb596312cd"}, &(0x7f00000002c0)=0xd8) r4 = syz_open_dev$sndctrl(&(0x7f0000000180)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_HWDEP_NEXT_DEVICE(r4, 0xc0045520, &(0x7f0000000200)=0x3) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x33f, 0x8, 0xd623, 0x9, 0x200}, 0x10) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000300)={r3, 0x9}, 0x8) 16:56:32 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000000000060000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:32 executing program 1: r0 = perf_event_open$cgroup(&(0x7f0000000040)={0x4, 0x70, 0x8000, 0x8, 0x9000000, 0x4, 0x0, 0x7f, 0x28001, 0x1, 0x80000001, 0x6, 0x5, 0x6, 0x4, 0xd81, 0x0, 0x6, 0x8, 0x42, 0x4, 0x6, 0x200, 0x0, 0x0, 0xb310, 0x2, 0x4, 0x0, 0x8, 0x7fffffff, 0x5, 0x7, 0x101, 0x81, 0x815, 0x2, 0x4, 0x0, 0x5, 0x0, @perf_config_ext={0xfff, 0x4}, 0x104, 0x0, 0x7fff, 0x5, 0x2000000000003, 0xfff, 0xffffffffffff7fff}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x1) dup(r0) r1 = socket$inet6(0xa, 0x801, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x2}, 0x1c) io_setup(0x23, &(0x7f0000000200)=0x0) io_submit(r2, 0x1, &(0x7f0000356ff0)=[&(0x7f0000928fc0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f00001b0000)}]) [ 275.438221] binder: release 19317:19324 transaction 1325 out, still active [ 275.445344] binder: undelivered TRANSACTION_COMPLETE [ 275.450481] binder: undelivered TRANSACTION_ERROR: 29201 [ 275.456092] binder: undelivered TRANSACTION_ERROR: 29189 [ 275.459141] IPVS: set_ctl: invalid protocol: 0 127.0.0.1:20003 [ 275.462506] binder: send failed reply for transaction 1325, target dead 16:56:32 executing program 5: socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r0 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r0, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r0, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:32 executing program 6: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0) sendfile(r0, r0, &(0x7f0000000180), 0x80000800000007) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000040)=0x3) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r0, 0xc0505510, &(0x7f0000000100)={0x80, 0x9, 0x7, 0x3, &(0x7f00000001c0)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 16:56:32 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6_sctp(0xa, 0x200000000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x2, &(0x7f0000ad2000)=ANY=[@ANYBLOB="e3d46d2e"], &(0x7f0000000080)=0x23c) setsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000000)=0x8, 0x4) pipe(&(0x7f0000000040)={0xffffffffffffffff}) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000500)=0x0) r4 = semget$private(0x0, 0xb26e7a8cd1bf84c1, 0x121) semctl$GETALL(r4, 0x0, 0xd, &(0x7f00000006c0)=""/126) fstat(r0, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r1, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r2, &(0x7f0000000680)={&(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000000480)=[{&(0x7f0000000140)="43fa4cad98ae0d5c115aa3411b732c56e38a54", 0x13}, {&(0x7f0000000180)="bf46cc9e346f8de0ab1b63bc372269c7430850a7b3d1b192f788cbc471d5b9", 0x1f}, {&(0x7f00000001c0)="9592c93862cfc0deda7460f05a6f57d9a6da921df552306ab87ac86ae12e2128aceac0894c0784e855b6dde518e558d80ebb5cf6fa7638cb5ede5107b65130cef2c2", 0x42}, {&(0x7f0000000240)="ef43c4bc033621bc2e42256707d64e0f0aa6", 0x12}, {&(0x7f00000002c0)="dcc2a31a8b1cfb891d45d7dae17751216ae9592520c852e373918695521a3967209079528af8a09acaf9146e610f7f0aed7888827c18869e2a868b3be52a5a7879b4b143eb314cf62a1d8ceac51d5e38d5b213023fb2c9ba34c67ba527088e96eae94acbc0781d299cb06303bb38ef854912e49ec80a16790810d6f27eb8da04c8e4e352cd3150661f44de6c84a36de8100f9d4320dc5ebeb493627db4664eb3023fc9c206e03af820d81fcafbd5bbb7d32f131747a4c34ef4487334c27f0bb298d102b37cec1662d555ae5b3235dfdb735478cbf89cb2", 0xd7}, {&(0x7f00000003c0)="407cc6c4b45ccc43fcdb4a3e40bd6d91f8700899598f8491b35227c058cc46624e7f9253c02d6126a0aaf1f3e3b7b47048916d03d2c007f2ffcc200c5e9195612cd6df14adf1ce1d6abccbbb428d9a4e92118260515516cf567e67e9ac78eee5824fedc901e9f9077179e68e46a0542f63ad02e3a541873f3448fe04274ffcbc561cbda4e41ef36becf078e3b62cd3762f28bb9c", 0x94}], 0x6, &(0x7f0000000640)=[@cred={0x20, 0x1, 0x2, r3, r5, r6}], 0x20, 0x40000}, 0x0) 16:56:32 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380)='/dev/ptmx\x00', 0x0, 0x0) r2 = syz_open_dev$admmidi(&(0x7f0000000140)='/dev/admmidi#\x00', 0x100, 0xa800) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r2, 0xc008551a, &(0x7f0000000180)={0x6, 0x18, [0x80000000, 0xffff, 0x200, 0x7fffffff, 0x8, 0x1]}) ioctl$TCFLSH(r2, 0x540b, 0x5) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x20000, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/ignore_tunneled\x00', 0x2, 0x0) ioctl$KVM_SET_ONE_REG(r4, 0x4010aeac, &(0x7f0000000100)={0x1ff, 0x2}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x501001, 0x0) ioctl$KVM_CHECK_EXTENSION(r1, 0xae03, 0x7) ioctl$KVM_TPR_ACCESS_REPORTING(r4, 0xc028ae92, &(0x7f00000000c0)={0x2, 0xfff}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000280)) [ 275.540628] binder: 19403:19408 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 275.549352] binder: 19403:19408 unknown command 4743953 [ 275.584073] binder: 19403:19408 ioctl c0306201 20000000 returned -22 [ 275.620097] IPVS: set_ctl: invalid protocol: 0 127.0.0.1:20003 16:56:32 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) pipe2(&(0x7f0000000080)={0xffffffffffffffff}, 0x800) ioctl$KDGKBSENT(r1, 0x4b48, &(0x7f00000000c0)={0x5, 0x8, 0x3}) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f0000000000)={0x9, 0x800000001}, &(0x7f0000000040)=0x10) bind$alg(r0, &(0x7f000001f000)={0x26, 'aead\x00', 0x0, 0x0, 'authencesn(sha3-224-generic,cbc-camellia-asm)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000), 0x2a4) 16:56:32 executing program 2: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000400)={{{@in=@remote={0xac, 0x14, 0x14, 0xbb}, @in=@broadcast=0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}}, {{@in6=@mcast1={0xff, 0x1, [], 0x1}, 0x0, 0x33}, 0x0, @in6=@remote={0xfe, 0x80, [], 0xbb}}}, 0xe8) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f0000000000)="502e779927b53e57a9143de5e1f43511", 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr, @multicast1=0xe0000001}, @icmp=@address_reply={0x8}}}}}, &(0x7f0000000040)) 16:56:32 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000003000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:33 executing program 6: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000180)='./file0/file0\x00', 0xffffffffffffffff) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mknodat(r1, &(0x7f0000000100)='./file0\x00', 0x82, 0x289f) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=@getsa={0x140, 0x12, 0x20, 0x70bd28, 0x25dfdbff, {@in=@loopback=0x7f000001, 0x4d3, 0xa, 0xff}, [@ipv6_hthresh={0x8, 0x4, {0x1a, 0x65}}, @srcaddr={0x14, 0xd, @in6=@loopback={0x0, 0x1}}, @sec_ctx={0xe8, 0x8, {0xe4, 0x8, 0x1, 0x400, 0xdc, "73fbb6f5a86d9883c85c5e38c004293cd9034f584d8578cdda5f9a28d3fbcd957dff169ff06c0bbc85b47c389ff43ec975ce98852371596ff0c60ba7560e7b55892606ffe30d422f8b7020cbd431b3f9521f9d9c3753729bce75b8c6534b4ecd839a95d6c7de8a97457509f304ef94d207eca3f29339d7f8dc3103d03d6f94102c17850530df89b7f7bbcbd6ab6397ebb0466b63e35f4f8f2bc81cd963395b59358f7442e28fe12962cff9c2f7d9dc6805a6f13a54616d24241191754cdff1b9f0d018ccc4d767e959ce2e739b0dcbc24b1a886ce0ee97c959248f7a"}}, @srcaddr={0x14, 0xd, @in6=@local={0xfe, 0x80, [], 0xaa}}]}, 0x140}, 0x1, 0x0, 0x0, 0x8004}, 0x9fb22ad53f646a06) syz_mount_image$minix(&(0x7f0000000080)='minix\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x0, &(0x7f00000001c0), 0x0, 0x0) r2 = open(&(0x7f0000fa3000)='./file0\x00', 0x0, 0x0) getsockname$unix(r0, &(0x7f00000002c0)=@abs, &(0x7f0000000000)=0x6e) faccessat(r2, &(0x7f0000000280)='./file0\x00', 0x0, 0x0) 16:56:33 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000140)={{{@in=@remote, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@multicast2}}, &(0x7f0000000240)=0xe8) r2 = getegid() lchown(&(0x7f0000000100)='./file0\x00', r1, r2) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(camellia)\x00'}, 0x58) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000012c0)='/dev/hwrng\x00', 0x2, 0x0) ioctl$sock_inet_tcp_SIOCOUTQNSD(r3, 0x894b, &(0x7f0000001340)) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="b7f2288a911993f0265df5cf1cdd8b55b062950b86bc01abc8464d4f8a906151", 0x20) r4 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r4, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000012c0), 0x0, &(0x7f0000001300)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) openat$random(0xffffffffffffff9c, &(0x7f00000014c0)='/dev/urandom\x00', 0x200, 0x0) write$binfmt_script(r4, &(0x7f0000000300)=ANY=[], 0xffffffaa) creat(&(0x7f0000000280)='./file0\x00', 0x102) recvmsg(r4, &(0x7f0000001480)={0x0, 0x0, &(0x7f00000013c0)=[{&(0x7f00000002c0)=""/4096, 0x34000}], 0x1, &(0x7f0000001400)=""/123, 0x7b}, 0x0) [ 275.746745] binder: 19425:19433 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 275.755479] binder: 19425:19433 unknown command 4743953 [ 275.762916] binder: 19425:19433 ioctl c0306201 20000000 returned -22 [ 275.798626] binder: 19425:19433 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 275.807524] binder: 19425:19433 unknown command 4743953 [ 275.813495] binder: 19425:19433 ioctl c0306201 20000000 returned -22 16:56:33 executing program 7: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000700)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(md5-generic)\x00'}, 0x58) r1 = syz_open_dev$sg(&(0x7f0000000240)='/dev/sg#\x00', 0x1f, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000001c0), 0x0) r2 = accept4(r0, 0x0, &(0x7f0000000380), 0x0) fcntl$notify(r1, 0x402, 0x35) r3 = socket$inet6(0xa, 0x2, 0x0) inotify_init1(0x80000) ioctl(r3, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r4 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x180, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000080)={{{@in6=@ipv4={[], [], @loopback}, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}}}, &(0x7f0000000180)=0xe8) ioctl$TUNSETOWNER(r4, 0x400454cc, r5) sendmsg$nl_route_sched(r2, &(0x7f0000000640)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000600)={&(0x7f0000000400)=ANY=[@ANYBLOB="7a52000031000000000000000000000000410e4447ac1abcb998993c35a78d1e815d05ce3cc690be03557ccf1b44e43a96cee054e4329fbf38d69ba71b99067546f3170cecfb82451c94f57b95b50a52cd756043e88e00000000000000000000e59c027d4a8d32039f2c0dbaaa66b6151dd46c316a22043f7b36e418113f12b3fcd60ae4650cbec92506a16c9c15145279c9eedf8a2e21ef6da9d9c8f024890d09390d2d68daad42f37cb2efb42e37a850227e7d85a3f1404699a256cceda1c2083d1a3849769b2af299f6aa2f44e59fddb3939a8e5587e1d30767e2d373a6b0271453473b006fefc326345b9317db1829deefc49c2164b4c41a60e0116b592820"], 0x14}, 0x1}, 0x0) 16:56:33 executing program 5: socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r0 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r0, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r0, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0xfffffffffffffffe) mprotect(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000) mremap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000ffd000/0x1000)=nil) 16:56:33 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000001f40)='/dev/mixer\x00', 0x404040, 0x0) getsockopt$bt_l2cap_L2CAP_CONNINFO(r1, 0x6, 0x2, &(0x7f0000000840), &(0x7f0000000880)=0x6) ioctl(r0, 0x8912, &(0x7f0000000000)="025cc83d6d345f8f762070") syz_mount_image$bfs(&(0x7f0000000300)='bfs\x00', &(0x7f0000000340)='./file1\x00', 0x0, 0xa, &(0x7f0000000700)=[{&(0x7f0000000040)="c3c6035b89dd269757cacd6d49f260e936cd703722dbb0e5e9a543fe12133fc244", 0x21, 0xffffffff}, {&(0x7f0000000080)="c624416f6bbe85c5c87a4ee529dc0436a4d3d0fa1a863414f88b243ab58f72ff5f39929e41289d0051383b805e586191cdb296bb3451d1f11779e79cfb6039610b5b9226dd18781fb279da330430be07c72385f5b97292dd74709010582f5fdd2907095d6a28195f1d9319df08201866410aa2a22853d60e9e6b1cf9f24a833970eec6b7a3e178393e2cdd371622042d77be6dbe76c47ec16219c7c0074104e6a36e9350ba248737a1a0eaee67e286995a15afa4acd3b043a2dbe3b73d411f5bcf545e0cda25dc37b2cafa480271149292aefaf2e54c9e0f7e20f67f89045da362964f67", 0xe4, 0x81}, {&(0x7f0000000180)="aa94e0812d02490fb15427480d60a9c1af698c854b0c16a8f13d5ab774ad3b065ec8174bce4e0f9404b1020d4eaf740c549a39ab7ffe220145de6428cf672669946d29eab6cd1dd13844a005e7f459b97613d133131093c607b292fad76dc03ef92c7a795518fb0e165112f63006f670a33fbd63d2e56401f83e410ca07d39f184d7b2fa7ab22cae76948f3d8ce89953768b058b8e11d7e78ac311df06dccc89b9136fab03e4", 0xa6, 0x5fc4a29c}, {&(0x7f0000000240)="d4cdc28401c2b2f144945dbf3ff84649d4c4d730e2dd1e64a3e90aa1fbfa9ac74e3612fab5464fd030038cbd19bb305a90055b8a338703bae5d5414238902546be4ac39e080bc92978943df8f149d4b06690d867ed194fc0bf5d9b04948f3e2d0f33c531234a25e948c78813", 0x6c, 0x3ff}, {&(0x7f0000000380)="ec4aca3df65fd33482423cb38809486f0e58e1711b1d3d01f327d5c77d9b7ec4d748ac8f3a67a12a2c2bf003902cc4f4b824160f32217a6d751f1734695bfc76761123a606caf7b80874c069310d11409e968766cc9c17db707eec204ca7766136a2e07f882c523a98c4b7ee81f6d712340c516ed71494e175c869f8acd71cd33e24cd0c395cb42858ee78c8eaf2747b06960bd583836c048c814df59d92d58aa887b76b64d771d230d0099e7933a20037ec3a888dbc49273514d9a3e7669c540558e8782307112b2936b522a4133fcb78f93fa79c5d0e7f6f16c83b68c3783b5d76c93fedf7569f11b9", 0xea, 0xf2c}, {&(0x7f0000000480)="0ae546953da57f7ea60f95cc1f47d3eed2bdf80b2befec28edece44b4f3f4a57a563d39786ff7d8b3f249c9cdb1e094bc7bdb92cbc21eaa65ecbdb3fe15a26b02d3be7256dafc2d29b9770adf2f60234c863596988ce1fe0c69df5e148828dba14e461816c65447b1f32", 0x6a}, {&(0x7f00000002c0)="cfa9658be58a40ba8653f65f59a4265dec5422a1be2e4c5b", 0x18, 0x80000000}, {&(0x7f0000000500)="77197bd6cf82df0b7d0b2fe4d1ebd5bfcb568b95182d72f5646cc99302a42227967a9d0b83f1f1355af6a86f0d88b0a9a5e4114f69c28d752b2e1cb3649bb01c1df9d610cf68502eedf22a65dd3f723b34e61807f5c06e3614be42b0706549f4ee70b59961829d092b487afd0f670ed34bb695985703dda0c89c5a58f4e50df4efe890373f46ccdc2290826597a31fd54ab624e71f46b9f3476e7fd642053c7aa416d01724c34a8ae83ba5e6e732c45bfbb1", 0xfffffffffffffedd, 0x10000}, {&(0x7f00000005c0)="2cfbaae76f8bd7ecb9fceeefe1ce5da2d13d1beb7d8fec6d73f97fc9a6b71de0cd934dcbb174b79604afa2f703297bb96738711f46a955d09d8c60ac08dc394b2b3f0c", 0x43, 0x100}, {&(0x7f0000000640)="c1be78609f00000000000001008f9bed04eb3b08f382410778f29fb6835f0056825e8006a50b601b6871be3e71ea1bf7a33e99acbc2d4b508d1155fcdf7cd6075843844d3d632804d272c5b1fe6f9e7ac714274bc0304f33e978d8bc460ea7dd43ad3e1fe7202fdfb5f101b57bcbe5451de766a1f67c1142c9d346927c72ca3d171da511e2000000000000000000000000", 0x91, 0x5}], 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000008c0)='/dev/null\x00', 0x1, 0x0) syz_mount_image$xfs(&(0x7f0000000900)='xfs\x00', &(0x7f0000000940)='./file1\x00', 0x8, 0x7, &(0x7f0000001e00)=[{&(0x7f0000000980)="8733bf77e41b1aa652ef3a23c6b36cc743202d592f2513959be7bdc46915b5b3ae7bb4a2e11c517610fb1c5c532122e9a47b76b4a7d9e634b98ba8814067a3fccfa6385ec4eca21c86ef76ebfd311e813a0453b4ee65db1cb4068e84eade2cd43e2059d392337ba4023b08a843257bf25734f2b30ecd7423c77dde6d7f47fefd7f28d88c7a268725fe8a652471c9576d50282f6ba7405e7c38e143998fc31328ec0d61111a25a3dc7319c04bfa0dff7dd51b0b78008b75c458de5fdd8f0a3fbde6697c6a57557c22a882bdfa6b7247341bdaec715415c1780d9273a8bb9eb24cd17f477222081de281484cc3f22bbfff7ca6", 0xf2, 0x2}, {&(0x7f0000000a80)="621d276dd39bdc55ba45846c04db6a3cbea34894d9b1f317e72141af1b27471550395fc6fbb36c69b53301fcb6d1f651b187644db0d688ae3277216bbfc2eae4c4dbac", 0x43, 0x3ff}, {&(0x7f0000000b00)="9f3060401ea6d9d151d61005305d7caf14970f17e1286ece04ea14b26c12fcc3cbd48dff8d12151639b1d06dc8c2430c95dc85b5bcac7b2da75fc6857b48da9372bab3d8d43f30ee9cacf1311af5226671393753d2758b9b422150452d74a96cb3b8e5a387810a54084a8e33b1a2b422895cdb56f30f5d918f3b574c07fe93c56c2390504e819ec72c3e820676a43e89ac490d467ed7234ea33f8959add61156fdb31ee8070b8a053de6d3bc575db4ac7beb999ef730910e72aa680b1a9bbf91a89311e0fb594bbec0f7f720c2341a72926f297485ece4c403457474ca26b8adba163b41f57b050615e71045a5e44b33799733bb9b7d9f2fdae8c833e7d19f2dac6e2ce202ceb70a319d537fa70c6db71e648638b2a2deb6d127e8028d641cf4942fb2b569d1639294b756dbf68d4056f2f1e8239b75d0d9804e67831b4376e5eeb22dfcc5b8c9d881c882af29f6be8f3b4ba1e89260e7b12e0450ed01c12d802b5ddc53d9c1ec7698743fd18032c85d5a199402588d108f3ee7776372d2fc88b4bcd780582f1706d4b5b649a33cf047d33997b418cb5f0c47743d80859e7cca04d2d13345083d48bf6c96f6aad6057dfe3e129b21e84f249400f9fba865bfc5c7a18f751211f1dc0980aae6e036a638923308d538d9b9294eca36b4072cb185cae7ec4b1d07aadf30758da890a5122a02cfd7b44e87eeaec2b3995c17242cbd5581b5153ce3c9632205a7c7b08dad002ba5f070441ff524decc7aa839ed91dabcfacec3f656ea7290821a00eaafa5cb10bb77c706a330298d4824c0912a8e3c0cc3e839d522d91d8956d716b69365e2a4b19d12c0a1655bec6bee543bc5755dbf9c8cbf8e6b3239883f0a804b7e7141183a75bd7c478ff061ac27ace47cf59431e81922156da449410e543f25b5df91653a72942cd35dbf659b3b31927dcf630186126cf448bafcb838a55775a805ed043b25a3a8d1a37f6910b2c46b5342b936e4e1991c2b3c586e2334ab9d5d874822a3f7828570a2801761ccb1e473fb135b22845757d7a0e568d1d1ac5845b55eced72e6a2340564d1eb9cf3b7ea1fb10dd21b8dec0d98d2b94956ff1b9cbd1a7a8ef20ad46cdf23c0d8b11c2636f1f55933c86ebc990deb61bd5ed3ddd545f2349e66f53b0db1aeeb804f7e526a35d5fe24cfd6c430baa45119d8ecaa4dc5d07d4407e84b67452b305528abee755c11250d1939fe077ac97f840eb9660a97d94c145d43e626c220360714297e468720571caf0df8fdfda24a8b8881d3925d2e7851a0cb497e5472498a89270839c9acd449336374df6abde88e74b6428500c0bafa26ea4ccdbfae9010926a719a329304ae08fff6594483bf4a9e233f634b09dd2cae639272cba7b3fe686a67d99e53b05f9234fb19d767736cdaa6fedd5bace4cf3d79c22b6e3e759a552574bd510ba309f0a7372608916bab5b07911841ffa4ef0bcd9c710fd222c8e90185678919948376532be37a9fcbcb871f1f80aa7b2889c12bfc482b92d81528af5698fd9290b36328c5b5aba4a6445ad878b38cd5f2eb9014cf431ba6cf9abfaa5eed099b3898a55bb6880d775b9ad1a3a4c9455ecb74042d8bfd69c8a6473e82483f1833a8e9009ca954ddfb2867b712d468a3382c1e992f683bf09686dcd781948c862dfab6e53e1d77102d17b6fbe4804e97f3f7fe1a5f7d9b251984a763b862a9daecba73c62fd0fff1582280b8971258ae4416bc09e0b46f585a9e81b56c7afecc8e286ececfba7cb76fc8a9426ac5b5c2b4b75778e50230e5cdc1271ff3dedbd39bc555e5fcbe5dcb39c20fffdc8ff50c214f65643b34416e0f3276d7a1ccd543d55de2f89d90404686c4560392e75dec1b33c3fb9eaa361b8c15d886a5664f31d03d50df36996656821ff53fee33b1feda80139a055ccb2a8d90433812c298749ab80e698c125815d4f02699db371c07741a2a9379c885abce500ca6f7daa6ce9e9293e2c0c689e8db86051b0c579e315cd20fde4b9a6af3b97b77e6197d1a3e916cfbe55d5022d051a06fb971cf5a5d0371f2af209562a250823052ea59ec6fbcf111280866e86494ad8350d9c2fa73170117b7bc569310375f36ba26ed9988f560b5b9f2dea211a2e6171398fed82d44dfc92a184e1eeef0fa41d05a948f62a6fdeacafdb46cfede5c45dd6278dfac8e85fc4022ca7dfc6b4a546a7166b29810df58555a8488c51d49c0aa070507df21020c569b005bf7fa852cb07b6c85b19c6ac608f6b8819d8ee8e08f8582b1fc26af6aca91620794dc2c652aa49b84cd91d470cac13b656c8638eb4ad93b04981979b3cbf60d222a38add9381f32c0259c07908dcf5d33256799e72bc6788521f72853bfdf08f21cc0f0aeb471954520d200452893f1460fa9fdd6406ecd09e0318d0d00a4a07bc99fec600a186ed8f5959c175e55a8a2e9fdfb53d407b3af3b2b31053eb405d0b11adbdc15a908eb3e1bf001a46101249e489f16599e9f80d1b503f9d5122ecf48987fbda8a81584f627fbc4f7478f5e3bf6a7f63650a93c835aa5083a3888e9868385c00e400c43cc67024c1c1122cbc62eebf2eb7cda0506aeccd93909c9dce353af0f3d2505d185f78fc0dc1107b7cbc0a3d79776313f3a68f3d3bb0b37ae4f6eb608e45e61564db18c856778ff2d4166dc2c41aaa9a7a61cf748bbff0299749efd009d17ae7ee9f60c62515c4643a8fe8ea16c1f7d1edb596ff32f37f568cf3b40208c8205ba556f48078a59456f843cc6209ce833842fa0f5aa4a856f1bc39fed25e903073194a84fe68912fcb640b9c6763b3124665d1fb02f8116eb54614a0a924bbebe824dcdcf13c5f53dfeac372ff6d87d374a38102bde4d4ecbf4de19b0852fd6a8de223ea0e9473534ff10e8f8392f78026288781aaae59caa31aebe370ad0903d08e9747bcd109120ed7e2416d699c14a8f5acd7eb9f862b432f31555a629d906530a676476cc07bbdb7fc97ac2983bfd331665c0a9d91a2ff6b8b60274223c0593e63853bec16f78368caba4836b5d3e0de4c3bddcb831e6eb888bbb369da85d31b885654ca33087d7b6ce6fa717921f7dafebf2630d51b84e4e3e1b4f2cd8953ebb362f68f9e7b992f7b82bcfb60f3401e104da0298ec50ea3ba0a1e0d5287cf1260421b06b75fadba20c8b37ff14179f5b0e6c1bec963526feee82fe956e015a0254a04dfeee5a10cc0b212668c433e07966217ef2def75abface5d4787dc2681c485554724e84db9edbeff0f3fcd0990faf3ba19df7a10e9f0d48f2418e4107f8248f79009e3f943f9a020b02943f78342a89aa812661d2085a002c8fa2ac889b5adf232af997428b923baf34c969e8080e514998fac6f473ff77237aadb0f35b122ab7f168686bfd60ac48c4cb6888fe8b308de75a48feba026ba2d377a0fa64e71fc9eddafdbd0a748ea6b367bd53e0755e9e566d1d6b3b65cd9ccc2d63a5752facce841519840ee205b2b55e17dfa7af19da6431960901adb1001e175581c37d8a318b9819924107dce38b7ec0230e1d4cddbf7e0f7f6aaf1d184fad92f1855770bd7822d9ee157d9fff1e128cdcb36257df75e457295c0c2bada86e8e994fb16dabd8383e7b8775cd72ccac01e20901e2afe9e16a587b8bf1d903fb2e75315f85c4c49aadf1b85573843375f49e17b854109febe2a0de3a3c5db9c1167d45f33e5fafbf151e192850e899b6ece4a8c7392c61f6fe755c3c175b75dd978c16a8f7a87eddf9e7ed7c28a69b8d10396b75bd10549b9a172a246b8cd901c4520d6a58512f1837c722c0e8f5741df70bb7e3a1183ca21df0d2602ab87fc9cab7cb44fc2a9602489d34a62865c8b9508a0b35d985e8a40bc24a115627eecaf1fe07fb6ddb49dc6822a4a6312c6d4c254a55714a42736273a22dfc4e7a9be8a088a86369e01e3745c64dda4624ba5f1b32dd87ca8e1f3061281c30ccbcc7a3414812d2cb41b72f874ed177dbe1acec706f9e19b4069829127a1c395692ab399d27e63ac25e25e4bd0c5506b3f0fd1b9a79839d6b726b09b1ace04b5418f244cff6e2b7f642fef9fcaebbff609511eda19fe36762213e9709c4bb0efcc9565c1f093cfe1bab6ae6c29d414c2d1b485676a72b525a95902fdc88e5367e7a34ec85186deafebdae842fc9b12c3f7e11188a087c9714d97780fa401122fd68a8209692569706dc11d3f499830e1f6f71d9a1d2c61c9e85256cf6bc8cbbd9931379acbb9c35fdcaee41100932e65a1af34753e0894879552582db1235005904a40e469a31654b381d712f8e26bc92f1e2494c910e06f1b05d2ba2712c0b6702422e0490628a564e9328b4700a21e3721adf82f8f72cbd3f735d2888ec9287e9f9027e33ed185b4f9ea1cb5381f91ce2117b6c9b45230871cc355417ab622ef39e901d2fd1045ad3a534e7d72a803a622b8f1173594a876c37561358bad7ad19039086e14151133a596d02914a8881c965684e281b1fae058cc53f4e194315311676dba806b1271f204e2194ee68baa1f0297a9cc0b1fb8ea981350e03fd89e93f3795cffbaae6c4989caf0368720b972f85153f599fb368c3004950c5aa59954d1965c87bcdb51d531f44d428b552651023b318315946426678683a2d9e73332cc799515ae199986d6d49fde31e05dd229b09fe7dd27d87ea3b61f1ee416512bbad0107d5fa2197b295c8d72744713fbba2a80fd63c003ef2aefafe815049c24d0cdd8ae45507f70bdb7fcd3f2dcee5362e5cc3a5276acea21253f95fc063a8cab1f4050eaf1326b901fb91e1e196e952b9d2eaa7ab826a04065d0417e74d02157cc73456248c4e9bbe94e4c086c95a058400150b0557ab637be72ecaa11b2d02f2802452dd6dc3ea49d19444cd34124ca0f05f4562238218e1eb11e03271acf6c0106d54c6f4fa78a63fe0fd64929bd6e0c779376ddc156ba2615a12553b61f34e9e423d754b2e4f85ad8aacf2b5a1ebb3c0811ad653453d3fa83a1aa73f8741953c10f32016e4c6964229665d1c944ba6c015f86fcb112957ad6b10d086adfdb93d609574ae9f5bded4e4f00da0e6fc6d7fc714747f46f4b9525582f0d784a9685e4445c406ee7002a82de4db7b4d1990ed56d36daa2d89d6fda4dd882262f37cb88e38e05f883fd1a07aa5e2c245f21752f21c006f70425b8317ad58f3e907575a3574fdea1592c88667260b6957d19865be5103540f9bb44781875870b26c73b7ed2d5644f65d3ecf6917e7832ca86f9dd5576b5f39f93e618d0663c0d2a269c0d163a045c8c700b905922aa49d2c083379a7dc332c409bfeeac8aa8da63c5dd218ca4a9835826e43abd2941e90ca3166a951db7ad7e38ec3b6cdb223cc18c76bc73241e583936ec48692c5592fb0cc320cd2febeb0760b944616e0464bdbe176bbb0ef3453adc86b05dd2c77b63302f8870048ed619f953f9a9f5992fe005225fb94d981d266499d8b0ae565f7a86c708f9d8c066d66e84cd5cc681e9804b2f248487d06179ad3d4e0c2e35544fe0d7b2660b66839b3a1c39ecc1b057de2f31f38fc3d9822161b32aa5c1e88bf8bbf672071752cecc48dc707b77fdda654bf234a13590a6feb1b8176af464db6d0b9376d149824f718a1381f297b905deeac74ac847a82084be4d0537e9d4d239c7544787cf60a59df2414d0ecdf2cba09e34c999e342aceeae570cf7181f4832a4c62dd2e21e60ba1699d0e5cfdc121935a55c986cfaf5511c513188401c4707d1926a13965c40e657e70a4c904624fefc13986c3c7f", 0x1000, 0x1}, {&(0x7f0000001b00)="ab98c2d2c935aae199d049ff60f227d6b188e6af4c145360c4b673", 0x1b, 0x6}, {&(0x7f0000001b40)="50b7ea1c0e340c1f82ebf020e83a8223a7cb78ce48d73bfb470dd03b901b332d8fc6a4ec4c8eab8038e3f7f384ee5c15981530e3b6e00ab1f45c4188896b39c7cf1f1db62ca33ad7b849cdb7860b5ab33a33217ea03acf47863acff6cbbabd322bce7474215f6b7cd868436e8c06f0ed1a931339947704d641064c8b91bde01ebc18265319e80ace3ead463cefc7dac6276547af6bac966670b9d12558b4adc56270e426fa1adace243c68322770817e24450f6d22990337328434a70c2b4f5d01a6981312fbd34d5f998937342197c54e476da3", 0xd4, 0x1}, {&(0x7f0000001c40)="b0f2e8402cf6da19e58233ae16306f439c355a0a54c385fb88b0ebc24e8b1d2870e39baf51189b9589c6b7aa71187135abbcb03ed9ec11124360d982582b77bb22dd685167d7b6a2d83cee150726e64f6d8980f18938924c84bb58089d9ec673c07da4e2c02390fc45606b27e598880e5594823261d2f6b0254015e6f0d2f4deae678f36b9b012b5bae9879a1390ae5da853c327813e1cac19a398a5e63bde511580bc983426416a73eaebfa826b5adc4069c57d7e91769a485846a9abe3505f0ef9679589c35120213e2272c3e8343d02ad95d32baa9fc8bbd65b9c4f6a7422ed214a9264e55992", 0xe8, 0x80000000}, {&(0x7f0000001d40)="0e4729ffc30863e0905f5ddb427c6de358d63c6b0b6c97880ec2ea657705bc90daf23ff70e1ec17ab8194bcc9258dd5ef2f4425123730bb79f4fddbda56decd73f09b4807f2d2ab5ca2f224f176b0ec251fded397ff63418e3d5cbed18b46b5d1309e7b5e2adfbb49febd55b5286ba5dbbcc539b9c22fa6516ba6539a16de7c6d4b2a57a93490940495ab3cceb9b0b578227914b06b18ae0cd3374220573bde5fe96a212", 0xa4}], 0x12006, &(0x7f0000001ec0)={[{@biosize={'biosize', 0x3d, 0xdbed37d}, 0x2c}, {@grpid='grpid', 0x2c}, {@gquota='gquota', 0x2c}, {@quota='quota', 0x2c}, {@uqnoenforce='uqnoenforce', 0x2c}]}) 16:56:33 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000007000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:33 executing program 2: r0 = socket(0x12, 0x2, 0x8) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000080)={0x0, 0x9, 0x0, 0x100000001, 0x4b1}, &(0x7f00000000c0)=0x18) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000100)={r1, 0x7f, 0x4, [0x7, 0x1f, 0x800, 0x800]}, &(0x7f0000000140)=0x10) r2 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x100000000, 0x10002) ioctl$KDSETKEYCODE(r2, 0x4b4d, &(0x7f0000000040)={0x7fff, 0x7}) unshare(0x400) r3 = socket$inet6(0xa, 0x2, 0x0) fchmod(r3, 0x0) 16:56:33 executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x101000, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) write$FUSE_NOTIFY_STORE(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYRES32], 0x4) mount$fuse(0x20000000, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x81003, &(0x7f0000000300)={{'fd', 0x3d}, 0x2c, {'rootmode', 0x3d}, 0x2c, {'user_id', 0x3d}, 0x2c, {'group_id', 0x3d}, 0x2c}) 16:56:33 executing program 0: r0 = socket$inet6(0xa, 0x4, 0xca) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f0000000040)={0xfffffffffffffeff, 0x3f, 0x81}) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @dev={0xfe, 0x80}}, 0x2) 16:56:33 executing program 5: socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r0 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r0, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r0, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:33 executing program 2: r0 = socket$inet6(0xa, 0x5000000000002, 0xfffffffffffffffe) ioctl(r0, 0x8912, &(0x7f0000000040)="025c727a5153c83d6d345fcd3cead3abcaf760298431b142f02e23c0eb276b16f593c73c92a3fa7ab90495730c47c6220c8a9e721c9e3df3203ca1491a93") getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f00000001c0)={'ipvs\x00'}, &(0x7f0000000180)=0x1e) 16:56:33 executing program 6: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mount(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000380)='./file0\x00', &(0x7f0000000300)='cgroup2\x00', 0x0, 0x0) mkdir(&(0x7f0000000240)='./file0//ile0/file0\x00', 0x0) rmdir(&(0x7f0000000600)='./file0//ile0\x00') r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cgroup.stat\x00', 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000001600)=""/4096, 0x1000}], 0x1, 0x0) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000140)={&(0x7f00000000c0)='./file0\x00'}, 0x10) ioctl$KDGKBMODE(0xffffffffffffffff, 0x4b44, &(0x7f0000000200)) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000180)={0x0}, &(0x7f00000002c0)=0xc) perf_event_open(&(0x7f0000000400)={0x2, 0x70, 0x8, 0x7, 0x7, 0x100000000, 0x0, 0x9, 0x8, 0xf, 0x80000001, 0x20, 0x200, 0x9, 0x7, 0x9, 0x6, 0x7fffffff, 0x8, 0x15, 0x1, 0xffff, 0x9, 0x8, 0xff, 0x2, 0x8000, 0x0, 0x10001, 0x100000000, 0x100000000, 0x401, 0x5, 0x101, 0x5, 0x0, 0xa4, 0x8, 0x0, 0x4, 0x5, @perf_config_ext={0x8, 0x7}, 0x10, 0xfffffffffffffffc, 0x2, 0x7, 0x1f, 0x800, 0x9}, r1, 0x3, 0xffffffffffffff9c, 0x0) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000280)="025cc83d6d345f8f762070") bpf$MAP_CREATE(0x14, &(0x7f0000000000)={0x1}, 0x2c) 16:56:33 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c4000000007ce000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 276.481583] binder: 19473:19479 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 276.490301] binder: 19473:19479 unknown command 4743953 [ 276.511515] binder: 19473:19479 ioctl c0306201 20000000 returned -22 16:56:33 executing program 7: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000fafff7)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000480)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000a5f000/0x1000)=nil}) prctl$setfpexc(0xc, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000040)=ANY=[@ANYBLOB="0100000000010000034d564b0000000001"]) r3 = socket$inet6(0xa, 0x1000000000002, 0x0) mount$9p_xen(&(0x7f0000000000)='*\x00', &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='9p\x00', 0x200004, &(0x7f0000000100)={'trans=xen,', {[{@version_L='version=9p2000.L', 0x2c}, {@version_9p2000='version=9p2000', 0x2c}, {@afid={'afid', 0x3d, 0x8}, 0x2c}, {@cachetag={'cachetag', 0x3d, '$em0:-'}, 0x2c}, {@access_client='access=client', 0x2c}, {@access_any='access=any', 0x2c}, {@msize={'msize', 0x3d, 0x4}, 0x2c}, {@aname={'aname', 0x3d, '/dev/kvm\x00'}, 0x2c}, {@cache_mmap='cache=mmap', 0x2c}, {@version_L='version=9p2000.L', 0x2c}]}}) ioctl(r3, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$KVM_RUN(r2, 0xae80, 0x0) 16:56:33 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$dspn(&(0x7f0000000100)='/dev/dsp#\x00', 0x7, 0x80002) sendmsg$rds(r1, &(0x7f0000000ec0)={&(0x7f0000000140)={0x2, 0x4e21, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10, &(0x7f0000000b80)=[{&(0x7f0000000180)=""/80, 0x50}, {&(0x7f00000004c0)=""/152, 0x98}, {&(0x7f0000000580)=""/253, 0xfd}, {&(0x7f0000000680)=""/228, 0xe4}, {&(0x7f0000000780)=""/194, 0xc2}, {&(0x7f0000000200)=""/27, 0x1b}, {&(0x7f0000000880)=""/156, 0x9c}, {&(0x7f0000000940)=""/188, 0xbc}, {&(0x7f0000000a00)=""/169, 0xa9}, {&(0x7f0000000ac0)=""/131, 0x83}], 0xa, &(0x7f0000000d80)=[@rdma_dest={0x18, 0x114, 0x2, {0x400, 0xfffffffffffffffe}}, @rdma_dest={0x18, 0x114, 0x2, {0x8e, 0x7ff}}, @cswp={0x58, 0x114, 0x7, {{0xc715, 0x9b0f}, &(0x7f0000000240)=0xe44b, &(0x7f0000000c40)=0x4, 0x3ff, 0xffffffff80000001, 0x1c, 0x4, 0x44, 0x9}}, @mask_fadd={0x58, 0x114, 0x8, {{0xb, 0xfffffffffffffff9}, &(0x7f0000000c80)=0x200, &(0x7f0000000cc0)=0x10000, 0x0, 0x80000001, 0x1f, 0x5, 0x40, 0xffffffff}}, @mask_cswp={0x58, 0x114, 0x9, {{0x400, 0x5}, &(0x7f0000000d00)=0x8, &(0x7f0000000d40)=0x8, 0x1, 0x0, 0x5d, 0xfff, 0x60, 0x5}}], 0x138, 0x40000}, 0x20000080) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000000)=""/148, 0x94}], 0x1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='oom_adj\x00') preadv(r2, &(0x7f0000000480)=[{&(0x7f0000000280)=""/209}, {&(0x7f0000000380)=""/242}], 0x10000000000002a1, 0x0) 16:56:33 executing program 5: ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r0 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r0, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r0, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 276.659532] binder: 19502:19507 BC_REQUEST_DEATH_NOTIFICATION invalid ref 117440512 [ 276.692209] binder: 19502:19507 unknown command 4743953 [ 276.702222] binder: 19502:19507 ioctl c0306201 20000000 returned -22 16:56:34 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f00000001c0)={@ax25={0x3, {"04614abc5d8f03"}, 0x3}, {&(0x7f0000000100)=""/121, 0x79}, &(0x7f0000000180), 0x1c}, 0xa0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="fc000000190001030000000000000000ac14140000000000000000000000000000000000000000000000ffff0000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000044000500e00000010000000000000000000000000000000000000000ffff0000e00000020000000000000000000000000000000003000800000000000000000000000000"], 0x3}, 0x1}, 0x0) dup3(r0, r0, 0x80000) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x5, {0x7, 0x1b, 0x1, 0x24084, 0xfff, 0x80000000, 0x7, 0x4}}, 0x50) 16:56:34 executing program 6: r0 = socket$netlink(0x10, 0x3, 0x9) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000001600)={'team0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000004fc8)={&(0x7f0000016000)={0x10}, 0xc, &(0x7f000000b000)={&(0x7f0000001680)=@ipv4_getaddr={0x20, 0x16, 0x1, 0x70bd2d, 0x25dfdbfe, {0x2, 0x3f, 0x4, 0x0, r1}, [@IFA_LOCAL={0x8, 0x2}]}, 0x20}, 0x1, 0x0, 0x0, 0xfffffffffffffffc}, 0x0) 16:56:34 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000020dd4000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:34 executing program 0: r0 = timerfd_create(0x0, 0x0) timerfd_settime(r0, 0x3, &(0x7f0000000140)={{0x4000000000000000}, {0x0, 0x989680}}, &(0x7f0000000100)) syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x5, 0x2000) timerfd_settime(r0, 0x0, &(0x7f0000000000)={{0x77359400}, {0x77359400}}, &(0x7f00000000c0)) 16:56:34 executing program 7: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x82040, 0x0) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) r1 = socket$alg(0x26, 0x5, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000680)='mountstats\x00') bind$alg(r1, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4106(gcm(aes))\x00'}, 0x58) r3 = accept4$alg(r1, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000000c0)="4cd4d394cb3c9f695ae515eff31cc50a53b945a51964f0df30e63409", 0x1c) accept$alg(r1, 0x0, 0x0) sendfile(r3, r2, &(0x7f000025d000), 0x734) 16:56:34 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$alg(0x26, 0x5, 0x0) openat$vsock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vsock\x00', 0x40202, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4309(morus1280-avx2)\x00'}, 0x58) getsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000080), &(0x7f00000000c0)=0xb) 16:56:34 executing program 5: ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r0 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r0, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r0, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:34 executing program 1: r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000), 0x0, 0x2}}, 0x20) r1 = open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) sendfile(r0, r1, &(0x7f0000d83ff8), 0x8000fffffffe) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f0000000040), &(0x7f0000000080)=0x4) lseek(r0, 0x68e5, 0x4) 16:56:34 executing program 6: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = syz_open_dev$audion(&(0x7f0000000200)='/dev/audio#\x00', 0xda, 0x40) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000240)=0x7, 0x4) syz_emit_ethernet(0x7e, &(0x7f0000000280)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff0800450000700000000000019078ac1414bbac1414110c04907800002802450000000000000000010000ac1414aaac141400084000000000000000000000e00000020000000070dac2cb07361d0a19e0000001fffeffffff00000007e000000100000059603204edd0e5061ed1948613aad0e3f4691582061b9e18df29b6ab41b08604988204336efabc5c4bf007b49813de6cc24c705a5f1babd2da7f0d"], &(0x7f0000000000)) ioctl$void(r0, 0xc0045c77) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000580)=ANY=[@ANYBLOB="020b09002d00000029bd7000ffdbdf25020013000500000026bd700005350000040007000800000004000000000000008d000000000000000800000000000000040003000600000002000000000000000700000000000000f7ffffffffffffff05001a00ff020000000000000000000000000001ac1414aa00000000000000000000000003001014030017006c80000002004e24e0000001000000000000000002000b00018000000400000000000000532df090985f8fea3f1b01716a95711876f01418531b08f34edb646f69d1462c2ea2a471bc57b7afa794f827dd003f98311f1d712104c3216f61e7e5a9ccc5f2391c87a31bcce39ec45a0a231a5f8d5dad1126a13eedaa1fe9c5310d009677de7184e1d0c305a3a2200532b3bc58b42b4d5b51ffff311b53df67c28a6146d3906afcce6cfa7dba3d5311f8bc4902333ef83c9da999b4fd9b6e7db6f033923f6fd827ef530000000098fd58ccef6f130481f88904fd4259f40f4d3b585ffa77d7c98970de6e740ee138f2b239be54b884e9c76ce7fd0371e9b416e4d0d99b341fc99aac49fb1f5f61075e7ac2956d085f82db8b44f5237e6bd08092c976d1ce0a2e38b45bd823e2f71347dd9ac988e0978be2b61ae39b8d74ea09212a6c1a6ba875edee44a3a6f84b5aa0ca350ded57272395b5f57491b68cc12e07bb22a24134ac0c14129bbaa900000000000000000000000000000000"], 0x168}, 0x1}, 0x4001) r2 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0xa13d, 0x4000) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f00000000c0), &(0x7f0000000100)=0x8) setsockopt$llc_int(r2, 0x10c, 0x8, &(0x7f0000000080)=0x5, 0x4) 16:56:34 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x3, 0x2) getsockopt(r1, 0x0, 0xd0, &(0x7f00000005c0)=""/203, &(0x7f0000000040)=0x3ad) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000000)=0x0) fcntl$lock(r1, 0x5, &(0x7f0000000080)={0x3, 0x2, 0x7, 0x2, r2}) 16:56:34 executing program 7: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = dup(r0) getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000080)={0x0, 0x80, 0x6, [0x0, 0x4, 0x80, 0x7, 0x2, 0x3]}, &(0x7f00000000c0)=0x14) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r1, 0x84, 0x5, &(0x7f0000000100)={r2, @in6={{0xa, 0x4e23, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x9a}}}, 0x84) bind(r0, &(0x7f0000000000)=@un=@file={0x0, './file0\x00'}, 0x80) 16:56:34 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000030000000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:34 executing program 5: ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r0 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r0, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r0, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 276.962410] binder: 19539:19552 BC_REQUEST_DEATH_NOTIFICATION invalid ref 218234880 [ 276.975698] binder: 19539:19552 unknown command 4743953 [ 276.993544] binder: 19539:19552 ioctl c0306201 20000000 returned -22 16:56:34 executing program 2: timer_create(0xfffffffffffffff8, &(0x7f0000000180)={0x0, 0x0, 0x10000000001, @thr={&(0x7f000022f000), &(0x7f0000298000)}}, &(0x7f0000a7e000)) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$sndseq(r0, &(0x7f00000001c0)=[{0x80, 0x1f, 0x100000001, 0x3, @tick=0x1, {0x401, 0x80}, {0x3, 0x9}, @quote={{0x20, 0x6}, 0x3, &(0x7f0000000140)={0x5, 0x6, 0x401, 0x0, @tick=0x7, {0x5, 0x385}, {0x5, 0x6}, @addr={0x100000000, 0xfffffffffffffe00}}}}], 0x30) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f0000000100)={{0x77359400}, {0x0, r1+30000000}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000080)={{}, {0x77359400}}, &(0x7f0000000040)) 16:56:34 executing program 4: sched_setattr(0x0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x1}, 0x0) r0 = socket(0x10, 0x80002, 0x0) bind$netlink(r0, &(0x7f0000177ff4)={0x10, 0x0, 0x1}, 0xc) connect$netlink(r0, &(0x7f0000000000)=@proc={0x10, 0x0, 0x1}, 0xc) sendmmsg$alg(r0, &(0x7f0000000140)=[{0x0, 0x0, &(0x7f0000000100), 0x0, &(0x7f0000000100)}], 0x492492492492805, 0x0) recvmmsg(r0, &(0x7f0000002940)=[{{&(0x7f0000002580)=@ax25, 0x80, &(0x7f0000002800), 0x0, &(0x7f0000002840)=""/198, 0xc6}}], 0x1, 0x0, &(0x7f0000002ac0)) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f0000000040)={0x4, 0x4}) r1 = syz_open_dev$sndpcmp(&(0x7f00000000c0)='/dev/snd/pcmC#D#p\x00', 0x7f, 0x100) ioctl$KDSKBMODE(r1, 0x4b45, &(0x7f00000001c0)) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000100)=0x0) write$P9_RGETLOCK(r1, &(0x7f0000000200)=ANY=[@ANYBLOB="280000003701000201000000000000000000000000000000", @ANYRES32=r2, @ANYBLOB="0a002c5196bcd992073e69c218e925fd1b5d9343"], 0x28) 16:56:34 executing program 7: syz_mount_image$hfsplus(&(0x7f0000000040)='hfsplus\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000001740), 0x0, &(0x7f0000001840)={[{@part={'part', 0x3d}, 0x2c}]}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x408180, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f00000000c0)={{0xffffffffffffffff, 0x2, 0x4, 0x1, 0x8}}) 16:56:34 executing program 6: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) gettid() sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00002fffa8)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1=0xe0000001}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1=0xe0000001}}]}, 0x50}, 0x1}, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/stat\x00') getdents64(r1, &(0x7f0000000080)=""/101, 0x2b) getdents(r1, &(0x7f0000000140)=""/125, 0x7d) 16:56:34 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0xb, 0x7f, 0x7, 0x5, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r0, &(0x7f0000000580)="e06721211eb0995ab2752c03e0dbacbdfdcd66ea08d761e757c17bae0dc6a54b6364dbbb78abe1ba0eae75bc5c435dc424fd86f154c0bc07be46332f6a81a931ea2b50767b73225e885ecc37a0a88d515b8bc1443dd3907ab0dc1fa4311ffeeab5c1c997d627d1e0acb3b5c69016ff49d5628f36339bf03f94ebb327e7e24efab6cd77dbdf8e2d2e53f0c2d3886540f53225dab2081633b1a3368fbc542320cdf8e34935251230791afbd56eb6c5cc5b6d8f205fb3ed014c159a47d329198a80530964f90218c911064cd0ca2a1c877754f0aa83afba2a4558f655bf4222d187e1375fd46eab044b99a672c55972faba80d88d91237d3e84d683d3a4116d1e9993a5992029d975acd20618052925b28b1b24ff0aaf4b34cb339e29293b86bfc14409418e20ba110f60215116aab7d084dcc84983", &(0x7f00000002c0)="ce5bf66c30c24daca6b3879fd8c76fafe11743d78a3a3cebdd66e8d706f102de6dca941e4f66f56f7da18295d73ff163c63a4e4c681c4b5b47a32af6064efd872ab5c47fa321caf0421b1d0beec0a4e8a535e08f145e86c634c1af97e69ba4e02f3fc25a441610923c13f39c33d23562", 0x200}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000180)={r0, &(0x7f0000000000)="827021baca", &(0x7f0000000240)=""/98}, 0x18) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000000)={r0, &(0x7f0000000180), &(0x7f0000000080)=""/140}, 0x18) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={r0, &(0x7f0000000300), &(0x7f0000000080)}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000400)={r0, &(0x7f0000000180), &(0x7f0000000300)}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000200)={r0, &(0x7f0000000180)}, 0x10) 16:56:34 executing program 5: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:34 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c4000d40d0200000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:34 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$bt_hidp(0x1f, 0x3, 0x6) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000040)=0x7fff, 0x4) clock_gettime(0x5, &(0x7f0000000000)) [ 277.164748] binder: 19582:19590 BC_REQUEST_DEATH_NOTIFICATION invalid ref 196608 [ 277.180542] binder: 19582:19590 unknown command 4743953 [ 277.187106] binder: 19582:19590 ioctl c0306201 20000000 returned -22 [ 277.309819] hfsplus: unable to find HFS+ superblock 16:56:34 executing program 0: r0 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bind$nfc_llcp(r0, &(0x7f0000000000)={0x27, 0x1, 0x0, 0x0, 0x0, 0x0, "8811e78754a539d39c2bd6a40fa8c8aa024d86cdc834bc921c0525fec2541e21ccf67e1d7b55cabe9e068dd58ce565aa9a9d325ebac7627ffe7a54cdbd77b3", 0x2b}, 0x60) listen(r0, 0x0) setsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000180)={0x0, 0x2710}, 0x10) r1 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x1, 0x10000) accept$packet(r1, &(0x7f0000001540), &(0x7f0000001580)=0x14) 16:56:34 executing program 7: r0 = memfd_create(&(0x7f0000000140)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x80ce63) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000040)={&(0x7f0000000000)='./file0\x00', 0x0, 0x8}, 0x10) lseek(r0, 0x0, 0x3) [ 277.337726] binder: 19612:19620 BC_REQUEST_DEATH_NOTIFICATION invalid ref 34460672 [ 277.350071] hfsplus: unable to find HFS+ superblock [ 277.358975] binder: 19612:19620 unknown command 4743953 [ 277.364546] binder: 19612:19620 ioctl c0306201 20000000 returned -22 16:56:35 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r1, 0xc0505405, &(0x7f0000000000)={{0xffffffffffffffff, 0x2, 0xc6d, 0x3, 0x470efa51}, 0x8001, 0x401, 0x5}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioperm(0x0, 0x4, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000580), 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 16:56:35 executing program 6: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x37, &(0x7f0000000000)=ANY=[@ANYBLOB="0000ff00"], 0x8) r1 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000000040)=0x2, 0x4) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x40, 0x0) getsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f00000000c0)=@assoc_id=0x0, &(0x7f0000000100)=0x4) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r2, 0x84, 0x12, &(0x7f0000000280), &(0x7f00000002c0)=0x4) getsockopt$inet_sctp_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f0000000140)={r3, 0x7, 0x7, 0x55, 0x4, 0x3}, &(0x7f0000000200)=0x14) finit_module(r1, &(0x7f0000000240)='/dev/vcs\x00', 0x1) 16:56:35 executing program 5: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:35 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000000000600000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:35 executing program 2: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000880)='./file0\x00', &(0x7f0000005440)='hugetlbfs\x00', 0x0, &(0x7f0000001d80)) syz_mount_image$ntfs(&(0x7f0000000000)='ntfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, &(0x7f0000000500), 0x1020, &(0x7f0000000080)) sync() 16:56:35 executing program 0: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/fuse\x00', 0x2, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x0, 0xffffffffffffffff) mount$fuseblk(&(0x7f0000000000)='/dev/loop0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000200)='fuseblk\x00', 0x0, &(0x7f0000000440)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x6000}, 0x2c, {'user_id', 0x3d}, 0x2c, {'group_id', 0x3d}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x800}, 0x2c}]}}) r1 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x6, 0x2) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x2, &(0x7f00000000c0)={0xffffffffffffffff}, 0x13f, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000240)={0x3, 0x40, 0xfa00, {{0xa, 0x4e22, 0x7ff, @local={0xfe, 0x80, [], 0xaa}, 0x3}, {0xa, 0x4e22, 0x1, @remote={0xfe, 0x80, [], 0xbb}, 0x81}, r2, 0x9c9}}, 0x48) 16:56:35 executing program 7: r0 = socket$inet6(0xa, 0x80803, 0xff) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) getsockopt$IPT_SO_GET_REVISION_TARGET(r1, 0x0, 0x43, &(0x7f0000000140)={'ipvs\x00'}, &(0x7f0000000180)=0x1e) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vsock\x00', 0x200, 0x0) setsockopt$sock_int(r1, 0x1, 0x5, &(0x7f0000000000)=0xa5ee, 0x4) ioctl$sock_bt_hidp_HIDPGETCONNINFO(r2, 0x800448d3, &(0x7f00000001c0)={{0x1, 0x5, 0x7, 0x6b1, 0x8, 0x2}, 0xfffffffffffffffd, 0x2, 0x101, 0x9, 0xfffffffffffffffb, "a2066102884b7bb1923d041c6b54cb2dc481f7235a9be06627576993a8a8dcf93e04a25daeb805bba41c9f5c23da60909c31d5096bf0bdfaeb1caf48bfb95aedaceca362ac8b12a4adcac2f29cff52c9259b79aca25d3587dae72f6ad8891c2d4c559eeefe514c10b820209c3f4e32f1f5abbc908a4bcdcc885872a01bcb42b0"}) connect$inet(r1, &(0x7f0000593000)={0x2, 0x0, @broadcast=0xffffffff}, 0x10) sendto$inet(r1, &(0x7f0000000000), 0xfe88, 0x0, 0x0, 0xfffffffffffffce9) [ 277.954991] binder: 19644:19651 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 277.963695] binder: 19644:19651 unknown command 4743953 [ 277.973451] binder: 19644:19651 ioctl c0306201 20000000 returned -22 [ 277.993235] Unknown ioctl -2147202861 [ 278.015140] binder: 19644:19651 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 278.023866] binder: 19644:19651 unknown command 4743953 [ 278.031818] binder: 19644:19651 ioctl c0306201 20000000 returned -22 [ 278.060567] Unknown ioctl -2147202861 16:56:35 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x123400, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000080)={0x80002009}) r3 = eventfd(0x7ff) r4 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r4, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r3}) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_IRQFD(r5, 0x4020ae76, &(0x7f0000000000)={r3}) 16:56:35 executing program 1: socketpair(0x5, 0x4, 0x9, &(0x7f0000000000)={0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r0, &(0x7f0000000140)={0xf, 0x8, 0xfa00, {r1, 0x5}}, 0x10) syz_emit_ethernet(0x6e, &(0x7f0000000080)={@link_local={0x1, 0x80, 0xc2}, @local={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff}, [], {@ipv6={0x86dd, {0x0, 0x6, "c8fba2", 0x38, 0x40000000003a, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @icmpv6=@param_prob={0x4, 0x3, 0x0, 0x0, {0x0, 0x6, "b79208", 0x0, 0x2f, 0x0, @dev={0xfe, 0x80}, @local={0xfe, 0x80, [], 0xffffffffffffffff}, [], "1d3053a06de46b1c"}}}}}}}, 0x0) 16:56:35 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c4000000000000000004c0000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:35 executing program 5: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:35 executing program 6: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x5) r3 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x3, 0x28900) getsockopt$bt_rfcomm_RFCOMM_LM(r3, 0x12, 0x3, &(0x7f0000000040), &(0x7f0000000080)=0x4) fsync(r1) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4018aebd, &(0x7f0000000140)={0x5fffff, r2}) dup3(r0, r1, 0x0) 16:56:35 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$xdp(0x2c, 0x3, 0x0) bind$xdp(r0, &(0x7f0000000080)={0x2c}, 0x10) 16:56:35 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/icmp6\x00') acct(&(0x7f00000001c0)='./file0\x00') sendto$inet6(r0, &(0x7f00000000c0)="37193cac9c512ce10667a6a47bb37afcaf17dff26e37f283a997999c23bfeb48c0db0d36662fc0208233af059937da18e28dca02db0549769fa20d54d383acb7779353a6be4d23e4005ce83339a59d643e8467802b7c73e16a420ac762b05954d3f3ae43830981a2f27951ca0a42568973ee6dbd1e6da90a4e57c045b9d8703705775eb3c544a6c2d9426de46cf29aa248f2222be33b7e57a13492c0cb9af7bd", 0xa0, 0x4000, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @dev={0xfe, 0x80, [], 0x1d}, 0xfffffffffffffffe}, 0x1c) r1 = socket(0x10, 0x3, 0x80020000000002) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000280)=0x1) r2 = gettid() write$cgroup_pid(r0, &(0x7f0000000300)=r2, 0x12) setsockopt$inet6_tcp_TLS_RX(r1, 0x6, 0x2, &(0x7f0000000040)={0x303, 0x33}, 0x4) ioctl$sock_ifreq(r1, 0x89f2, &(0x7f00000002c0)={'ip6_vti0\x00', @ifru_data=&(0x7f0000000000)="b06f31673d3da2b793d4f9a507e3c9133ba7ce8f5e6e538ecf8829b08f7f4aae"}) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r1, 0x29, 0xd3, &(0x7f0000000340)={{0xa, 0x4e21, 0x7, @local={0xfe, 0x80, [], 0xaa}, 0x1}, {0xa, 0x4e22, 0x10001, @mcast1={0xff, 0x1, [], 0x1}, 0x3}, 0x4, [0x8, 0x2, 0x3ff, 0x100000001, 0x7, 0x1, 0xd8, 0x7fff]}, 0x5c) 16:56:35 executing program 7: r0 = socket(0x10, 0x80002, 0x0) bind$netlink(r0, &(0x7f0000177ff4)={0x10, 0x0, 0x1}, 0xc) connect$netlink(r0, &(0x7f00000000c0)=@kern={0x10}, 0xfffffffffffffccf) sendmmsg$alg(r0, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000100), 0x0, &(0x7f0000000100)}], 0x49249b7, 0x0) recvmmsg(r0, &(0x7f0000002940)=[{{&(0x7f0000002580)=@ax25, 0x80, &(0x7f0000002800), 0x0, &(0x7f0000002840)=""/198, 0xc6}}], 0x1, 0x0, &(0x7f0000002ac0)) [ 278.324257] binder: 19684:19691 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 278.333167] binder: 19684:19691 unknown command 4743953 16:56:35 executing program 2: r0 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x800, 0x0) ioctl$FIONREAD(r0, 0x541b, &(0x7f0000000100)) accept$unix(r0, &(0x7f0000000140), &(0x7f00000001c0)=0x6e) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000080)=0x2, 0x4) r2 = socket$inet6(0xa, 0x3, 0x9010000000000084) sendto$inet6(r2, &(0x7f0000000000)="482e0000000000000002d61d02b1baa9", 0x10, 0x0, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x1c) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f0000000200)='-posix_acl_accesssystem\x00') 16:56:35 executing program 6: syz_emit_ethernet(0x46, &(0x7f0000000700)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "c22df7", 0x10, 0x2b, 0x0, @dev={0xfe, 0x80}, @local={0xfe, 0x80, [], 0xaa}, {[], @dccp={{0x2b00, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "0087ae", 0x0, "ca8345"}}}}}}}, &(0x7f0000000000)={0x0, 0x0, [0x0, 0x0, 0xd12, 0x2]}) r0 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x0, 0x28002) write$P9_RWSTAT(r0, &(0x7f0000000080)={0x7, 0x7f, 0x1}, 0x7) 16:56:35 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = accept4(0xffffffffffffffff, &(0x7f0000000440)=@un=@abs, &(0x7f00000004c0)=0x80, 0x80800) getsockname$inet(r0, &(0x7f0000000500)={0x0, 0x0, @multicast1}, &(0x7f0000000540)=0x10) rt_sigsuspend(&(0x7f0000000040)={0x4}, 0x8) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x4, 0x31, 0xffffffffffffffff, 0x0) accept$alg(r0, 0x0, 0x0) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) connect$vsock_dgram(r1, &(0x7f0000000000)={0x28, 0x0, 0x0, @my}, 0x10) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0x8000, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r2, 0xc0305710, &(0x7f0000000100)={0x1, 0x2, 0xe3e, 0x8001}) ioctl$int_in(r1, 0x5473, &(0x7f0000000080)=0x2ad) 16:56:35 executing program 1: r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000040)={0xffffffffffffff9c}) setsockopt$IP_VS_SO_SET_STARTDAEMON(r1, 0x0, 0x48b, &(0x7f0000000080)={0x0, 'veth1\x00'}, 0x18) clock_nanosleep(0xfdfffffffffffff4, 0x0, &(0x7f0000000000)={0x77359400}, 0x0) r2 = gettid() r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000280)='/dev/audio\x00', 0x242c00, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@remote}}, &(0x7f00000003c0)=0xe8) prctl$setendian(0x14, 0x1) lstat(&(0x7f0000000680)='./file0/file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuseblk(&(0x7f0000000100)='/dev/loop0\x00', &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuseblk\x00', 0x800000, &(0x7f00000004c0)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id', 0x3d, r4}, 0x2c, {'group_id', 0x3d, r5}, 0x2c, {[{@default_permissions='default_permissions', 0x2c}, {@default_permissions='default_permissions', 0x2c}, {@max_read={'max_read', 0x3d, 0x401}, 0x2c}, {@blksize={'blksize', 0x3d}, 0x2c}, {@max_read={'max_read', 0x3d, 0x4}, 0x2c}, {@allow_other='allow_other', 0x2c}, {@default_permissions='default_permissions', 0x2c}, {@blksize={'blksize', 0x3d, 0x800}, 0x2c}, {@blksize={'blksize', 0x3d, 0x400}, 0x2c}, {@allow_other='allow_other', 0x2c}]}}) prlimit64(r2, 0xf, &(0x7f00000000c0)={0x23, 0x106}, &(0x7f0000000140)) 16:56:35 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:35 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000000007cb0000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 278.389239] binder: 19684:19691 ioctl c0306201 20000000 returned -22 [ 278.402606] irq bypass consumer (token 00000000ec040eff) registration fails: -16 16:56:35 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") unshare(0x40000000) r1 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x7fff, 0x1) setsockopt$IP_VS_SO_SET_EDIT(r1, 0x0, 0x483, &(0x7f0000000240)={0x16, @broadcast=0xffffffff, 0x4e21, 0x4, 'nq\x00', 0x4, 0xffffffff80000000, 0x35}, 0x2c) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x1000}) setsockopt$IP_VS_SO_SET_STARTDAEMON(r2, 0x0, 0x48b, &(0x7f0000000080)={0x2, 'lo\x00'}, 0x18) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000000100)={0x0, 0xde, "effea49ede03a81775e32447636d6ccca44e8faa4c6049616ec637dad8390cf078ad92b23e5f98bda010b0cef986614901681b7efce97ad74366d9435f468f156e80ab94c6b32264881dae6647491f8d8560ddb92f56e8ff5ef0e48cd91a218adf671ef0bceb778a6ad86e1d16035b32ac961298187245ab26c423f4998fcd53cdd0e832767f25cc2bed938bdea1a7721fdbfc1fca3ea2e267e1d95a6660211c520ccfb543bfc1c095e29df57eb09a4aea503e2863f685d4c1ccfef32fe1a5ce13f9734a854ee001347e427ae5d1c2a960488eb7e36bce9353d373079554"}, &(0x7f0000000000)=0xe6) setsockopt$inet_sctp_SCTP_RTOINFO(r3, 0x84, 0x0, &(0x7f0000000200)={r4, 0x7, 0x1, 0x1}, 0x10) setsockopt$IP_VS_SO_SET_STARTDAEMON(r3, 0x0, 0x48b, &(0x7f00000005c0)={0x1, 'lo\x00'}, 0x18) [ 278.450170] irq bypass consumer (token 00000000374eaa49) registration fails: -16 16:56:35 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_SIGNAL_MASK(0xffffffffffffffff, 0x4004ae8b, &(0x7f0000000000)=ANY=[@ANYBLOB="ae0fbb"]) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000000), 0x1000000000000040) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 16:56:35 executing program 6: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000040)=0xc) setresuid(r1, r1, r1) r2 = getpid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f000064e000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f00005ebff8)=0x80000000000003f) fcntl$setownex(r3, 0xf, &(0x7f0000704000)={0x0, r2}) recvmsg(r4, &(0x7f000095cfc8)={&(0x7f0000893ff8)=@sco, 0x8, &(0x7f00000a4fb0), 0x0, &(0x7f0000b30000)}, 0x0) r5 = dup2(r3, r4) sendmsg$alg(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000180)='-', 0x1}], 0x1, &(0x7f0000000200)}, 0x0) 16:56:35 executing program 1: r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x7f, &(0x7f00000001c0)="62d24c296bdedffbd3587918f7ceb24a27ebd1f7f2b4974aa67d8d035991a49f0c2a12707527b3c468ab63c86afd8f162b472296a4f0d8f181f1f14faca06db269772ecc960f6a8e62ee9cbe7ba50b4e235ec3758cc5d327f2de355052abb57daec9c114d9322da83be2d9afb0d6ae983642d486ff80bcd3b4f913d216219663cf62f980ac87ed1fec93968a1aa9d48669b29e0eec68227b98d91fd52b3d34bdc9877ec7fb75da88592c1af96c7baf0314ea38ad6276bf96f1cfd2215cd7f4eff73d59d88413e1ab6a991d519f39ab2e6c1aac295b72bf15d6dd8ef01daa5930a3372344b06ecde8d16d932bf05a30be1d3358") ioctl(r1, 0x8912, &(0x7f0000000080)="025cc83d6d345f8f762070") r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f000014f000)={&(0x7f00003c7ff4)={0x10}, 0xc, &(0x7f00000bfff0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="b8000000190001000000000000000000ff010000000000000000000000000001e000000100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000545f105a427127b92620ef00000000000000000000000000000000000000000000000000000000000000000000000000000000000c00000000edffffffffffffff0000000000000000000000000000000000000000000000000000e8f0e81fe74105c5ee4bfa97e39df9ea19a83c22ccbf82"], 0xb8}, 0x1}, 0x0) setsockopt$inet6_mtu(r2, 0x29, 0x4c, &(0x7f0000000000), 0x4) listen(r3, 0x7) 16:56:35 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:35 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c40000000004c000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 278.588671] binder: 19729:19733 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 278.597483] binder: 19729:19733 unknown command 4743953 [ 278.606075] binder: 19729:19733 ioctl c0306201 20000000 returned -22 [ 278.618382] IPVS: ftp: loaded support on port[0] = 21 [ 278.653354] IPVS: sync thread started: state = BACKUP, mcast_ifn = lo, syncid = 0, id = 0 [ 278.653719] IPVS: You probably need to specify IP address on multicast interface. [ 278.669863] IPVS: Error connecting to the multicast addr [ 278.683045] IPVS: ftp: loaded support on port[0] = 21 16:56:36 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:36 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000070000000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 278.756305] binder: 19747:19752 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 278.764976] binder: 19747:19752 unknown command 4743953 [ 278.772373] binder: 19747:19752 ioctl c0306201 20000000 returned -22 16:56:36 executing program 2: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x200000, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e24, @multicast2=0xe0000002}, 0x10) r1 = socket(0x11, 0x4000000000080002, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x10031, 0xffffffffffffffff, 0x0) mq_timedsend(r0, &(0x7f0000000140)="181271a48f2c16ee166e7169ecea5d797faabd194a0b12c96afcb155b75b63debdc1fe37704a7bbb666c0344847bcc3a10e67e0d43a0f7aee629fd26f38f60b43ec83f3eff07c75e7e7736805611685ef0c2feabeb", 0x55, 0x4, &(0x7f00000001c0)={0x0, 0x1c9c380}) sendmmsg(r1, &(0x7f0000000080)=[{{&(0x7f0000000040)=@l2={0x1f}, 0x80, &(0x7f0000000300), 0x0, &(0x7f0000000000)}}, {{&(0x7f0000000040)=@nfc={0x27, 0x9}, 0x80, &(0x7f0000002740)=[{&(0x7f0000001740)="c7", 0x1}], 0x1, &(0x7f00000012c0)}}], 0x2, 0x0) [ 278.848197] IPVS: stopping backup sync thread 19736 ... [ 278.922127] binder: 19764:19768 BC_REQUEST_DEATH_NOTIFICATION invalid ref 458752 [ 278.932130] binder: 19764:19768 unknown command 4743953 [ 278.946831] binder: 19764:19768 ioctl c0306201 20000000 returned -22 16:56:36 executing program 7: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @broadcast=0xffffffff}, 0x10) r1 = syz_open_dev$dspn(&(0x7f0000000100)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r1, 0x800000c0045006, &(0x7f0000000000)=0x102) sendto$inet(r0, &(0x7f0000e9bf14), 0x0, 0x200007ff, &(0x7f0000deaff0)={0x2, 0x4e23}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x22, &(0x7f000084e000), 0x4) 16:56:36 executing program 4: r0 = memfd_create(&(0x7f0000000080)='\x00', 0x3) write(r0, &(0x7f0000000040)="16", 0x1) sendfile(r0, r0, &(0x7f0000001000), 0xffff) fcntl$addseals(r0, 0x409, 0xc) fchown(r0, 0x0, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000), 0x0) 16:56:36 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x0, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:36 executing program 0: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x1, 0x0) modify_ldt$read_default(0x2, &(0x7f0000000040)=""/48, 0x30) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r1, 0xc008551c, &(0x7f0000000080)={0x7f, 0x1c, [0x100, 0x2800000, 0x0, 0x9e9, 0x8a6b, 0x9, 0x40]}) sysfs$3(0x3) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)={@dev={0xfe, 0x80}}, 0x1e5) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) 16:56:36 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='map_files\x00') getdents64(r0, &(0x7f0000000100)=""/4096, 0xffffffff00000018) openat$cgroup_procs(r0, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) getdents64(r0, &(0x7f0000001100)=""/191, 0xbf) 16:56:36 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400007cd0000000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:36 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x0, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:36 executing program 7: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x7b, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x100000020000008) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, &(0x7f00000005c0)="c74424009b000000c744240214570000c7442406000000000f011424d9e10f088fe938027238672a5e000f01d10f228766baf80cb8b655a480ef66bafc0c66ed2f66baa100ed", 0x46}], 0x1, 0x0, &(0x7f00000004c0), 0x0) r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x531080, 0x0) ioctl$EVIOCGEFFECTS(r3, 0x80044584, &(0x7f00000002c0)=""/181) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6}, &(0x7f0000000a80)=0x10) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000013000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000040)="c4e32d7d0b02dff40f22e70f01d165660f3881ab00000000650f01591bc4c3715cd700c4e3314ca9897e0000ba3e0fc76ec88fc9d89ade", 0x37}], 0x16e, 0xe, &(0x7f0000000100), 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x80400, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r4 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x115c02) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$TIOCCONS(r4, 0x541d) write$P9_RLERRORu(r4, &(0x7f0000000140)={0xd, 0x7, 0x1, {{}, 0x2}}, 0xd) 16:56:36 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f00000003c0)=@assoc_value, 0x8) listen(r0, 0x1f) r1 = accept4(r0, &(0x7f0000000340)=@alg, &(0x7f0000000040)=0x80, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x0, 0x8002) ioctl$TIOCSLCKTRMIOS(r3, 0x5457, &(0x7f0000000100)) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000140)='bond_slave_1\x00', 0x10) sendto$inet6(r2, &(0x7f0000000080)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000200)={0x7f, 0x100, 0x8000, 0x0, 0x5, 0x4, 0x2, 0x0, 0x0}, &(0x7f0000000280)=0x20) setsockopt$inet_sctp6_SCTP_MAXSEG(r2, 0x84, 0xd, &(0x7f00000001c0)=@assoc_id=r4, 0x5) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f00000000c0)=0x9, 0x4) shutdown(r1, 0x0) write$binfmt_misc(r2, &(0x7f0000000240)=ANY=[@ANYBLOB], 0x34000) [ 279.646364] binder: 19791:19797 BC_REQUEST_DEATH_NOTIFICATION invalid ref 13436672 [ 279.659990] binder: 19791:19797 unknown command 4743953 [ 279.675336] sctp: [Deprecated]: syz-executor6 (pid 19802) Use of struct sctp_assoc_value in delayed_ack socket option. [ 279.675336] Use struct sctp_sack_info instead 16:56:36 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x0, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 279.683312] binder: 19791:19797 ioctl c0306201 20000000 returned -22 [ 279.786758] binder: BINDER_SET_CONTEXT_MGR already set [ 279.803771] binder: 19805:19806 ioctl 40046207 0 returned -16 16:56:37 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") mremap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000005000/0x2000)=nil) mremap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f000000a000/0x1000)=nil) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x441, 0x0) ioctl$TUNGETVNETHDRSZ(r1, 0x800454d7, &(0x7f0000000040)) 16:56:37 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") futex(&(0x7f000000cffc), 0x0, 0x0, &(0x7f0000edfff0)={0x77359400}, &(0x7f0000048000), 0x0) r1 = getpgrp(0x0) fcntl$lock(r0, 0x7, &(0x7f00000000c0)={0x1, 0x0, 0x7fffffff, 0xf7f7, r1}) futex(&(0x7f000000cffc), 0x0, 0x0, &(0x7f00006f7000)={0x77359400}, &(0x7f0000000000), 0x0) futex(&(0x7f000000cffc), 0x1, 0x5, &(0x7f0000000040)={0x77359400}, &(0x7f0000000080), 0x0) 16:56:37 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c4000100e0200000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:37 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)\x00'}, 0x58) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x100, 0x0) getresuid(&(0x7f0000000040), &(0x7f0000000080), &(0x7f00000000c0)=0x0) getgroups(0x1, &(0x7f0000000180)=[0xee00]) write$FUSE_ATTR(r2, &(0x7f00000001c0)={0x78, 0x0, 0x7, {0x76, 0x80000000, 0x0, {0x5, 0x400, 0xfffffffffffffffa, 0x7, 0x6, 0x0, 0x8, 0x40, 0x1779, 0x8, 0x400, r3, r4, 0x874b, 0x4a}}}, 0x78) setsockopt$l2tp_PPPOL2TP_SO_RECVSEQ(r2, 0x111, 0x2, 0x1, 0x4) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)='\n', 0x1) r5 = accept$alg(r1, 0x0, 0x0) recvmmsg(r5, &(0x7f0000001800)=[{{&(0x7f0000000a40)=@xdp, 0x80, &(0x7f0000001040)=[{&(0x7f0000000f80)=""/187, 0xbb}], 0x1, &(0x7f00000010c0)=""/17, 0x11}}, {{&(0x7f0000001240)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @local}}}, 0x80, &(0x7f00000016c0)=[{&(0x7f0000001680)=""/35, 0x23}], 0x1, &(0x7f0000001740)=""/145, 0x91}}], 0x2, 0x0, &(0x7f0000001940)={0x0, 0x1c9c380}) 16:56:37 executing program 0: r0 = socket$inet6(0xa, 0x1000000000003, 0x100000003) r1 = syz_open_dev$vcsn(&(0x7f00000000c0)='/dev/vcs#\x00', 0x1, 0x200) ioctl$KVM_SET_CPUID2(r1, 0x4008ae90, &(0x7f00000002c0)={0x5, 0x0, [{0x0, 0x1, 0x4, 0x9, 0x7f, 0xfffffffffffffffc, 0x5a9}, {0x40000000, 0x2, 0x1, 0x1f, 0x1, 0x8, 0x1}, {0x2, 0x1, 0x0, 0x6, 0xfffffffffffffffa, 0x7, 0xfffffffffffffff8}, {0x0, 0x2699, 0x1, 0x2, 0x2, 0x80000000, 0x8}, {0x4, 0x8, 0x7, 0x0, 0x9, 0xfffffffffffffbff, 0x100}]}) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000080)='/dev/urandom\x00', 0x0, 0x0) mkdir(&(0x7f0000001b40)='./file0\x00', 0x0) mount(&(0x7f0000000080)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) chdir(&(0x7f0000000000)='./file0\x00') r3 = creat(&(0x7f0000000040)='./bus\x00', 0x0) ftruncate(r3, 0x8200) r4 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r4, 0x0) readv(r2, &(0x7f00000007c0)=[{&(0x7f0000002300)=""/4096, 0x1000}], 0x30e) mbind(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, &(0x7f00000001c0), 0x1f, 0x3) 16:56:37 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 280.238839] binder: 19819:19824 BC_REQUEST_DEATH_NOTIFICATION invalid ref 34476032 [ 280.246776] binder: 19819:19824 unknown command 4743953 [ 280.252734] binder: 19819:19824 ioctl c0306201 20000000 returned -22 [ 280.271242] binder: 19819:19824 BC_REQUEST_DEATH_NOTIFICATION invalid ref 34476032 [ 280.279576] binder: 19819:19824 unknown command 4743953 16:56:37 executing program 7: r0 = socket$alg(0x26, 0x5, 0x0) socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="025cc83d6d345f8f762070") bind$alg(r0, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts-camellia-aesni-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7295df0df821728d598bf6c2c702ff314", 0x20) r1 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x7, 0x280201) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r1, 0x80045700, &(0x7f0000000080)) r2 = accept$alg(r0, 0x0, 0x0) recvmmsg(r2, &(0x7f000000a700)=[{{0x0, 0x6, &(0x7f000000a680)=[{&(0x7f000000a580)=""/200, 0xc8}], 0x1, 0x0, 0x38d, 0x1}, 0xffffffffffffffff}], 0x40000000000015f, 0x0, 0x0) [ 280.301999] binder: 19819:19824 ioctl c0306201 20000000 returned -22 16:56:37 executing program 4: r0 = socket$inet6(0xa, 0x1000000000003, 0x100000003) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp\x00', 0x400100, 0x0) ioctl$EVIOCGABS2F(r1, 0x8018456f, &(0x7f0000000140)=""/168) r2 = socket$alg(0x26, 0x5, 0x0) sync_file_range(r0, 0x146b2a27, 0x101, 0x4) r3 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x100000000, 0x1) accept$alg(r3, 0x0, 0x0) ioctl$VT_RESIZEX(r3, 0x560a, &(0x7f00000000c0)={0x4, 0xda1, 0x1, 0x4, 0x8}) r4 = dup(r0) write$P9_RRENAMEAT(r4, &(0x7f0000000000)={0x7, 0x4b, 0x1}, 0x7) bind$alg(r3, &(0x7f0000f54fa8)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(aes-generic)\x00'}, 0x34) eventfd2(0x5, 0x2ad3eca152903497) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000040)="bcd0ad05e6a8da1da49737764601f01d", 0x10) r5 = accept4$alg(r2, 0x0, 0x0, 0x0) sendmmsg$alg(r5, &(0x7f0000006500)=[{0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000002a00)="3dc4e1778455c6703d1216f2a8df5e2337ed02f79d69d8e6b415aee093c5b038790f3c723b3718f7aa74fdab99c24e90d739ec8581e73431f809fa87e42f4893342ea299d346b39fe6dd18e3afdc7e35cb632301dad405fa14d277944d87f65f6c1ac40863273ec1eb562fa949e4c31a718eedeb7f643d62dd3f5aa31bebac5b5c7ccd711791efed6febd14d84b0ba535d592d997828bba1b6db401d6f9c4bfd52494afe2c41815bdd051a83703daa93ea09645ad25df16bd47a10416ea13d10fdd06b5fa4a337bbc81f47246cb6acc86ef415f09b998b48284a3b505bac77356d4319582c05d9fe4da2bdaf414659abf6ccdf60d723b7fe1c76042adf71780a808aed6b7c85e2895ba48114e671d69195c64481022cb46e3f4d0d1d9b38ea512b98dc74cf394238229fb6a1ffc3978286f303fecb297fe08d98e03938ff261302ef02744019389c3c8e08f714e089b0b00c2cae8a87aef506c676b31660bb8d023da783f36b92f45e184385a57fcf138483a8fc79287912f3693ef900a6ecae55a55e16df4145beee522347b1571e101703eba76f3e2ae4eb331d1d34132fa5d7a79361a8f162958cba251da65297fdc6a004113419df6236f0b6d772267b68101697628d31231258c424dede587e95e91d2e6522f5da97a1cad7284fe09b49963811a4d224fc7ba50319054228496d75b7a5c505ad6040c999b1d62bb0fd01a7c8a4bfc64b3f57264264333bdf5a5837891a810bb1fdec9bb739be2592f50a8d3c9d3e62577d0a3c2b2d82d078a0301e1d59477e17c985fec66cbd22869626cebbdd4199bf96c3024eb9f4860e313d0e27a197956d7afae56c7055bca3cbc7759283b00451f7ec071db81e937583f37a043544edcc5247090cf8d74a56b74923c1f5e333921f2486f015d8bc4e37c3e8412adffd13723ec7e9da0777faeb533eb99dbeed22de10c20316cdf9b349fa09faa96e36aeec7667034f72a49cb104188ba8683872dacbb9669a00bb3541ecf6fe0116c7cb930151b3683fc98ab3da12b78f46f712e2498273185bd90a33f8a2c4d18acc8dc6b257e62088a28d259bb7bfb5d20786083e45e41d2113d643e80a0c23761db8b714d13684d3d478ef5828a3e8bf24426dc50ce3dba574d15b64fea32c39d8eea0a555777b892e48ae0d743775864d57151627bb76ae047c318cf2ae1cb56450beb33906799866fe19b1c7fb921d1d78f7d69f668157c69335608dba1386ddb8bf3639143b53577dc6ae8b5778047e300474e6bfaef79be2d93e3c26bfc10cb373adbd672a4dd8e2613ab2eab66af936afafccd0e1eee801aa9c5f6a6827469c17e4d738b72c2db5404b37b07e9ddac9a24a8eab89f5f273b03687c0872290b285ce34f7609aa7a7e496925414e1570c89825374fa1997e89bcbdefd5efe8421f6cd7c9f904c6f08b00aa036257a7c2e22536c7c03c7db398bec3bbcd1eaebe7e93f2efcbb90488e3e54fea16eb1a841ca0fd9f514622b530dd97557090bb4feda0e90e30c2b85101bf19c1047ff5dd46945a96e7cbdb277b623c51afd7a34ad97dfb0d891a25e017ed955966de300a4a7e5f59e39b477c057503be27d9dce1b64938dd824a7eabc9dc29d2bf976dd5bc3fb6167960cccf7aee5cbe59ff61b47b5033b537dd17e3108a7fa19685881a37675fb765bb15c0920706154824bd87431941c3d259e92b3c8202ee31b6c793d891e028f564aa2b0a8bb4f6df46c692c10ab578683d34baabcd4f77da4bbb4b0d70bbe4ad01ce9de6accd7bd3412f5ca4a516c2d7b7214833bda857bbb4c206232b8d0936d8a00b803b9054aa55c2868a48a56bbefa8648d3da378e4240a5dc6b2a2a6c9fc76c5897b355200b8367d3c421bc24134deeddf2d2090049d001e97485c82a83fe636b809beb56e9a138c2487c02bc9f71e4bd7136de37bed04013debddc3cefaa578a2e989e5790d8b9bb8b8781c7a710e2d671980f424a1a1e03be17177697e997945209c65c964d1647d001873ddf1c5547a05231c416bec4d315edcbeb201814eb0bdfb5516cfcda94056b07c750fc1af75bbe76cf471a0c3d04ad0fb9e94ec31c81456da4269f9253974c3333de3adc8685f3412c772739c6ea1f76b067e1eb624e8f8fbb63eb16e275d9473e998a8ff4b191db78e282e49a57a17214e1c6474bf1f9b44eda301e8374709f088c09a3f40033b6984e77f26cbb33235e0b0e11c15c4c464ff06b5bce394e79a0664a41ea91f0e8a66e10f4207bf9690bd5bccc688ab0c1dee0322211564c5fc12f5aeefe6c3a9f4dbe81742af77f33d2f91d358d6c44f29b466d9ebea7d1ada7e5e4234b7f6e82a542ab6cc66c7916d30dc9d613b408fd7fd3056a0ba4a7255849504a99436bdacadc9c2a6cdc2aa87f09aa33d0a9eca3d1abb9f9ae5100fb550545f83cc891392c3f9d07151254c4eb629878207c6f6cae99240bb2863d8a91f457ea8cf8ab181d4b84754e835d52aca49afa5764d2a19b1be8dba5171dc4ae8d7fc4fbfcce212630fc054e49d590bce9af4b21fbb7a7139d900a37a3a965447edaf173cdf4e7e605a1d3f71564a9947d2624be7fb52a85ef050ab36760ab9b9b4fc8bd8e9bb4208baba6593ee53316a234d828876f7cbbe79d7da8d582cc40c2f6f4f01623087d93b238554cd3558699cf666f2a0c9f39938117fe739ceaf2cd7f561967a3c344ebec39f9e8c23e4d7f524cbb0ec48e8e38aa8f30e818ad3a20fc97d8f5bd19375fd4eede817cd1b946acbbdb252ec2b47c155e62d8eee747f0fe67a517881452a1ebcdc85c3d3deaff5cd016c556f8ca04f95882aca41c6bfc556ef9b87ba1b6c8b727b9d99db4228b8bec3c86bf07be6a61cc55501a8b31b909e2aaa996a6c859e0bbe192e308f4c6a26ac0dba22f9e130b900ab951acf1b904a696d07286ee3d99dd1ed4b3534e9331f772c93ba90e85a8056b3348a877cf59acbaa1c0e1a1ad18dbf4c2ee11137d76a2173d1e47281ba29e2c328613dca1322989ba52d85f3edc27c54a47a7be070a42e6e9ca71e2bda235bcd5ebebd1804dc366a2d094dda195edc331a6fae600df30a255adf3b3a037ba734852629487b13ceebbe76afcaf2cdafb3a412472e6fd552289b78c096981f6352ad13df114259b2805c47c8145e03055d21cb1d055367bd3ea1a136ab040aa759a09d523df22a84f85480c4b6561bfb4fbb3872a25d2691302b5eb74bc22b2dc60fef5fd72c6252fa86189e44a84cea88ff88994ebecda9c874d784272438f1cf29e380e3abedf236204de6f3b2a10b26f7e3d0f8a213512f64d211012395c635c6f5547a68dcef02dd148e4930af698c895f54d12c9a1119d535bfd8a88cde302978cae8332729ee56e44782410e0e801d3330d8bec542541617665ff4903db6ebf9c2699088e00ebd1b0878481a95b117f806907b4fc332bcd6683d2bc494533ed328625c99ccf4e19de8f6f5690f9588b7914c96fe9c44e2893528a1cd5a08e0681e779dbed7b4582351fbba1e733188067d7c07a94c524a4fe10026deea3f2cd1f7f4fab4fd387bd5f0f46fa3a8337c84754861beda70403d644f5e4a2a7dda8fdb816cdab6ec01bfd4b499b01444932a83c9a3e914a5e7b25f5f9a8f7a79767308a834391f214aba02a3e401beb5a3079376b0ad5948a6aced35883accd568bda3954f92afd8e9803e9c739f326010081d0d382ca45af259fb3466f5046a353c7be46f5744ab8341bb5de467a60d60b8c4350ee034e4104fc6783c42baa39aec4fc1222833497c85fa40fdc57d89eb20e3f58907b473c84e0463f89fceca3c9f74fb2a47f9e040d7f03acbeb11c2354f0b00cd7e0d9ed8541ea220d72d37f7c681a46f2e994271687c22ea1e21fe825c498e1bcb2d745c764f2c1f15ebd1ef461f81583d13795c972afa5e031105afda3105e805da5817b70ff47016d82e5aa6cdf05b2fa998e6ef07561c0efecf8f21bd4a57be025265c1556dd4fd02c257733bc623556a70ecb0c6be639fed9c4494785b0ff178c0c3806506ad8b5a5e52f64485a035a5aec96a634451848a870eda6000bce1c2da37a1cb00c8a166424f6fe04a6f8b272b73919da481507d04f3ce8a3ab2191fb9830869df95d536d0f0e19c702201165431f742781a4768b1866be5f1d47457981b8e861ed6c3fa447e409a4bd17809928857973412622c572a9070a1963c60ce16ffaf98c7a91b3b3b00373e27f76c638220d75fb12e574a6b289e4069b183b059d8c870b228d40cf844c5d916fcd9eb9065ef9746b5c703c9f6d69ad01c70d050c4d556bff3564fd8d83d8e9fb4f9bcf5ffad045d7fac61e5ebf363eef7748c221b18a9237716de38ae985a092e735b76b6bd108b472e8ac8d5f0426f70a7b4c0ceb0ed9c4edf196d3c8873100c29f395b375d5aa56bfd7e3c73ea6447ba5e6eb2dba", 0xc51}], 0x1, &(0x7f0000003a80)}], 0x1, 0x0) 16:56:37 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:37 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000004000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:37 executing program 0: socket$inet(0x2, 0x3, 0x4) syz_emit_ethernet(0x7e, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff080045000070000000000001d078ac1414bbac1414110303907800000000450000000000000000feffffab1414aaac141400444000000000000000000000e000000200000000e0b7a0f279000000000000007f00000100000700ffffffff00000000e00000010000000057be287108520c5aaa945702232ad0d93df59f25c7234f35bc90000000000000000021ffc1dd95a97888a422257a9ea9ea28f4ab96d9ba22a6fc3e2aeb0ae0e24f54baa92ccc987ce543f13b0c6b60d4c1102ece4b46acf4eb53a311c3785e52b65ce496db10d71c58146115bd81622f303460921edfda27368c3864c74ca66a8b586ec68230f520c00af9deb8a22b303c87ea291c171775d60396e6e42423e0bd1d43b4323a70afeeb32628352fa3022b15855723931a0c4456960b58eb9331e06f390c90e9a2913f7fe8d92cc0077ae19a59fd5bd089dbf233268a33838ae83acd46224bb207f196cda0c69c8dbca4939493e5df34b734360dad6040d4c786264a267c523483069b300940a30cba362960514b025fdb337fa9bf3cf541fa03c1b395b9cf0b22af3ab70000000000000000000000000000002896b7800613f2"], &(0x7f0000000000)) 16:56:37 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id', 0x3d}, 0x2c, {'group_id', 0x3d}, 0x2c}) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) vmsplice(r1, &(0x7f0000000340)=[{&(0x7f00000001c0)="25595a50878e322f2ea5284baad0c7", 0xf}, {&(0x7f0000000240)="4d01b70feb78eb300fed5bd17446a6f2bd8ca1bef04dfe9298b011625eda5ccfd56c03833329", 0x26}, {&(0x7f0000000540)="b693e6b10692f204f88c9fb188150b020c92d682b1384bbc5d168c827742601ce044083788393076143abe6d8e7011c45ea3d23f5a91f7eef4f7519aff78ff08ea73938f18f25a7697e4bb2f8cf037bffdc17d1506cdc34cd74441e2aa1f80c4f67f5536e1b8a366a883bbc8d514b521029bad63fe3c5cb94006a1a4918fd84b53cd67068d968fb8d0dac7c724e889fcc6844d3c38387546f9034c0ff8d84780cc6440bb79f7c5473793170d0e53e57c06fb", 0xb2}, {&(0x7f0000002000)="a520d44b9e7fb68294311fb89c2c465c9a2c5fa3dec5c557c092ad6b60367300000debf6675e1f3fd388ca12cc9f1364530de92ce5d0aa1ccf14151e672611085d87626859539e9520c39928fd778f0c36b65474c7a41e4eaa1efa9da56a2b3058841ff55d89303fbeb2277b7834469beb5d9c13265aa5a3adbe64f6c1d11dfab8792b8022b4a771d7069fde5a6d0d61a1492eb56a9a039fbe5e3c7594b047bb81f727aac9429a38de56b24c9930ef2551e9a772fdaef3da19edf406c3773c28ebdbcc757cca191e98380d36cd8a88cc5091d3e6d3e9db270e442de738bbefe39f67b665e30d0f8590ab6651f73c5fd69665526fb275b35024e211f4e34224d7ac48c9e6a40f8706054bacbe011add36e03f3e25ebd82be4efafdd48140feb5c3278ba50c1881ff6fbf7b6f11bcf035bd26da016e6c18edd5c07e0eb715c08cd5fe8dcea4b8ece84bdce083423578fe5421c1f9b5ba8e4e75abe94bc25d0b15b5b7f52a812663e900c2d827df2bd7a4ffd67aa794fae11be71ede1cda4c3df17624b83ea15dd69911b99ee74e41ca291405e6ce80cc47298bfd698378e6bd06c3cfe1904216d1d37c96411f2087a624d4d74fb203668f4224ee958bfde70b2a15e9ca5048989306a1c7909d44bccaec4621b51e0b03b37a88fa9fd6cd9a0cae35e4880c7de2484dba00e4c175acc4a08d5f9dd4d4a9e3c9b76c86b6313755266a359b12ab3f3575e6fa4a60874387805904faf72695fd75d1bba6daf59ae7edb723df87e2c8c7cbc73c7fa30167c1579f3c2308b2b885043de85f47c76680b3c9348b49a1a33d187b6a487ac4fb21781c42430147d629bddd7a24a0e30aecd35051768be1a112a78187a7730e86c2c4c88ba23316ed8befe23b999e2b366be7b5de95d11d86fede4473cffae6db72832244c7768babff939a530b8569bf624ff19a3c7c53caa5a935b59fe96af1e7807239072e1a840bcc855c302b65d34abbad26d6a59aa67a7b3d47664d0f4240b9dfefbb0cb5e2f2cde288170caa568c7663e8d9b749557ad0faf2e8857d9e7026c2d8cfeea61e2c44239dc83e1c7a187ccfffda3a790e4d71bf128140494039ba34f4bccafd8a6cd714b63ab6a80b06164e15dc42b3c837e709528f13b3ae17bcf6d4624cb6807b48b00a0af33eb0560b4e0a92813983a0ee0ef45d6ebb9d53fa2a1e6b7660fcd83f669c8986bef7389c3c98e0bd4230569a02984604c280ee5ae75433d539646f51a27f6c38c3fd4c95fc4420be4b98dceb9f6d9abb4b1b7c191e9fe0044d3674d4aeb2727700a7585881a0136c2f78943b607ad65dbad2adb671c393e226d2092b451f0152467617ad48776398447e6d1c8f5d740f574d884a8217ce6b907bb2519a0b6430994d33b6de882e5c5a9c8c0477717f555e747fa08c5ab75a83807f06ce5476617c3aa543e6a469020587f198da74acf8c5c29efd541fb1eda0f850625044ae7f37446a4fa40f55055380911eaeb5437f6362e75c37f333e7467742c0d199294cadb04c5d917ed0d03f0ece254994db809ff360e35adbef672b2d5d684a95aa9e9610b3be2fb52106b5a672cf29b0fd10ca368791a1278017534fb62845b9634bafba6ea57eb6dc269df130268e12226d908554dbc22f4ce366d09d0ad3fea56211dbdf355d99d981a77a5ee04ee73d4762321f64aad4b15b42492661b5952bc968a7a60e07e84f759349899ab2ec920fd9093ad028faaa7a75d05e5f5828fbaf45b3253e1917f8dbe29f59f6c55a064b0c0bc0560ba5feba084a3016578306d904b0c4614ab8c70b253929b4cc5e4de15353cb177cfdc27386014476f51a9012cc008e3c142ab54c841b738db9b691bdc177fe3a3f6f0c1ae8465e73a6b5b1fdc5ffe95b4501ba7d3cc1483db3ba2ea6eb2de70f26515d76fe6b42e1c311c2e7fab86030d335165875789f0c7acbd5e3decfcae8b2ec801e81228d87755467a51bc04cc5b77d7a43df8b26bf7ad4cd16e9c7675589e10392a70939e0309905612de68092e654b0866707beabff215d60ff65c5f943c9104a8e8fa9b57cc87dec4eaace5c0d9b81f38ba8d338fa0ba9ee4a56f28d524bbd78e9f29b2c1a1f15560d259f371459a8f61352bbfdbce2d436bac1dc33cdf91c4612576408b947c116f2646452061f022e229c85a0813de0b1bbb2673634deaafded3e546ed3cda084576b01038ed08616f1f32dc3d47929f750444b0053d29655c8367d0d892df72afaf53edcc25dcb56a7745ad5f5260b106245a065a5fc6c3dfdbbd806923a1b9ad18071dda39f6352fee0042d56700a98ba99a5c4409512c750c5eaff41294b0d38391f6ef807e1d3af22312c3cb8d3db18032c74c8eb54c0bb225bf858a4217ad72614f8d45ab132a1753e83750c19a5548ed9eb7ec5cbdba3b4600941a9bff371a313f5be74dfc5e0f14ed37679e94812c64c7f839da2d54341c128e25d474998b90c71443e725b7a1a29294e4c7ca5db61f16156613d1fd6b05d9fec6254e60299f739cda78ac3b06147b2efe68f334911c90f26b77a546748fe3b35bcf7596961c07f2e74544e3766c9075b65dd899d924b29fe395b0be7404275fcc0187faa758254285cbe88e5123d32679f790326cb4b4a72b107c390d78aa268fc0f1fd126b6eb2e7cf7816727609454d02b7efe9ca7eecb6602f9644356f947f682c69938d5c9fef5d196d2c443a4b5d2d71c8536734ecdf412da2a0d95e7d1feb699caf15e61867358919203500fb2774b0c98be254b5a21d1bf9df456f19547f4045dc4bfbd10952e315442b0ead5179d8ec33c9bc6d23e9350e87e88b427de1ef5086f9bf3ed0dd1826069f14bfdaf743100f01e865247d12954a40a59b253ad9a9c6bf4e7b606e79417956c5cb149c3444bc8834af2dde209436a26b47b6dc2cdee176dc69aa8bb05fd4a71e836ef9b41a05bef22caebfd3e40c282e31670bbeaaf3cc95f83973f6e5ea34e0f68c0f6d33176b9505d4492c0e0591ae68a38a66b678b1d415984df3a5026881be049bdbad2486cebb9c96ad4bfbb963452056472e9ffa036cf518d04ec82173b6261ede31ad449399c854b99dd4fd1dcc2acfdd201c41335ac994aca4e74e39b0ded1f18ef6b67045de2b1564d6a09f249ce022c9d0a8bc8dabd84d0afa211bd619fd0aeae03890042235c7ef74f3202042024c5c7d2ab83dec4024273299ab57cfbb926f834e454df41de9ca4bc6249e01f1a4b5725f8e2e1138a729e93377f65cbf90229664773ad81e28b58879eadf6713d44f76fbe31cfc2a3d30a924d9d2e64a5e5942a86e1544d8dfe47ce6364458e39340aacdd33514d37675869ebc13f9326974c909e2fb0b0b7061ebc332a61bda7096d38a086f7d8185332280c0acd197bff7d309a4408d3e946734e51cdd8e7a3171ca2c78b501e07923b88c2e19a2f8ef20525299e601a5d64553f0803fb8ad18858ad3861865b1e30bc0a82496c3bb0249d4d0e95f6b45ceba1d9274c970d0ce03f965685714574187dadfe6ed2654d00c934f9573eedb6e913f69b59a3f46669d773cd77f623ca2f434ae3e7e4eb3ca9fc3b217987f19e3c4019017cb42395842856966ad837d3609004cc14b13b1bb3098c614314c2d31866f584ccc769d056c6e9236808dbb346de197263b5940000819336907053239c418356657b4d59be55301e63ff35cffe58390a5103b9bf4a3429332f7b22669c1b52c3ae24ed2dc303418854269854de9b7b18f4643501f2d1f083a354e9e16bcd58ec87689fe75a06eaf724ecb3d9e690f53698ad743943730bc582675d5c5864ce7be962560a2e3ede74bd359f78bc07933e70c4f25e030f11fd85b6191bfe89d6f11c7212a727bfba9e582ad5eead0229f5079654b7ef28ac72105eec2a23d413d2406446e82700696bb8b8bbe2937b2b320dbb81d7714e10ad6a0d41cd977f2517b694d2bd3e6e1f70ce02c2bbeca123b41f59c34c74ff8f5ae45d899e10daa9f715e2c367b8cd95553c00999372ca78a2f65c98187e6a5fe9658b555aba86001b8693ea59c7e32d27155472a5a6b5ec48c361247451e33984fda5cdd264baca82ea602e0516702d1c1442f595052f42d2396a2def57394ab535d61923bd563a191f65a179f9628032437608bcebfe0ae61aec1e857b849dcc5b727aa211a504697c16e6a833f0403f16df9eb4a4b2509fab7c88ed46cedcfe357deca587684acd902e7bfbcb4baf98e56dde6c5e2685d1ce25ee12145849fe973c042c61fb53e7cdff397bd481f027d22e567e65bca7057c7ff338fd4c2a07dbc3162037c2832f2d989d1a301e868233b51b7279a2016e83e245074a8b7ca577825fbe5dc5c8705b2c66a38c1b4614dc39c1a21bbec918d97b2fd420edb6fc9419b782b77965d246fac301eff227d7ef895584adf569e7f061c08456030496af06f2bef5cfc758fcf706a89ca879a46d35792e726986df44258be10ea2d17020d7161e0bfab41f99933a74a6305ca2ce01895ff1c6d8addea375a1fb9ca920a2a699950e6f4460615835ccdabba301cb9132790a5abf557d35d630ec5d237fba49362ad00785feb488aa4bf098472124ddd2bb4102814f21d5306ecdbbcf52eddf4f3a39a7031d4a5e0d3828ff5f7eeb5b05fabd6731fc9532288ceed047828f2f7abee334288067c27a2177cbc0e73d7b4bc237cb00f3f42fe6a019421c1c484cd11a0c40931dd0a6997cc70529d4c04d610cb077bad006afe445dc288d5663b853f5762f91197d105356d49a597fa54ffc5b0dd2ab639dd8c2445000af91d52146ed03c31d107cd32efef26573d2a971b2df502973e6a2b0337b982c036e01f6c399f92c609cb2178d34aea3f81d70ca6a88d8749dba6c21abb8eef619b23e136c43d601e25f31b90d3d9528c3be75254c404aeaa817d185cc97b0144090b789739723c4dda9c59b3aeca1096947b2bfee3b5a12d9bf58e277f1754b4d7d073df180117b1b90b4d34f39d15dee02c8e68c2b28349d1df958e388bcb6cbbaf155fd17afc1c0ae037bea6c8d2f1f6e522de41f6133c3d3fce0bfc0f044c9f6552a10c33a7288a122602ba1ebc8daf17a16b92f4082225133ceb8bdc500f3c100d479c308146f78df401bb8c7dc406f74ca36c9a21d250d89705940930e922542cb60341d8101d90c2af30262d692d346f0a3c08f05219102c1ea798a6f1afb64f92010952899df031963cf86de40df97c398df48c2353a07e1ebbe2265909c27385d11f23e56e4a53f239bbb06de094b83a80a394fe9e2c1024d533099bf62b577d432001233a51ed82e693029c8adc630a7e600aa9411cf517c398f72899a1ec8cdea260e22635293571e21c1fe0b8e909df356ea28fa342a754ac67a7e80b9628b9a9a7ca4fe763f25be346fc8974c23cef7725f173dd3d9acc6c9b0aec9a78858b416f722886c973ca0594775eec427e551d5cbb1ba7652def96dab2bc8d0c950e2c6539f6cbf40f6e1bd248fdf1c06df373a3a00f4bb07dcfa890f5edf9eff7919fddaad8cd00391c11c63e5df908e8d97ff2e7505f8e2db1c447ee2eb20181aa001222302479c3ea17ea443db38c605e0985008a07ee75f4fe81434b487fbc91f0ee9dba25a6b38b0487bd535dc23835af49da1e4bd777383ac5a98a32a8270abcd466066c5e0014fc8b47c68e47847345b83f8e6555253c6953397ca9499caa102714756395c862add87800a648951a66ec3c89e850e4c46144b842c2eead473f549496aa331580a638a28f3b5f", 0x1000}, {&(0x7f00000002c0)="6754294767442c6d5d274f07010bfcaf2bc4ff8ecd91ec64dd032f8517985c3b2d6f0b68b6ad488a1eb96c47d1", 0x2d}], 0x5, 0x6) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1b}}, 0x50) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./file0/file0\x00', 0x0) read$FUSE(r0, &(0x7f0000001000), 0x1000) r2 = open$dir(&(0x7f00000000c0)='./file0\x00', 0x4000, 0x0) read$FUSE(r0, &(0x7f0000001000), 0x126e) clone(0x0, &(0x7f0000000540), &(0x7f00000003c0), &(0x7f0000000480), &(0x7f00000004c0)) write$FUSE_OPEN(r0, &(0x7f0000000040)={0x20, 0x0, 0x3}, 0x20) utimensat(r2, &(0x7f0000000080)='./file0\x00', &(0x7f0000000180)={{}, {0x0, 0x2710}}, 0x0) 16:56:37 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:37 executing program 7: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendto$inet(r0, &(0x7f0000000040), 0x0, 0x20000003, &(0x7f00000000c0)={0x2, 0x1000004e23, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='ip_vti0\x00', 0x10) r1 = memfd_create(&(0x7f0000000000)='dev ', 0x0) ftruncate(r1, 0x380) sendfile(r0, r1, &(0x7f0000000180), 0xa00004000000002) [ 280.445560] binder: 19838:19844 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 280.454254] binder: 19838:19844 unknown command 4743953 [ 280.473172] binder: 19838:19844 ioctl c0306201 20000000 returned -22 16:56:37 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet(0x10, 0x3, 0xc) sendmsg(r1, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000010407031dfffd946fa2830020200a0009000600021d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) semget$private(0x0, 0x1, 0x40) openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x200042, 0x0) 16:56:37 executing program 0: listxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000780)=""/180, 0xb4) pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = creat(&(0x7f00000002c0)='./file0\x00', 0x24374dea61ed75cf) ioctl$TIOCLINUX2(r2, 0x541c, &(0x7f0000000300)={0x2, 0x1, 0x4, 0x6, 0x7fff}) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000340)='9p\x00', 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@version_u='version=9p2000.u', 0x2c}]}}) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file1\x00', 0x2000, 0x41) getsockname$unix(r3, &(0x7f0000000200)=@abs, &(0x7f0000000280)=0x6e) write$P9_RREADDIR(r1, &(0x7f0000000480)={0x2a, 0x29, 0x1, {0x0, [{{}, 0x0, 0x0, 0x7, './file0'}]}}, 0x2a) write$P9_RREADDIR(r1, &(0x7f00000004c0)={0x49, 0x29, 0x1, {0x0, [{{}, 0x0, 0x0, 0x7, './file0'}, {{}, 0x0, 0x0, 0x7, './file0'}]}}, 0x49) getsockopt$inet_sctp6_SCTP_INITMSG(r3, 0x84, 0x2, &(0x7f0000000380), &(0x7f0000000440)=0x8) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1, @ANYBLOB="2c0030b1eb50a4feb6221596cc5c654502a577a8cf778af0a816162b40f566cc0a97ae444422a8ca7e993427962cb143338c1a5e28ff48a7911df06afd10a5518dded71e5ca187150bbfa18532f07737ed049531e53aec16cb798fffd08e7739633dfad42aae71f829b3827dd97ac6a9d4e1136e094056310b9eeb16600a5bb0b6177143b3d0006bbe0fcb24a800efdb316cdb9faf31f48c995e13"]) stat(&(0x7f00000005c0)='./file0\x00', &(0x7f0000000600)) 16:56:37 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000000007cc0000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 280.501686] binder: 19838:19844 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 280.510376] binder: 19838:19844 unknown command 4743953 [ 280.516672] binder: 19838:19844 ioctl c0306201 20000000 returned -22 [ 280.661296] binder: 19869:19875 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 280.670058] binder: 19869:19875 unknown command 4743953 [ 280.675487] binder: 19869:19875 ioctl c0306201 20000000 returned -22 [ 280.686544] binder: 19869:19875 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 280.688448] netlink: 'syz-executor6': attribute type 6 has an invalid length. [ 280.695217] binder: 19869:19875 unknown command 4743953 [ 280.702759] netlink: 20 bytes leftover after parsing attributes in process `syz-executor6'. [ 280.708636] binder: 19869:19875 ioctl c0306201 20000000 returned -22 [ 280.721161] netlink: 'syz-executor6': attribute type 6 has an invalid length. [ 280.732283] netlink: 20 bytes leftover after parsing attributes in process `syz-executor6'. 16:56:38 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d34") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:38 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x400004, 0x90000) ioctl$EVIOCGPHYS(r1, 0x80404507, &(0x7f0000000040)) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_S390_INTERRUPT_CPU(r1, 0x4010ae94, &(0x7f0000000080)={0x9, 0xe4, 0x4}) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r3, 0xc0145401, &(0x7f0000000040)={0x2, 0x2, 0x401, 0x2, 0x3}) r4 = dup3(r2, r3, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) 16:56:38 executing program 2: r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000000180)={0x2, 0x0, @loopback=0x7f000001}, 0x10) sendmsg$rds(r0, &(0x7f0000001f40)={&(0x7f0000000080)={0x2, 0x0, @rand_addr=0x5}, 0x10, &(0x7f0000000500), 0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="480000000000000014010000010000000000000000000000", @ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0010000000000000", @ANYPTR=&(0x7f0000001b40)=ANY=[@ANYPTR=&(0x7f0000001ac0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='X\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000480000000000000014010000010000000000000000000000", @ANYPTR=&(0x7f0000001bc0)=ANY=[@ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e0000000000000000000000000000"], @ANYBLOB='d\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000001e40)=ANY=[@ANYPTR=&(0x7f0000001d80)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="9200000000000000"], @ANYBLOB="010000000000000000000000000000000000000000000000"], 0x90}, 0x0) 16:56:38 executing program 1: ioctl$ION_IOC_ALLOC(0xffffffffffffff9c, 0xc0184900, &(0x7f0000000000)={0xfffffffffffffffa, 0x8, 0x1, 0xffffffffffffffff}) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc0\x00', 0x101000, 0x0) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000140)={0x1, 0x0, [{0x3, 0x1, 0x0, 0x0, @msi={0x8, 0x7fff, 0x3f}}]}) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f0000000240)="8147095645a29a86da10d731eea4dc1ae9a7d9fc48215d65a3b09b151c81a87cfa7661494b6d52f706d01d9475b32338366c1005a03b2626544bfb2991e04f7d8e7f08a90271c3883b98ebeb56b3c23f76522a3bbdbceeaa117f14c57a0dc0666ae1fb079d65a4f2defa3de530fa0eee76328a0598bbed3afd1621488ec6cf5530bffc911eaa4e6032f8e3d79137337bb5f48150ab8807e23b732b1ab43e4b5a86dcdb899f74ce244cfbfc6e50db3ef3c1a6ce09498a422fcee6b8a37a2e8b8e7a35ea2bc070f9b22c6a0c8a5dbad5061c83e555855c059cd172a476ff9b10954091ec1f2ba73d9a2430dbac90ee105eb90810310531ac5dc67473af78ef5cc5") r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f0000000040)={0x4, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r4, 0x4018aee1, &(0x7f0000000100)={0x0, 0x2000000001, 0x1, &(0x7f0000000080)}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x1fe, 0x3, 0x3000, 0x1000, &(0x7f0000fff000/0x1000)=nil}) 16:56:38 executing program 6: syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f00000001c0)='./file0\x00', 0xf6d7, 0xaaaaaaaaaaaaae4, &(0x7f0000000240), 0x104010, &(0x7f0000000000)=ANY=[@ANYBLOB="93d00900bef721ca5f4892d07fdd02000100f9"]) 16:56:38 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400006000000000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:38 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(blowfish-asm)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000100)="71e67a15", 0x4) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/sync_version\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f, 0xe}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r1, &(0x7f0000000400)={0x8, 0x120, 0xfa00, {0x1, {0x0, 0x1, "1642a3743344d859b9acd29fddcbfa118deb2c484e76fc73e1a9e6854b132d02989cda2721670345fcfc157eab56782d79ac368a37c1c0b4898586c16fc41dd50f30611cfad747ac52b489d81db1bcff6582e2db3b47f7a40c01f6b6ac28edc32dfbd58a851316c1ef290d14bc670c924f897c2a1b062a384432f188bb9ae75b7f9dbbe95d2ba89f53876566a8ac6efbb1f672ba01733c16a00b5105117dd594463a773668a8218a04cd7f3955f9297ea14f634a3a59f3be34a4e66b2d0beb6e9fd45890e81df77faa427a4a84c1e848df9a7b9643b2f19f967804055f509db6140a9c255319dc4b9d878fbcc8965fb10a090c7e8db5fe628bac9be66c1d9f7a", 0xdd, 0x400000, 0xf13b, 0x7, 0x4, 0x7, 0x6, 0x1}, r2}}, 0x128) r3 = accept4$alg(r0, 0x0, 0x0, 0x80000) ioctl$KVM_CHECK_EXTENSION(r1, 0xae03, 0xe9) sendmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000003c0)="dd2e3f96f2605b57", 0x8}], 0x1, &(0x7f0000000440)}, 0x0) recvmmsg(r3, &(0x7f0000006880)=[{{&(0x7f0000000000)=@ipx, 0x80, &(0x7f00000000c0)=[{&(0x7f00000017c0)=""/4096, 0x1000}], 0x1, &(0x7f0000000600)=""/154, 0x9a}}], 0x1, 0x0, 0x0) ioctl$VT_GETSTATE(r1, 0x5603, &(0x7f0000000240)={0x7, 0xffffffff, 0xfffffffffffffff8}) 16:56:38 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc0\x00', 0x4d0000, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(r0, 0x40086200, &(0x7f0000000100)=0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x8188aea6, &(0x7f0000000040)) 16:56:38 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d34") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 281.186739] binder: 19888:19895 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1536 [ 281.202556] binder: 19888:19895 unknown command 4743953 [ 281.209608] binder: 19888:19895 ioctl c0306201 20000000 returned -22 16:56:38 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = getpgrp(0xffffffffffffffff) rt_sigqueueinfo(r1, 0x68, &(0x7f00000000c0)={0x0, 0x0, 0xffffffffffff0000}) recvmsg$kcm(0xffffffffffffffff, &(0x7f00000018c0)={&(0x7f0000000100)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000001740)=[{&(0x7f0000000200)=""/157, 0x9d}, {&(0x7f00000002c0)=""/115, 0x73}, {&(0x7f0000000080)}, {&(0x7f0000000340)=""/99, 0x63}, {&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/233, 0xe9}, {&(0x7f00000014c0)=""/236, 0xec}, {&(0x7f00000015c0)=""/246, 0xf6}, {&(0x7f00000016c0)=""/35, 0x23}, {&(0x7f0000001700)=""/16, 0x10}], 0xa, &(0x7f0000001800)=""/167, 0xa7, 0x8}, 0x40002100) getsockopt$EBT_SO_GET_INIT_ENTRIES(r2, 0x0, 0x83, &(0x7f0000001a40)={'broute\x00', 0x0, 0x3, 0xce, [], 0x1, &(0x7f0000001900)=[{}], &(0x7f0000001940)=""/206}, &(0x7f0000001ac0)=0x78) fcntl$setown(r0, 0x8, r1) r3 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x5, 0x100) ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82) 16:56:38 executing program 4: r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x2) read(r0, &(0x7f0000000300)=""/184, 0xb8) setsockopt$RDS_RECVERR(r0, 0x114, 0x5, &(0x7f0000000040)=0x1, 0x4) write(r0, &(0x7f00000000c0), 0x0) 16:56:38 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000060000000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 281.404985] binder: 19926:19929 BC_REQUEST_DEATH_NOTIFICATION invalid ref 393216 [ 281.412813] binder: 19926:19929 unknown command 4743953 [ 281.421131] binder: 19926:19929 ioctl c0306201 20000000 returned -22 16:56:38 executing program 7: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x5c832, 0xffffffffffffffff, 0x0) open$dir(&(0x7f0000000000)='./file0\x00', 0x0, 0x1c0) r0 = socket(0x1e, 0x1, 0x0) getsockopt(r0, 0x6, 0x0, &(0x7f0000000040)=""/4, &(0x7f0000000080)=0x4) setsockopt$inet6_dccp_int(r0, 0x21, 0x10, &(0x7f00000000c0)=0x7, 0x4) 16:56:38 executing program 6: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000469ffc)=0x7fe, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000000)=0x9a0, 0x4) setsockopt$inet_sctp_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000040)={0x1, 0x800, 0x80, 0x5, 0xde1, 0xfffffffffffffff7, 0x0, 0x4, 0x8, 0x7, 0x6}, 0xb) 16:56:38 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/mixer\x00', 0x40002, 0x0) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f00000001c0), &(0x7f0000000180)=0xfffffffffffffeb6) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:56:38 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000200)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000140)={0xa}, 0x1c) ioctl$int_in(r0, 0x5421, &(0x7f0000000380)=0x801) setsockopt$inet6_tcp_int(r0, 0x6, 0x19, &(0x7f00000000c0)=0x8, 0x4) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x11a) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100)={0x303, 0x33}, 0x28) r1 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x91ce, 0x8000) faccessat(r1, &(0x7f0000000180)='./file0\x00', 0x8, 0x1c00) getsockopt$llc_int(r1, 0x10c, 0xf, &(0x7f00000001c0), &(0x7f0000000240)=0x4) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='pagemap\x00') sendfile(r0, r2, &(0x7f0000000600), 0x10000) 16:56:38 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d34") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:38 executing program 0: r0 = socket$inet(0x2, 0x3, 0x80) connect$inet(r0, &(0x7f0000000100)={0x2, 0x4e21, @broadcast=0xffffffff}, 0x10) connect$unix(r0, &(0x7f0000000240)=@file={0x0, './file0\x00'}, 0x6e) 16:56:38 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400003000000000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 281.777747] binder: 19946:19953 BC_REQUEST_DEATH_NOTIFICATION invalid ref 768 [ 281.789488] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 281.812373] binder: 19946:19953 unknown command 4743953 16:56:39 executing program 6: getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000180)={{{@in6=@mcast2, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@loopback}}, &(0x7f0000000340)=0xe8) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0xf, 0x8, &(0x7f0000000080)=ANY=[@ANYBLOB="7a0af8ff00000000bfa100000000000007010000f8ffffffb702000008004000bf1300000000000085000000c0000000b7000000000000009500000000000000"], &(0x7f0000000300)="47504c00be5f1ad4185f49df3281a8f4f804a0057503fcc1f1b0ac9db506d2a552a46555000000000000000000000000", 0x0, 0xfffffd69, 0x0, 0xfffffffffffffffc, 0x1, [], r0, 0x10}, 0x8) 16:56:39 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r1, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r2 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x40) open$dir(&(0x7f0000000740)='./file0/bus\x00', 0x0, 0x0) writev(r2, &(0x7f00002c8000)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f00000000c0)={0x32, 0x3, 0x0, {0x3, 0x11, 0x0, 'ppp1(-^}]trusted{'}}, 0x32) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r1, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r1, 0x5) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r1, 0x84, 0x7b, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 16:56:39 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f76") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 281.822827] binder: 19946:19953 ioctl c0306201 20000000 returned -22 [ 281.832520] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue [ 281.844934] binder: 19946:19953 BC_REQUEST_DEATH_NOTIFICATION invalid ref 768 [ 281.852960] binder: 19946:19953 unknown command 4743953 [ 281.858995] binder: 19946:19953 ioctl c0306201 20000000 returned -22 16:56:39 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c4000000000006c0000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:39 executing program 1: r0 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) r1 = semget(0x2, 0x3, 0x362) semctl$IPC_STAT(r1, 0x0, 0x2, &(0x7f0000000040)=""/65) mmap(&(0x7f0000000000/0xf50000)=nil, 0xf50000, 0x1, 0x32, 0xffffffffffffffff, 0x0) ioctl$int_in(r0, 0x800000c0045003, &(0x7f0000006000)) ioctl$TCSETSW(r0, 0x5403, &(0x7f00000000c0)={0x3, 0x5, 0xff, 0x6, 0x55b3, 0x6, 0x3, 0xffff, 0x2, 0x4f8, 0x5f5d, 0x2}) fdatasync(r0) 16:56:39 executing program 7: r0 = socket$inet6(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") mmap(&(0x7f0000012000/0x2000)=nil, 0x2000, 0x2, 0x11d, r0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000003fe8)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000013e95), 0x2f84) ioctl$sock_SIOCETHTOOL(r2, 0x89b0, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000180)=@ethtool_link_settings}) close(r2) close(r1) 16:56:39 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/mixer\x00', 0x40002, 0x0) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f00000001c0), &(0x7f0000000180)=0xfffffffffffffeb6) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) [ 281.873551] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 281.893149] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue [ 282.023492] binder: 19979:19983 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 282.032234] binder: 19979:19983 unknown command 4743953 [ 282.037823] binder: 19979:19983 ioctl c0306201 20000000 returned -22 [ 282.050007] binder: 19979:19983 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 282.058767] binder: 19979:19983 unknown command 4743953 [ 282.064205] binder: 19979:19983 ioctl c0306201 20000000 returned -22 [ 282.085811] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 282.104351] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue 16:56:39 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") sendto$inet(r0, &(0x7f0000000200), 0x0, 0x20000003, &(0x7f0000000140)={0x2, 0x1000004e23, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='ip_vti0\x00', 0x355) r2 = memfd_create(&(0x7f0000000000)='dev ', 0x0) ftruncate(r2, 0xffffffffffff8000) ioctl$KVM_S390_UCAS_MAP(r2, 0x4018ae50, &(0x7f0000000040)={0x85, 0x0, 0x10001}) sendfile(r2, r2, &(0x7f0000000180), 0xa00004000000002) 16:56:39 executing program 6: r0 = socket$inet6(0xa, 0x1000000000004, 0x8) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x80011, r2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) 16:56:39 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f76") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:39 executing program 1: r0 = socket$inet6_sctp(0xa, 0x200000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000000100)=[@in={0x2, 0x4e24}, @in6={0xa, 0x4e24, 0xfffffffffc589739, @loopback={0x0, 0x1}, 0x4}], 0x2c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000080)=ANY=[@ANYBLOB="0100b335", @ANYRES64=r0], &(0x7f00000000c0)=0x2) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f00000001c0)={0x0, 0x1000, "68a9e99efb3f2e8570ede9ef8627435a191edb5ba3c274f29a097b53ab23f596b044a95376e9b30760a19154d865c8376253282831959e0b288abe4b40cb9765c943de57db54c4266d8b65844ca165f1796858fd5494da53013914b877ea263e9df310d01edf5ffaf1b8899ed9f06078d1e374dc6e3f4d98eeceff843feb02f8cf0a4010796e35bcfe28465e765a1a16254f94ac7c59812efd2ad7454cd7f6681c1a6da32351c949cfa25b93d9188d685b0ce95ea81e9813ba41d529f3b57230a3b862e2a44230af6ca077a911a86e274d00556e0f68cbd09c6e5f480c3c31bd9f02b2a872cd295b9e19fd2f82241467f9efb9023689a8b0adbe2f6fc289a8582227733a9457bbcedc386cf0fa5d8974b201653b842a3061feadb10d4e2a782380392c5f6e09ee35cd87227f7d27a216093469c2672fd7503ce2005a93d53d1acac904a952c112293f8525cbc2cc13e4e8c48f827144430992639b2b7e5a4d31d5ce3bfdddd07bc0961f7827a96d5f43c19c1fff5a955fb00eb811e6bd0fe1f019be7d1e8e23b41417c3bca0dfe6f8572b1565800e25ceffba1893edbbca6ede7c44a9eba29f60ac543f6f3765f2bafc3eef232bb98e7db27d3ebc4f62333f227c048245d4afd53398898c3edb40fd758e78bea5fcac020d9b443bf53a8759ef96ad81b281ec8ab7b5201468352bce09fb733e4bce416d4028b7bd2a922b0f289e2b2dcb10ed8a147fba2d008d6dd05b1e335911f443284cb045b7283ef5034c2ffbe0f35ac4d88f628db0dd0d0797cd78623786da50b7ac6ddf8dc8ded53f5bbe09b0a12a0ecfb47c1fe5a72d2816b807e30ac502ad4033918ecc68b134a17c8dd2638bc2a0c9b3f77c522252c2b5674fb129dfbf51c216ca1172234b9f040f876bf096e80e9dc052a00dea4b8546434341e7afb32c2fdc9fd60efd6c774cc29b096d40d5d34b3c8a1f9cdf8f21bbe747d441fd807cf262e668f7e6218c3157f04ebf420b18886e6a06dc963fc3ac1006f1e0f1852148c301970dcb2add38cc80cf88371331680036e1a2b14f559e7f3f2b5afe0c031b88e18c65603f2c93ea236916619c988b3de3844a964320936b358889d6e9a801445554e321b5009e73148015fe5325f394ed27efc9d1ad1c514d8569ef5b259574fdc2d5bd1a3fc437cf2b0baa5403ac56c66a0e10ecf23c384a770be62bd3bf7c72ab8fa731d58039df7a1e9e1cbe7b1c6cfe7ec6c63ba9537df30de7b6f301c860a989a14ccae635a17c1197e8ae878f9eec90f04aedb50e43f02d57c5c05ed9a353faa0bf89a0100c47eb3971c5566f62c4a1d0ca7f5b34872b8cde8418dcde9f264a1b3adc5291b583d11ecdfc3d88815f90a05481cff2f40f4d1ad76bc997277bed9aa620b4c5ce840f6f1439366086be38edb2223564e2e54f975ce2312218c9cf5e7cbe331ac3e817fc9d6db06fc750c4cb53f929d1d94695d0f01a4a097ba0d3adca82421070b7ce5e86bfdb99cee192bf61b3752cebd22612aa56328ed9281d2a502b9cb3fecf38eadce6dd4a95122a0ae8e848c0aa0e77daecc244d40d8495a13bfc1bdb6478421bd3b5e83e37a0ab1c1401319e6d398b13e1440a2c622427bdbcca87d84f5de668ac8e826455118796a8e4985f98d903ebe8a05af46e2bb56fc589487317f49258669575dbf988fb27c9d641a7f4160dede7b1f9e8fd2f2d53056cfbe906eab74f7f4eccd45af1489dddef44a142df62907090120799f483db405990575ee4a53629752c1c373466381fec64f807b533c29c4416d53694bca465fee5d06e5026256aa81ebc42b5a85e8038a67bee05e697788fcf97d7bf37e557845119209988a1e87889b410583713717792490151a95380ce82dd31dcadbd9c9a80f5fc73093a43125669707cda6d7fefaadbde58cd44eef76fbfd7fa736a377cd36c2ac170147278ff2758581ad8c1ce685063ee4e2cc4d4fa3e921bc1611cb274451f8238df38d4d9f75351edf86ad91bd55db84d428e410380272acfa1d66d1b688aa38457ef95f6205e7d3ca26201c293eb22dabd2c2612e886882f2cfd4910212213b429ab63ce65e67cf6f48eaec079dc14d26d4280162d7ee3939568c325e61e54774b3ef71fb1f42ae4cec9f567d4478c3c6bf6884fcf6f31d526c2c0fd7040f2efa488f3b3789ad8658723c0326cfcfb2eaa3e4787bee28dd0e33bd2ca5cfec024b493b61851f668608b66277746296eb4600cb210b030fdf2dd34263c61cd10c0bd8db72e099b69ca5fdfd1ff62db4c0a661c75356f323fdb562bb20a6ec4f5546ab29e66370f9bc6c663604eadb3c091602ebc817ac82c05e55a04dfd808324cd4ec9f6ec91f25da231492df5f184594e2366b63b320707c3e24078d1aa596a32a296b8c98935135b78a1f2ec676027d7019336a04a4f31e779f7ddc270b2e3eae731465498832a4442d2fe87d5bae26966eb68f30890e3ab2be16870fd6c37c7efbc4e56b3f057a3b7a0023bdbf213f60ec99eb8eddaa99aa5812697ec8dae4a3006c6348576a599efc0468f2874ddfd75681dbb1a8c82c6bf31fa93957b34aadf90a1be1b02b2aaed27f740d3b61519444a6beb2457a43a0e4f77ed52bcea4ddd539ce47e5963612ca981e431601d35d02a38c659e570e2f5dc5a26db20171750f3b317724db9d5b8fd12ef973ab8dcdfa82353ef746811e4bb57a6e463b617ad9b77092d3ff3f775ced4ee02ab186cda26e7c9fa5cce376be9588dbd3227fd8f58cd4d32ffadefb2dcee36b7272da9121982a649306bc6c345d8b5887e616efe9185bc25cbfcce04607cd4015595b02836d52f8644a94c1f6a1750700938e5f6b47aee3827706a58cd9ece4c824060bc0fe450c960ea651a99669ad6143782ff5e2ba4a0b194dfcab1aa554a1a39810ca1254ead1879757e80d258a063b778b3b24e6c22e9ebcba19b498864e29208c2e0f3899c543c19372f8669261b2ad908c6457b2dc2a480d964bcbc661673a9b6525083d79bbbcf8d2c7095e3606a65b50b51c273e03df31ef90329e68e1acafbc96f91304f5bfd82d592d2db99760218413d32ca657d2e845c2fba3ddfa9c6e2de967a08fc5dc749d994e1bf0eb6f1384d17718096f2cc248bdf76328de899c4d2afb06120b5109ae383ca861c7dd8d3088d03a0059cd20cc820b3e18194644ab6b9324ef62a527e425e0d573622e47a2f136721e3f6ea953d6018d4d9576c4cacefbce54feb52aad19f4917b6c4e2f764d96d85ecbc63170d75ddfb0deb492625fe75f3e2a90ec798842b182e0510b252f5cdd1d75cbc486d08b81392dd2e542ca5570d068517ad1a0c46f4acaa81c51147b789f407f3b9495b625b4a113992977f3345d76d4a01fffca94a0460b3a08c86d60a8d259b9fc3aba90ac16defcdd2c66c5ef6a6ed25199c98951b28fa5bad877aa3e2fa49258a266698e0a2ba5c742c519a6eaf8b6e0c397267282d872a7fb304d37c6d8a60cbbdd641dc34871b710371570179f8988ea2baa65995398d77ea120e2b066e0dbdc31b053ee95d80f65c7c781827718d547f1517a7a941ffc1cfd66232fd9011432050a87f92fd1b61f91dc3f01b52c3edbb2d4b0cd6d6c519ea12ac832f9e3f99085670355fe70c8a1b12adf1a37fa8ffb30e4c6c6ce9eaabe22431f0a0ad7f447c9570bdde2d5797728c128b137c166fcd88b15c78c3d2df1aed7e8d70edd54bd858c9450d6681a96201186469129d2fd4317692cd0097ce3c2ff4eaa7280bbc5536b373856d64d5cb33ee7402a41c722c5c0cb23a11921c3ee9563ab258886e92017b3723fbeb5f2723deeffc2168abe35c81c3b9bb7091ff5a244eef78f02ac89f98eac1d3d97af39a908f4bfaa6e161a136bc41f9926d43876194f498f19ba89948c1148102ed192a615a189943a0809ea47b30f19ebe2926e1f536abddbd0eace4c16e8c10863bd8d2c00a3779b624ef6f6f60db3a22d379b4c6bc4fdea363fdab23969bb964ca5b435193ba71b3638e72ee0e32ef998dcb183ac3a047d9a3a49fe0c0b7a093ee212a5c432effcd51d3dba392485c6b0e94600965b8b98678a25218b8c560b28bf02d69d02bbf7484e00f9e3804db5b16f7fdc4d7701012fdcf3f61ebe336863430029de96ec09fd76d64b89447b06aa3ad0b4b204b11252a4feed9d09e4e47634bffeb426f6294b596be25b8e90d2306b117d6d3b56ac40e4e9692fd4c42ffd545219188e168ecc402a3f9ae726060510e27c62aebbe429a6c72949c0fcc58d9927e188219b29e344da471bb602e8a67cd1d5ba33e136a17198f57358d75bb0fc3858180a4b8073f75d5024898fbc39b1f45304a7b03378c76bba3e67c5c4da43a7b3ebf44ce815e1a47306d1413a386d87649cfa16844ce68bd5c4b8f294c0605d34fbc5104b6fecb4c3922c079606a506417fc6462102e0a436e90adaa4588c2947b6c39a664a3c3af38ff8ddf5ad538834d081fb4c7cb05156f75348ee67dc4e9a134806fd3114a3bac5bc69f18ba6620b34b68b33d35582b42e5ebef32e6b6282eb746badeadeb9c67adb36d5924e1c960c927bb3afd7edbbb8c3a927f241f2570f970e53ef574d16393851a8f2fca2fc8c994adbe237786396703582b943f722a6a475dea9ea72ebcb62e2c0b423fdd30711a88549faf74d86d96bf55ae36ad197d0bda06b698dd4902b62f75052402750a70cf70a6c850a6e62203ff6e3b9e812af16c64e8c332fdad78e9afc505df6fd7a0e0771aa6db6bc160013cddf8329ed30341f8e372e3fe5dda4d4272e80b09eb8a0e0363d38cbab53356b5394d206e5f661a870f9d69a449dad08dbf3d8940bb4add0a624ee745d4a8e2a9a6188a270789c318463de323a264de1ca1960fad518c6a0377b13b0c53fc5a8d49d4c263d24b36050100fbbd9b3256edd746cf8dd760cd23810ff4552d1e75f959525ba98c889c402b0d1d03c05795b96721e3fce10983d30e34e6bd56ca1b4ebf326819378a24752b98301a81176dfbc8af8a92757b6c882a8d810f5af4759f57421b2fafd3af4deb5dd53dc17ac9c616c61d70dee7dfe8555d2bda9555b5f4ca26b59b66736d83835ab1ff29468254fd95f1b97ce943f6d15b57cf0d69d1c342432e51898a3f14b4cf1896dbffea68f9eb43d5dcf67d591262da197bd3954d15f8798bbea3913d8938e5d543b106f1c48e7d7ae9529da70dcb314020a61874c83a7c489589cc3b14b98f5459e85c79722c6259d87fce9181039a3eb2cbb0d42284d5bc0e563358deb3ea5dccdd6cc4ddadfcbed8445b640f447f9c6b4577dfa06bc22bb77dd570f72038e3d30c694b21dcaf53b941406745407c92484f4e038e40c3288d50ec952d39d13283e5e2c5b4dfe5b381eab769cd46db1606605a44b1e0ce41e9205a0a63b6e52eb2b85d9a7120a2d4476b1eacbcc719516863f9fde53c3706f1b416d56d26b0cf5fafe4d5cef9ff7f200421910b09841902717226946fb06bf0cac3e29df0180dfd397513f31f839f7c11dedec43997863d9b5598af9704c0e1a70d33e1ffabdcdfab58aa61186d740c7e144805d9efcbf757b0752d631f986c45c7766a30c8dec90a45ed8aa7aa43f975f0e6d1f01540b46b252a61b4cb455d1a78a20464f1f808f01e23cc2d9ec1461c69a72c5b7eaf912392a601fe1c4c24f2db6af168f8c9673bd3371d39bc7d66948847cfde760d9cc5a61f63bc03a6dd8c6996a538641f07166bffa98dfe14a4e76454565836352ede732caa8743c7feb7efc86ac90"}, &(0x7f0000000000)=0x1008) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f0000001200)={r1, @in6={{0xa, 0x4e21, 0xd90b}}, [0x8, 0x80, 0x3927d4aa, 0x7fffffff, 0x8c92, 0x7fff, 0x5, 0x5, 0xffff, 0xee8, 0x4, 0x3f, 0x3, 0x6928, 0x3f]}, &(0x7f0000000040)=0x100) setsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0x10, &(0x7f0000000180)=@assoc_value={0x0, 0x8}, 0x8) 16:56:39 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c4000004c0000000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:39 executing program 7: r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) r1 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) memfd_create(&(0x7f0000000340)='{ppp1eth1self!user\x00', 0x3) openat$hwrng(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/hwrng\x00', 0x1fd, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) perf_event_open(&(0x7f0000000d40)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8}, r3, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000140)='/dev/zero\x00', 0x0, 0x0) prctl$getreaper(0x1b, &(0x7f0000000080)) ioctl$TIOCGETD(0xffffffffffffffff, 0x5424, &(0x7f00000000c0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000380)={{{@in=@multicast2, @in6}}, {{@in6=@ipv4={[], [], @rand_addr}}}}, &(0x7f0000000480)=0xe8) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r4, 0x84, 0x18, &(0x7f00000001c0)={0x0, 0x3}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r4, 0x84, 0x7c, &(0x7f00000005c0)={r5, 0x5, 0x1}, &(0x7f0000000600)=0x8) getsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000000180)={@ipv4={[], [], @local}}, &(0x7f0000000540)=0x14) keyctl$session_to_parent(0x12) socketpair$inet6_sctp(0xa, 0x5, 0x84, &(0x7f0000000280)) connect$llc(r1, &(0x7f0000000000)={0x1a, 0x300, 0x0, 0xffff, 0x2, 0x2, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x10) 16:56:39 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/mixer\x00', 0x40002, 0x0) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f00000001c0), &(0x7f0000000180)=0xfffffffffffffeb6) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) [ 282.350886] sctp: [Deprecated]: syz-executor1 (pid 20015) Use of struct sctp_assoc_value in delayed_ack socket option. [ 282.350886] Use struct sctp_sack_info instead [ 282.369272] binder: 20004:20012 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4980736 [ 282.383517] binder: 20004:20012 unknown command 4743953 [ 282.385121] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing 16:56:39 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f76") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 282.389351] llc_conn_state_process: llc_conn_service failed [ 282.414975] binder: 20004:20012 ioctl c0306201 20000000 returned -22 16:56:39 executing program 1: syz_mount_image$vfat(&(0x7f0000000140)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0x100000000000e000, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb64c86d6b66732e66617400020441000500077008f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000000600)='./file0/file1\x00', 0x3fffa, 0x0) write$cgroup_subtree(r0, &(0x7f0000000480)=ANY=[@ANYBLOB="91"], 0x1) ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) getdents64(r0, &(0x7f0000000180)=""/143, 0x8f) openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101000, 0x0) r1 = open$dir(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) getdents64(r1, &(0x7f00000002c0)=""/91, 0x5b) 16:56:39 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c40000000000000000007cc00000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 282.444319] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue [ 282.471273] llc_conn_state_process: llc_conn_service failed [ 282.575645] binder: 20039:20040 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 282.584395] binder: 20039:20040 unknown command 4743953 [ 282.590276] binder: 20039:20040 ioctl c0306201 20000000 returned -22 16:56:40 executing program 0: r0 = accept$inet6(0xffffffffffffff9c, 0x0, &(0x7f0000000000)) fallocate(r0, 0x20, 0x1, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snapshot\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(r0, 0x84, 0x74, &(0x7f0000000040)=""/72, &(0x7f00000000c0)=0x48) ioctl$VHOST_SET_VRING_KICK(r1, 0x80083314, &(0x7f0000000100)={0x0, r1}) 16:56:40 executing program 6: r0 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x80000) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f00000000c0)={0x0, 0x5}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000140)={r1, 0x4}, 0x8) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$BLKFRASET(r0, 0x1264, &(0x7f0000000180)=0xfffffffffffffff7) ioctl(r2, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r3 = socket$inet(0x10, 0x3, 0xc) sendmsg(r3, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000020907031dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba16a0aa1c0009b356da5a80d18bec4c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 16:56:40 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/mixer\x00', 0x40002, 0x0) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f00000001c0), &(0x7f0000000180)=0xfffffffffffffeb6) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:56:40 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x1000000000002, 0x0) r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x80011, r2, 0x0) setsockopt$inet6_mreq(r1, 0x29, 0x0, &(0x7f0000001a40), 0x14) futex(&(0x7f0000001ac0), 0x3, 0x0, &(0x7f0000000080), &(0x7f0000001c40), 0x0) r3 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r3, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r4 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r4, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x4}, 0x1c) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) sigaltstack(&(0x7f0000141000/0x1000)=nil, &(0x7f0000000380)) r5 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r4, r5, &(0x7f0000000040)=0x100000, 0x8001) 16:56:40 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f7620") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:40 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x100004) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e1f, @broadcast=0xffffffff}, 0xffffffffffffff06) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") sendto$inet(r0, &(0x7f0000a88f88), 0x29f, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback=0x7f000001}, 0x10) [ 283.019153] netlink: 20 bytes leftover after parsing attributes in process `syz-executor6'. [ 283.048872] netlink: 20 bytes leftover after parsing attributes in process `syz-executor6'. [ 283.050892] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 283.075219] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue 16:56:40 executing program 4: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/rtc0\x00', 0x0, 0x0) setsockopt$inet6_MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000300)={{0xa, 0x4e24, 0x0, @loopback={0x0, 0x1}, 0x401}, {0xa, 0x4e22, 0x8, @empty, 0xf6}, 0x91, [0x3f, 0x0, 0x4, 0x0, 0x3, 0x3d70, 0x9, 0x8]}, 0x5c) openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x8000, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000440)=0x0) sched_setattr(r1, &(0x7f0000000000)={0x30, 0x6, 0x20000000, 0x0, 0x0, 0x9, 0x10002}, 0x0) statfs(&(0x7f0000000100)='./file0\x00', &(0x7f0000000240)=""/116) getdents(0xffffffffffffffff, &(0x7f0000000480)=""/115, 0x73) sched_yield() pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNGETIFF(r2, 0x800454d2, &(0x7f00000003c0)) ioctl$KVM_GET_PIT2(r3, 0x8070ae9f, &(0x7f00000001c0)) ioctl$sock_SIOCINQ(r3, 0x541b, &(0x7f0000000400)) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000040)=0x0) sched_setattr(r4, &(0x7f0000000080)={0x30, 0x0, 0x0, 0x1000, 0x7f, 0x6, 0xd29, 0x4}, 0x0) 16:56:40 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c4000000000004c0000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:40 executing program 1: clock_settime(0x200000000a, &(0x7f0000000100)) 16:56:40 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f7620") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:40 executing program 6: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f0000000100)) chdir(&(0x7f0000000080)='./file0\x00') umount2(&(0x7f0000b1d000)='.', 0x2) mkdir(&(0x7f0000000140)='./file0\x00', 0x29) pivot_root(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='./file0\x00') r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cuse\x00', 0x101000, 0x0) ioctl$TIOCLINUX2(r0, 0x541c, &(0x7f0000000180)={0x2, 0x81, 0x7, 0xffffffffffffff7f, 0x0, 0x2}) 16:56:40 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) openat$mixer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/mixer\x00', 0x40002, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:56:40 executing program 7: pipe2(&(0x7f0000000040), 0x80800) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000003000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$TCSETAF(r2, 0x5404, &(0x7f000005dfec)) r3 = fcntl$getown(r0, 0x9) sched_setparam(r3, &(0x7f0000000080)=0x2) sendmsg$nl_netfilter(r1, &(0x7f0000d65000)={&(0x7f0000de2ff4)={0x10}, 0xc, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="240000000301ffff000076411c95000000000000080015000000000008000800e5168d76f2a60439c7e8c9f1366013eecbfe08023d559f3957948f42826ebb7dcae126cfb36c786ca3e5cf09c4c5af8e558acd47389fdb1aa391610adf24", @ANYRES32=0x0], 0x24}, 0x1}, 0x0) 16:56:40 executing program 0: socket(0xb, 0x6, 0x3) r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e23}, 0x1c) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000080)=0xc) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000180)=0x0) kcmp(r1, r2, 0x0, r0, r0) openat$urandom(0xffffffffffffff9c, &(0x7f0000000280)='/dev/urandom\x00', 0x80, 0x0) listen(r0, 0x5eb857) r3 = socket$inet_dccp(0x2, 0x6, 0x0) connect$inet(r3, &(0x7f0000772000)={0x2, 0x4e23}, 0x10) r4 = accept4(r0, &(0x7f0000975000)=@can, &(0x7f0000000040)=0x80, 0x0) sendmmsg(r4, &(0x7f0000000c00), 0x70967c17166daa5c, 0x0) recvmsg(r3, &(0x7f00000016c0)={&(0x7f00000000c0)=@rc, 0x80, &(0x7f0000000440), 0x0, &(0x7f0000001640)=""/112, 0x70}, 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000240)='/dev/mixer\x00', 0x4c00, 0x0) ioctl$LOOP_SET_CAPACITY(r5, 0x4c07) recvmsg$kcm(r4, &(0x7f0000002700)={&(0x7f00000001c0)=@sco, 0x80, &(0x7f0000001500), 0x0, &(0x7f0000001580)=""/185, 0xb9}, 0x0) write(r3, &(0x7f0000000840), 0xff98) 16:56:40 executing program 1: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$sock_ifreq(r0, 0x8991, &(0x7f00000002c0)={'bond0\x00'}) r1 = socket$unix(0x1, 0x0, 0x0) connect$unix(r1, &(0x7f0000000000)=@abs={0xb503ed393c3e8a3f, 0x0, 0x4e24}, 0x6e) [ 283.481120] binder: 20084:20090 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 283.490066] binder: 20084:20090 unknown command 4743953 [ 283.495865] binder: 20084:20090 ioctl c0306201 20000000 returned -22 16:56:40 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f7620") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 283.522019] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 283.541413] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue 16:56:40 executing program 7: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) r1 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x80000) ioctl$RTC_WKALM_RD(r1, 0x80287010, &(0x7f0000000180)) listen(r0, 0x0) r2 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0xfffffffffffffff8, 0x0) ioctl$sock_inet_SIOCGIFADDR(r0, 0x8915, &(0x7f00000000c0)={'sit0\x00', {0x2, 0x4e21, @multicast2=0xe0000002}}) epoll_wait(r2, &(0x7f0000000040)=[{}], 0x1, 0xfb) connect$inet(0xffffffffffffffff, &(0x7f00000003c0)={0x2, 0x4e22, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r2, 0x6, 0x21, &(0x7f0000000100)="ae28996840497fdcdaa3801649612a45", 0x10) 16:56:40 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000002000000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:40 executing program 6: r0 = epoll_create(0x6) r1 = epoll_create(0x4) r2 = socket$rds(0x15, 0x5, 0x0) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x184) clock_gettime(0x0, &(0x7f0000001bc0)={0x0, 0x0}) recvmmsg(r2, &(0x7f0000001b00)=[{{&(0x7f0000000480)=@ll={0x0, 0x0, 0x0}, 0x80, &(0x7f0000001540)=[{&(0x7f0000000500)=""/55, 0x37}, {&(0x7f0000000540)=""/4096, 0x1000}], 0x2, &(0x7f0000001580)=""/198, 0xc6, 0x4}, 0x1}, {{0x0, 0x0, &(0x7f0000001780)=[{&(0x7f0000001680)=""/22, 0x16}, {&(0x7f00000016c0)=""/146, 0x92}], 0x2, &(0x7f00000017c0)=""/254, 0xfe, 0x8}, 0x5}, {{&(0x7f00000018c0)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @ipv4={[], [], @multicast1}}}}, 0x80, &(0x7f0000001a40)=[{&(0x7f0000001940)=""/96, 0x60}, {&(0x7f00000019c0)=""/79, 0x4f}], 0x2, &(0x7f0000001a80)=""/80, 0x50, 0x38bf}, 0x6}], 0x3, 0x2100, &(0x7f0000001c00)={r4, r5+30000000}) lstat(&(0x7f0000001c40)='./file0\x00', &(0x7f0000001c80)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000001d00)={{{@in=@loopback=0x7f000001, @in6=@loopback={0x0, 0x1}, 0x4e20, 0x1, 0x4e21, 0x0, 0xa, 0x80, 0x80, 0x3f, r6, r7}, {0x100000000, 0x7ff, 0x2be, 0x0, 0x1000, 0x800, 0x9, 0x8000}, {0x2933f0e8, 0x0, 0x8000, 0x2291}, 0x68c4, 0x6e6bbb, 0x0, 0x0, 0x1, 0x1}, {{@in6=@loopback={0x0, 0x1}, 0x4d3, 0x6c}, 0x0, @in=@remote={0xac, 0x14, 0x14, 0xbb}, 0x34ff, 0x4, 0x2, 0xa2, 0x4, 0x7, 0x3}}, 0xe8) r8 = epoll_create(0x100000001) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r8, &(0x7f000000e000)) r9 = socket$inet6(0xa, 0x1, 0x0) r10 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r10, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r2, &(0x7f000000d000)) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f000000dff4)) r11 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x80000) r12 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') openat$sequencer(0xffffffffffffff9c, &(0x7f0000000240)='/dev/sequencer\x00', 0x12d100, 0x0) sendmsg$IPVS_CMD_GET_DEST(r11, &(0x7f0000000200)={&(0x7f0000000080)={0x10}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="01000000", @ANYRES16=r12, @ANYBLOB="000125bd7000fbdbdf2508000000080004000900000034000300080001000100000008000300040000000800010002000000080004000200000008000500ac1414bb08000500ac14141c"], 0x50}, 0x1, 0x0, 0x0, 0x4004}, 0x800) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r9, &(0x7f0000000140)) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r8, &(0x7f0000000000)={0x20000000}) read(r11, &(0x7f00000002c0)=""/161, 0xa1) 16:56:40 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:56:40 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000003fe8)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000013e95), 0x4) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x1b, &(0x7f0000000100)={0x0, @in6={{0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, &(0x7f00000001c0)=0x98) dup3(r1, r0, 0x80000) close(r2) close(r1) 16:56:40 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qat_adf_ctl\x00', 0x280, 0x0) ioctl$TCSBRKP(r1, 0x5425, 0x8444) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TEAM_CMD_OPTIONS_GET(r2, &(0x7f0000002940)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000002900)={&(0x7f0000002480)={0x14, 0x0, 0x0, 0x0, 0x0, {0x2}}, 0x14}, 0x1}, 0x0) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000080)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000002b40)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r2, &(0x7f0000003ac0)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000003a80)={&(0x7f0000003240)={0x20, r3, 0x225, 0x0, 0x0, {0x2}, [{{0x8, 0x1, r4}, {0x4, 0x2}}]}, 0x20}, 0x1}, 0x0) 16:56:40 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x0, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:41 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r1, 0x0, &(0x7f0000000080)) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x8000, &(0x7f0000790000/0x400000)=nil, 0x2) ioctl$sock_bt_hci(r1, 0x400448e4, &(0x7f00000011c0)) [ 283.745464] binder: 20115:20125 BC_REQUEST_DEATH_NOTIFICATION invalid ref 536870912 [ 283.754159] binder: 20115:20125 unknown command 4743953 [ 283.759853] binder: 20115:20125 ioctl c0306201 20000000 returned -22 [ 283.777945] binder: 20115:20125 BC_REQUEST_DEATH_NOTIFICATION invalid ref 536870912 [ 283.785943] binder: 20115:20125 unknown command 4743953 16:56:41 executing program 1: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000040)='/dev/md0\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1000000100002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$BLKFLSBUF(r0, 0x40480923, &(0x7f0000000080)=0x200) 16:56:41 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c40000007cb00000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:41 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:56:41 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x0, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 283.793205] binder: 20115:20125 ioctl c0306201 20000000 returned -22 [ 283.807385] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 283.833686] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue 16:56:41 executing program 7: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x2000000000000044, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_REINJECT_CONTROL(r0, 0xae71, &(0x7f0000000080)={0x7fff}) ioctl$TIOCSSOFTCAR(r0, 0x541a, &(0x7f0000000040)=0x8335) r1 = socket$netlink(0x10, 0x3, 0x10) pwritev(r0, &(0x7f0000000100)=[{&(0x7f0000000280)="ac8359589004e9c9924ba53f4f083262a1a0b3223f71eed9a1dc3e8f28240a9ddd9c3dbfcd6ec2957bd01a08bef6651366c658200b39b046db4f66793480153ea225dbabc8d836220d68e1041da391eead6360dec46cfd6be717d0162d9baacaa6abc6c84dd7c2e3bac71b185e731aee47b6e399028f1f34ccebc2eb604ab5b6522200ab822fdab55cf6d51303ab2a3e1f6ae9ccf5c1c50674e481c411e958ec", 0xa0}, {&(0x7f0000000480)="045ae6bd2eb7de6d5b9bae2a198939bbdcb99c91e35978de0f337300e7ee96071e7e4ff7b5fb4bcb8d0c3a89c4402d8380f11e65424760fdf185490219a56d785c6b5793cf9a9b24916305f3952d578648eb9de7572db10e3d5825766b3f7e44d0eb8b59d94457d41e5d96f3f57183ecdd608b31340654754cef2e16017f326338d99213406a4c86db9d496f33485b13e47ee83391f1e7ca6037b0b0705fa6e77f4c", 0xa2}, {&(0x7f0000000540)="dd29994ca4ce5550b6e9f53f89dd70626d96bcebc59d53b991220f8118993a494e5049d9cac4214c18da3b90d54d0c61c0bbbbd670d4ce560fe1794566d6485f4d28fdba2e3cec2eda66ada1d0ad851e7687d48240d3a0e50cb27db20d85d49ebec0cbc21bdb4e7428e6141a05f5003591df4580d929b163aae7a3e1870ac5e292d01460010449f1fb745eff07df9d8888caaa8f1bcdbe0b04495af0b47c0896839cfbddd63b011c482a49bd7ff55a5ae58027bcaeaffc4e28e3f9c38ed7f320559ecbd2e3dff8c78130455a2f4b84312096fe326220c8e34d9dda6aa1ae8c29e2916e046200f25653056b930e3fc38f09", 0xf1}, {&(0x7f0000000640)="0ddca5990e8770116ad62755ff9b3e04facb54eca40a72747ca54cd7d47eac5f06ddd336cdf0636d4f971ae15a2c00e1622a14a5861c32c3c3a4580b2822ef2d8769f3e92be9f676794fa3bbcef73b8bd5df2ecb336a76a7d266710ff8a52878633463bd016d7c8b884d9985bb4084efb5865d7732d3b916dd90d1f2d109a5d89cd84876f83ece92dbe253cdc2194ca66198389dcc51f19e877a8999e4165fbbd74b614fffa84e965eab890e783ee4c180a31f79e94924b344bcaa3ece9cf7807da1e7255a0932cc4d1766b38811c3ee83585dda16d8629ed67d2b69d67ace7cdb0557e0dfb6183763d97f", 0xeb}, {&(0x7f0000000000)="2c6b618c3e9ca98c247b215a5bbf13ce70438e5f89ac020cfbc17ec8fe66d2932aa5537d71e2982f3cdff75955730fad2c4d4d4152f0ca57e3", 0x39}, {&(0x7f0000000740)="456731a5b019d6807d6374c72c3f744f4aaf234c156080762e52592ba7064e95fb9c376c4b926f760825b2621c7345095af737d74dc0de05eb0d8fdf3c93105d261e4363ed223f741c3289b473eb62bc1565bdfbf252fd6fb553da170854e33a2e77ca1b4022537fa361fa948fd37a5e6828eeb48d7dd4231736678eacadca37045ec3e8e70d141aea1438902a6555ef670c30a884ff126601544304859cc7d6c1ca9148fc8f68ba9c58f05b4d401d4cd243189c456857", 0xb7}], 0x6, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000180)={&(0x7f0000024000)={0x10}, 0xc, &(0x7f0000023ff0)={&(0x7f0000000240)=ANY=[@ANYBLOB="240000003000ff0a00a9e07677000003000000100000000c0001000000000000000000"], 0x24}, 0x1}, 0x0) clock_adjtime(0x7, &(0x7f0000000380)={0xffffffff, 0x6, 0x1, 0xc, 0x9, 0x9, 0xffffffff, 0x5, 0xfe, 0x4, 0x8c, 0x5, 0x8001, 0xfffffffffffffffe, 0x1, 0xdb, 0x40, 0x3, 0x2, 0x8, 0x119, 0x3, 0x1000, 0x302b, 0x1, 0x8001}) [ 283.937602] binder: 20143:20148 BC_REQUEST_DEATH_NOTIFICATION invalid ref -888733696 [ 283.946678] binder: 20143:20148 unknown command 4743953 [ 283.952530] binder: 20143:20148 ioctl c0306201 20000000 returned -22 [ 283.963840] binder: 20143:20148 BC_REQUEST_DEATH_NOTIFICATION invalid ref -888733696 [ 283.972123] binder: 20143:20148 unknown command 4743953 [ 283.977813] binder: 20143:20148 ioctl c0306201 20000000 returned -22 16:56:41 executing program 0: r0 = socket$inet6(0xa, 0x1800000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x11, r1, 0x0) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r1, 0x84, 0x1e, &(0x7f0000000080), &(0x7f00000000c0)=0x4) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x10001, 0x3, 0xf000, 0x1000, &(0x7f0000ffc000/0x1000)=nil}) r2 = perf_event_open(&(0x7f0000000180)={0x6, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r2) 16:56:41 executing program 1: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000140)={0xaa}) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$binfmt_elf32(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="7f454c4601040604ffffff7f0000000003000600080000005c000000380000000f03000000000000ff5b2000010002000002810000000000000000704a0b00008800000005000000ffff000008000000060000002b09000051e574640900000009000000090000007f2f000002000000000001000900000036b1ed7b51d5805a3cc9b7ef75a2849db03caabdfe7297140d8a4b4b5d79f9732fe0fea43e028ee35633984f6bb29aff7969ded51611c9520a54660a8eb2ac7b5c95cf189291fa86aa977a3bc40a0aa3a1391ba1c821ec1578adadd06fa06b7484f6a49cb61f66c1fa3edfa4bf4f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x5e6) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 16:56:41 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000060000000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:41 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x0, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:41 executing program 2: mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:56:41 executing program 7: r0 = bpf$MAP_CREATE(0x0, &(0x7f00004f9fe4)={0xe, 0x4, 0x4, 0x100000001}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00005f1000)={r0, &(0x7f0000eed000), &(0x7f0000b88000)="13"}, 0x20) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000500)={r0, &(0x7f0000000000), &(0x7f0000000440)=""/129}, 0x18) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x98000, 0x0) ioctl$KVM_KVMCLOCK_CTRL(r1, 0xaead) 16:56:41 executing program 6: r0 = shmget$private(0x0, 0x4000, 0x40, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_LOCK(r0, 0xb) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={"79616d01000117000000000200000300"}) setsockopt$packet_buf(r1, 0x107, 0xf, &(0x7f0000000340)="9ff98c7a", 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(0xffffffffffffff9c, 0x84, 0x70, &(0x7f0000000100)={0x0, @in={{0x2}}}, &(0x7f0000000040)=0x100) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x280000, 0x0) writev(r3, &(0x7f0000000380)=[{&(0x7f0000000200)="086d4c8dab39a5a389256248e0ca3a2ad62bd580418d1d", 0x17}, {&(0x7f0000000240)="90472ec10f675ff7ec7b380358c3133b150f9939754a63062e5db4006bd2929e1ca8887f0cd208ab20f2e97b9b9fa76f4ea94158395fca11837fbbcd6df7a1260fec7807020810d46c8584464bbf4cc1f482c14ed86224255fef2585a12e75717660864bc57c508664dd1d3904", 0x6d}, {&(0x7f00000002c0)="77302f49bc8a019858c0bfc13040f99485b4aaaa5e967062ffd6984da1ba8766389d930fb2ddf91e162059e5995ad4bd3d42fa37da011b59370eaff5db29f39fb3d2504c363f33e293d07ce97e9866679faa798ca96cd5f6f4f0fcbd", 0x5c}], 0x3) setsockopt$inet_sctp_SCTP_AUTOCLOSE(r3, 0x84, 0x4, &(0x7f00000000c0)=0x7ff, 0x4) dup2(r1, r2) sendto$inet6(r2, &(0x7f0000000040), 0xfc87, 0x0, &(0x7f0000000080)={0xa, 0x0, 0x3, @dev={0xfe, 0x80}}, 0x1c) 16:56:42 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x0, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:42 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @ipv4={[], [0xff, 0xff]}}, 0x1c) listen(r0, 0xffffffffffffff7f) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000100)={0x0, 0x2, 0x8}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000380)={r2, @in={{0x2, 0x4e23, @rand_addr=0x4}}, 0x8, 0xb8b2, 0x400, 0x0, 0xc0}, 0x98) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r3, &(0x7f0000000080)='A', 0x1, 0x0, &(0x7f0000000040)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(0xffffffffffffff9c, 0x84, 0x75, &(0x7f0000000000)={0x0, 0x9}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x1f, &(0x7f0000000180)={r4, @in6={{0xa, 0x4e22, 0x7fffffff, @local={0xfe, 0x80, [], 0xaa}}}, 0x7f7, 0xea}, 0xfffffffffffffec3) 16:56:42 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/wireless\x00') setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r1, 0x84, 0x65, &(0x7f0000000040)=[@in6={0xa, 0x4e22, 0x4, @dev={0xfe, 0x80, [], 0x1f}, 0x7e138d83}], 0x1c) bind$inet(r0, &(0x7f0000e5b000)={0x2, 0x10000004e20, @multicast1=0xe0000001}, 0x10) ioctl$TUNSETOFFLOAD(r1, 0x400454d0, 0x10) connect$inet(r0, &(0x7f0000ccb000)={0x2, 0x4e20}, 0x10) r2 = socket$kcm(0x29, 0x1000000000002, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f00000000c0)={r0}) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, &(0x7f0000000100)={0xffffffffffffffff}) sendto(r3, &(0x7f0000000500)="036fb904bae280d95d40135c9b0a4329cdd312c218f117e2bea31ccb12d2769a6e15f7255d670926e71d15d86cf95dc591671716dbbd4a57a9d25783d766b76aa0253f3a048ce32f649100b1fb7a8a640320f7ad70ef489eebfe625deb1f746b2d57ad6ffcebf766574249e2f1ce8d9a947cfdfabc17f382cc056570ad6c96658af7af013bd7e96ec9d401eb7a1825cee6adac1128f3b03f1809b9ea287051f64116510c0bbd676d331453ca2362e41ae728b088b3916735d7b39f804fdf58d87a8f8755bd1c62d86cba7d8d55fb9771647ba7992201698942a1a37e1f5375f2f70cc2968e0ede024ffccb69b8f641427f6ec4bae9227b1670b5beb9c321c4e218372d286a60e831291ceb154cca1eb8ddf5b3282707abcd2a41b071b87f53bbed74dca0310fba1d13a3ccca0996af17c67b3f55636c410a36ba51a5485bc8c06b5c476a394c85335b48c1423583eeece32dd20c5620d3550161e019b5fd24f3e8fa31894b1fe616f6ab0dbb85bea66bb100d9f20264741ed43713335bcdef5cb08e42f539cb3a3cd08eec56a464a5c662f3bb74af64f5a34005670557814b771423d9dc73cd3cd0c43f69de21a3f3ea19b4a8f872d2ec4bc745f970299e47089c2a884c55bc9b4f34a432cde865b073efa04da62e31d4a53e52eeeb55b94d1f547d2656f9cc32fed66932f9d6e1ba21b7ad53e8b03522fa560dbc8f6d93707c900b09d44ed182fcb812988163821a65a966c8a9bcfe2ff55f0735ef7d61eb61ad91d8b382067b829de01e03cf74cfd61c336cf551f19504eddef20be3db65c22322b524a41f6b671aa3f401b32fec3c8d72ab958867130a15dc69ca5b5f3bf25b9d328cefd7f9309614bd7c23f926f2c6fbbd4a7b6202a4b912761f8efc591480a82636590c8a5c3be910802db99381c4c8a41db38322", 0x297, 0x0, &(0x7f00000003c0)=@pptp={0x18, 0x2, {0x0, @multicast1=0xe0000001}}, 0x80) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000080)={0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000140)=0x18) close(r2) ioctl$sock_kcm_SIOCKCMCLONE(r3, 0x89e2, &(0x7f0000001a40)) 16:56:42 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) io_setup(0x101, &(0x7f0000000000)=0x0) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x0, 0x0) io_cancel(r1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x3, 0x8, r0, &(0x7f0000000100)="6f7ab90a56743e856b681bbdde29630ddee1f2dde8b8f8344e1fdd3c95719c4e05d912fdd10c20795c8f0b1c6cf2861e6b0998597ff0ac609b55a1cf13dade44c3fab9452bdcfac2407d0860f4a1956678f473d6a2a4300ce1a131e640d17fc6550a56762a76f7ecf4950ff4c0c6634b7dc721da8b0db40111f035c5c1a68e3aa8bd236aa48d1365c5136b1d3ecf1ad9563699a1dd4ee2f9015002b24037b3a63ac627ede1079a1c2a84340f9b1738260e3c21368e0860375181679b4a2499e4dd05dabb8f527c55aa066214eb09a86273ac8fcb53a4588528f38baff95fdd7e17836e199d3438cc6d546f2c57", 0xed, 0x2, 0x0, 0x1, r2}, &(0x7f0000000200)) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r3 = socket$alg(0x26, 0x5, 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000300)={0x0, @in6={{0xa, 0x4e22, 0xff0, @empty, 0x9dba}}, 0x9, 0x6, 0xffff, 0x80, 0xffffffffffffffe1}, &(0x7f00000003c0)=0x98) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f0000000400)={r4, @in={{0x2, 0x4e20, @local={0xac, 0x14, 0x14, 0xaa}}}, 0x1ff, 0x2}, &(0x7f00000004c0)=0x90) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/igmp6\x00') bind$alg(r3, &(0x7f0000001100)={0x26, 'hash\x00', 0x0, 0x0, 'sha256-generic\x00'}, 0x58) getsockopt$inet6_dccp_int(r5, 0x21, 0x6, &(0x7f0000000240), &(0x7f00000002c0)=0x4) r6 = accept4$alg(r3, 0x0, 0x0, 0x0) sendfile(r0, r6, &(0x7f000025d000)=0x28, 0x80) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000540)='IPVS\x00') sendmsg$IPVS_CMD_GET_DEST(r5, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x38, r7, 0x300, 0x70bd28, 0x25dfdbff, {0x8}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) 16:56:42 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x0, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:56:42 executing program 6: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000080)=[{0x0, 0xfffffffffffefffc, 0xffffffffffffffff}], 0x395) semop(0x0, &(0x7f0000000000)=[{0x0, 0x7}], 0x1) [ 284.720880] binder: 20181:20192 BC_REQUEST_DEATH_NOTIFICATION invalid ref 393216 [ 284.738288] binder: 20181:20192 unknown command 4743953 [ 284.757131] binder: 20181:20192 ioctl c0306201 20000000 returned -22 16:56:42 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000007fffffff00000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:42 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000380)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000040)={r2}) connect$bt_sco(r3, &(0x7f0000000080)={0x1f, {0x3, 0xac11, 0x6c3d9c6a, 0x10000, 0x7, 0xd}}, 0x8) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000013e95), 0x4) r4 = fcntl$dupfd(r1, 0x406, r1) ioctl$SG_GET_SCSI_ID(r4, 0x2276, &(0x7f0000000000)) setsockopt$inet6_group_source_req(r2, 0x29, 0x2e, &(0x7f00000001c0)={0x5, {{0xa, 0x0, 0x0, @loopback={0xff0f000000000000, 0x1}}}, {{0xa, 0x0, 0x0, @ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}}}}, 0x108) close(r2) close(r1) 16:56:42 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x0, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:42 executing program 7: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x80100, 0x0) ioctl$TIOCNOTTY(r0, 0x5422) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f00000000c0)) connect$l2tp(r0, &(0x7f0000000140)=@pppol2tpv3in6={0x18, 0x1, {0x0, r0, 0x4, 0x4, 0x2, 0x1, {0xa, 0x4e22, 0x7ac, @empty, 0x6}}}, 0x3a) prctl$void(0x3) ioctl$RTC_IRQP_READ(r0, 0x8008700b, &(0x7f0000000100)) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x10000, 0x0) write$9p(r1, &(0x7f0000000180)="aea658009af9679ac48fa4ebe6e3317e8acff4b692253d2f09807cbbe1da5bdecd83a2aad701452660630543fafb843ee678a41bc776d4cabb79e11c30affd85a5210b658d795fbc15793b211dda9e5989b426ef438ff684dbaca1618198623438754c7ab3705ab3461a517ff371d5ef5817c7abe2a15883b9a94b8eb9c812c15b498741b2a70d26efcad5d5af00b6492abecb82c4208b818567d7ed62be96c69e6245b474d1de7e837cffce346ea029652d26fe4427f78efbfdc14c9e07a27429939ac99b4e7d89f0bf29f838cbc507437dd1285b660901336c0a104de7f7455ce00a28767a57d93f574cdedf96deed49c1fc9ed41dcd60b0f8179c9cc4aa03472e4291f7a3744dd863754ea2dd6a49042bf906c05be3f41f736e27381d56be4363a035afc50fec379683efb0f9bdf56013d693132ea61c7f11b7358a1223777247126e1528a90fe26158699e24ed2dd4800aa2b0b3f8e40609284605db86676232b76cf1de8719d9784a17d03d2671baafc4994cee6e02a424575211df5adedf20052677577997355e0fde4b1c1ab4295fdc6c119b4228f9e8f9fbe68ab64758e39acbcc9b31001e8925866889e2f22805dd24e4c2c30868f73ec81e24b451efbdccc2d12b19ca18bf264161d0fa315f1156e6898120fb8c83558d6a199e400a1837312fdf6f2db23f8bbbab6df72b0c3105932aa0e8bc99cb14b3b305251095ee087be78d9a5f4c2532c8a8a5821d38763dc7c3494eb4781343805b95ce8518001a2f4eaf59ad79fe78c1ba328117984a8e614001dc8251848ab708572b750f60bc9c4ba9c5c04322722fb1e78bcbe1d5f90663b68f2be1f5a46f5c6daa9cd32c81a59b174ebc73abf50e29375a103657e949912e0d919956332bf22b1cf4f55c599b9b9114ce66aa68514d951e4156833bcd9c4c213510177a408d48a2c0d635c56ae5705758a2340916d584e33ffc7ed2dd5ac31f0dadbfeba61ecabe1a68747f91953f760922ba773139f4140d69b669ae642aaed274634edf097391557ae753088d96a70fc56258058e2063c8fed59bfc51bb60f594892ded794133958e52e57964081e6c3898994922542e8b3dbbed4da2de1c955c0d72d0cf4b19abb0d23fd81640d23e73a10c7c4c219d1103e929769657b08c19840fc6a9b277def7a27304db97da1cd99d636a4ee64475360bff91ba190a76b85bbf0ef45bead3f92366f1a9d703688f5744474cc7b6afc8cd3341017f0c6d30e2d22e2b80f59d74d68c990ea11a44271d45e425af217c07cbef6dca42ad93df1ddff264710d918869f250f5465c0497698019657b757640e0d7751edd555d61ca7b0ff25bec4572b3eac3bce2dcf985f8d7bbe4453c79ca2c0ecc7f03421a2e790c881193d2f32d6edce105dec1e431844299fc2428bbb5575364a4d0bfa1f8be5d3f8f4468bbac99a0679782bb7e7eba1095775c335b9a6c77ca3c281086637661b86ed6a51e480a7ebe79bba93455824ed4a1c97d79bd06b8c859363b5fc1c92f7696ea61a72a3a1b5955058463cca53fba34a0dd840ffd359da4c45373e7ee51176f73f7da633f87e61e5478569ceb2468b37778234937eb293bf88b7c7bd3d7a0dd1b4cceb0e2fd81f15a2c866ca9a48d60ad978ee80238cc9aeb246cc9b2d44d3b512530ddc3673a179002f1b6524d91daf03def668170550784723dfa3bd8dd860f1749a3c185728d6c9ac90857d8a4464c6c239d5bfc7cf2c973764fb924c9e6003932d524c7aa5d93d1a8c596cb5a1e2fd42977693b782d2713d2fbabc5cfe29ee4fef07ac139d5fb2861d502d532c4738465397e76fb2bb790693e69612f6036779cd01afd0c0ab2313340dba89aac82e40ed4b1b8e3e9288e1e98a3625847331ff860100f465f014601c11acebe97f9b3607cc6376c14b6fb19edf992b9fc67366cd6f5779aa6c3308b0c8038736b9efe3596508d29c53be9d4630ebcf3b4cd2229f68910026a0e37ff1e884f24c17a2c50b8d95893d9a2e6460a7c6f4e3fd88b8f305b0714647407fe0a2d1c23347fc65c3bdc5421532106bb4c766042edc5c33613cd731a2d0aed01943e8225a43dbfdf17d70386f29ad9caabdb8504253ceae0fa29f50b1d0d0e9b93949e4979087d40fdc59192ec0b27b1c6a5892fcb2cc15c9369ba31bf892caa3b7bc52a4a571525dec8f0df162a598a2c5111c78eb1b9f718244233de07b01661152545749daf41c8dee67d0f4ccd60ac4d64b92e7f76117db192bdc1aa0cbfa2da3d5f7c70eed44fb375b3171ea33ebf1e5a5e0300b55ffa1d2dceefd03579d3fd8e0a1630c3d1d94dbfb3c2b74994026d38a74a10bc473f140f06e56f6f3f57b2e25dbd3146df2fae526a38a56df9c84effe50f2321578ad333ae995e05b2eb4a36a3ee1d5c9b8c66f9acd9b8e8eeec5b448b962b5a299bc2c27376cc77a2a670de14b966e80d6efff7ae12b88768d46cde5f40f10b6fc21459f4e01f2046734f68e5b1bccad2e333f58ff7417ad84d68e2d99a9e385a0365ffa922effcdd041336641f081b28de03bfc1b531c626e614584c3a62a1b9e7643b7e4bb1f361e105f65714fad4565315a035fd527d00cf85df0b45adcf856590884411e1f492f678a782e903a8ee7ab829c0e5d57c086b67aa1ffe616edf4f10ec4baf3f80784095511ed18765eede701958867f3973e3342cef418dcc93ebd65ac966f4ea8a70aa08e42a2e1f90f8f7f8f92e748d08e3ba0a2a90dd2aa6f03ff5b16b7fa62e14970c97dfc2839e1dc24047659477f2ab7d03330b258933900401a06f0a44f46f25ceaf299561f07a28ec88ae60a0dbb1626492e1dc8fdf967e0161bc4ab7a6f124919fda6d41c4491ba73296c7652bc2e39ea8be3c4cfb2eeb475a04fe3f8405698b165961fa7437588753ca28ab495364562329e33f2ef5511eeccca2335b64693afc89f942b891eaea2d19257b9f3d67091b94fedbce7f4820bd430bed11956dcf5814c3eecd4af722754f3893ba3780a873afaa5f3c5835e9e949117fb8843192f57714864da740f0037508caacca525ddfcf8a7e7e1221a4f76036959b890879a18df0ce9471d2546a16345597d7d4643664a03f9c428bb5b9a33b3330e3201a879a7fb2795a66f20cd00ebe664d6ef50f9794227dbb4b902f179a0d4af03a881a63cef6628150b7c457b99f4662a7cc18c0e5dca0058a2ed2f71e9ff88d94c022c428bcbf8de9e839072a4380f4f009a0c2fbc5cc977cc940919c7a5075f9878cc51ad8d96228982112eced2cdf4af52242b38b9637faccfd1f42cb52b932790f8912f0ae2ded0031a5530b07c843c87bee946904cceadfcb4c3a6befefa64dbad85fd1bf0275d817ffbde43b7977476af74c1df23349a044654b1697ce6ee4c77ccad23e4017f69f1a103766ccdc7dcc5718ce6db1e2bf3bb4696aabb2c0aa71daa4e0d193b356a149de3765216814bf4f5c753424fa16654c0ac64b0f7f574e390d8eba546b4b9b8f20439f988d4018e8095f018a47b1a24c5187fffc9e8dc696fd8300eed5a417af510ef17e1d2ac9a73061e139db1a1eb942430ff16a8cf647df76d598fd835d46852782b398be51ffeecfacfe839a54b9ae5857170087e963469ae28ed8c32ed5088e26ce782c93b24f4e68dd63c8072b56e15c52aef91fb7a4a305be23827a5ec01d7db41ec45bec19f1872c2e4ebc7b5df9fd2b59e2a2e82f59b21f741d7693b1652ed38d4e0bf7245affaa49cfdc163f41eaa5048ea0cbf1c0544abb9d6b6d109569fc24910eabbcf9c88f5e04c2424d6c9ccf06d906c69ad05f589c0fd9603008a813bbdb3e70b573601ab3709aac37efccd3f1c128833d2abf2c476f659ddfc4feccb7f306f89949e6ef3e5595ac0ed8c7d02a83b72d6f5606427b4a27aa16fd5251597d5d50157b962192cc044d45ed97f9f8beb7ba75c4d3b48e4630520eda1be356a1f097867bb8614db727987ab50aa3cd1f59d0b1682913f1906b637714a6c50c101f7e85c4552d1f07dbc9e2527f6156939061a8b2d0b9942820c0ca9d44041fc7ba059444a890edf67a99fdb9ab1175408983a8d87f70156856e6beddeeee35f9a59eadfbf12fe9b5ae120d01da275a1a1426d0fdbc27426ae2c9046c21349a26d1545787f84f16b9bdad39624f9b75341b209b6a27b5908fa9164e5534df9882c79a2f9e9d4a37685c13cc20f74e6076b39d417475d5f2cb7057917268441a5cb875a02f5d09cc8bd5b1b477936cb07f6fd1cbd789fee6dd6fa5e475a5a44df7dbd0fbdd08e902b6ff9015c2b012fbcb570131e70e49783315e385aa0e000eb80d142faae9cdcaf3923a195aea9b3aa4dbfd2641d024ace84647dc194d98e3e6086230b3f370c494ddbceb76114453d3a71d0186b32ad236b72dd7d4d19c8b203ac0c38aebabd3b3e16204d98eaf90150e997c69dca5144b3cffc0806c43cfc63f775254d7020b6a22043f15f5ee761e5cec389089c9f3188ab7a133d05354edcc637438da20ef4a9638aa61bed02eb9de75f85c461cd191177dcab6176d60d1203411239756044c0a06104b808dc23a6af7f4e2be1268adfb0d78faf3849d6b6ed8f7401fbfa4cee2b0997b176cd2bb28aa36f57a18a738f9e5461d74b7febe2b2bca9467e802a920bd118144ac7e53bd75a05a35a4f9db173098bdd56bee393b0d749101c2ba12e04cd2517d00c1363b4b3fefd6303d2f9171ff1726a28e419d74460c310f7a41955520a4ea781b9b1378b937f66ebbec3ff4ba3ec76ac2b024bc9898a846f7d684fc1a6fcdca5b43dab085963e7af10305ef3d20bde55080ad951535ca2a5d3be3b6b5ca2339632997f1df7c68c99376ce9919e5db01ff959de2b18ebea9d1cee16d09209427e6e54f751544f16f48100b60d6ef65dd97e8bf72baa0ed34124b2a143776c88cade954c80d9193acbf5b33c9e4fe39b68768d918f2e511a7c816bf080f53224d9eb1913ed5b468622a8797e61cbbb0b293a4107f312e4490d264e5324895b9eaec19dfc695f14af777acbf6e124660dc2e46eeec133ea46d0d55eee450900c35e2a1d77d82ea66f48d2b6a72bf3a95985c7aabdc7a9cf8a3bc13e145e99284d721fe12684cd00b18ede9e77acac548376ff76b0e55c220f825bb7c54b76a50c2351ab255a4a6e221790db909a62970db8269580a5a6f64086d833e1f4a27bcf8892b7dd3d6e6597713a383c0d00363071f6b8cc7a4d3ec2d5d7033ba0f2a2a2fd5a6b29f6864b990df88fbb941dbbd204720a512ff01f0c52229731039659ef5f3a6823bdc9746017f4e4bea94a3b99753ed61a71de5939e17e15f73ded9edafd5e45512a97cae04bf53ce613cdfa6763b6b150577afd458acc0bf4247db8bde6c711908dc784a1622e9e2b0e960031abb0c4ef0ea2d484e4482b3cfba93d42317993de2ced2510c1a086367de4314a9a15079cfbea1a90bc26fdb04edd6a768538424e1d2f4b5a0dbb6f928635e4a82954d29ddfdb4b80dc10da7f9fc0e72c78b2c6c0c688a671ad33deb14128dd63efc712826e6a6699d345a5a8c5b24293212beb497f931a0a238fff53d3770c94a3926a0c4e008f5d4b9a9f8a364ba7b7fa232e346fe9a41a8199c64edf8d795eddff9634b3711aab167638416290fa6186322d02ba93e7be2c82819b031f74aef75a13b9770a7c1a33d630400b5b8dc1dc1eadf412386ae2715e67a7959badbec4572c706a067257fd2a1c1d881d0068c5b8be02a4a691f1d68b8209532acb923c72be4d4a9c9ac", 0x1000) setsockopt$inet6_tcp_int(r1, 0x6, 0x1f, &(0x7f0000000040)=0x2, 0x4) 16:56:42 executing program 6: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0x0, 0x0}) rmdir(&(0x7f0000000140)='./file0\x00') rmdir(&(0x7f0000000040)='./file0\x00') sendmmsg(r0, &(0x7f0000008600)=[{{0x0, 0x0, &(0x7f00000000c0)}}, {{&(0x7f0000000080)=@nfc={0x27}, 0x80, &(0x7f0000007380), 0x0, &(0x7f0000000000)=[{0x18, 0x1, 0x1, "03"}], 0x18}}], 0x2, 0x0) 16:56:42 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000007cb0000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:42 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:56:42 executing program 1: rt_sigsuspend(&(0x7f0000000040)={0x3}, 0x43679bb81b506cd0) clock_nanosleep(0x7, 0x0, &(0x7f00000000c0)={0x0, 0x1c9c380}, &(0x7f00000001c0)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x4, 0x8031, 0xffffffffffffffff, 0x0) munmap(&(0x7f00005a2000/0x1000)=nil, 0x1000) shmctl$SHM_UNLOCK(0x0, 0xc) [ 284.934995] binder: 20221:20225 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 284.943731] binder: 20221:20225 unknown command 4743953 [ 284.950404] binder: 20221:20225 ioctl c0306201 20000000 returned -22 [ 284.961441] 9pnet_virtio: no channels available for device / 16:56:42 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x0, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:42 executing program 7: mlockall(0x5) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000540)=0x0) perf_event_open(&(0x7f00000018c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r0, 0x0, 0xffffffffffffffff, 0x0) munlockall() r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x800, 0x0) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer\x00', 0x2, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r1, 0x84, 0x70, &(0x7f0000000140)={0x0, @in={{0x2, 0x4e21, @remote={0xac, 0x14, 0x14, 0xbb}}}, [0x5, 0x4, 0x800, 0x1, 0x2, 0x1, 0x1ff, 0x0, 0x6, 0x1, 0x5, 0xffffffffffffffff, 0x3f, 0x8]}, &(0x7f0000000040)=0x100) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000240)={r3, 0x7fff}, &(0x7f0000000280)=0x8) ioctl$KVM_SET_TSS_ADDR(r2, 0xae47, 0xd000) r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000000)='vmnet1\b', r2}, 0x1dd) ioctl$KVM_SET_NR_MMU_PAGES(r4, 0xae44, 0x256) signalfd4(r4, &(0x7f00000002c0)={0x6de0}, 0x8, 0x80800) 16:56:42 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000600000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:42 executing program 6: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x4800}, 0xc, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="3c00000013001103000000000000000000000000", @ANYRES32=0x0, @ANYBLOB="000000000000000008000d0000000000140003007465616d5f736c6176655f3100000000c2868735eca08d90e4f438cf1dadf9ea7ba735b205bf21f034a34e975d1c7f8ca3f5cf765c4a6b524c3a4dc253bd4cb28d890310e2493feb0d4fbf4e1b94ec0d17547fe8d2a41c9f7625a93d3806f1cdf4b5c11366e194343b14969ccafb64ffbd0b270066938786bfb46bcc"], 0x3}, 0x1}, 0x20000000) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x800, 0x0) recvmmsg(r0, &(0x7f0000005400)=[{{&(0x7f00000002c0)=@llc={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x80, &(0x7f0000000840)=[{&(0x7f0000000340)=""/98, 0x62}, {&(0x7f00000003c0)=""/227, 0xe3}, {&(0x7f00000004c0)=""/172, 0xac}, {&(0x7f0000000580)=""/199, 0xc7}, {&(0x7f0000000680)=""/154, 0x9a}, {&(0x7f0000000740)=""/244, 0xf4}], 0x6, &(0x7f00000008c0)=""/163, 0xa3, 0x7fff}}, {{&(0x7f0000000980)=@vsock={0x0, 0x0, 0x0, @reserved}, 0x80, &(0x7f0000000c80)=[{&(0x7f0000000180)=""/1, 0x1}, {&(0x7f0000000a00)=""/56, 0x38}, {&(0x7f0000000a40)=""/88, 0x58}, {&(0x7f0000000ac0)=""/228, 0xe4}, {&(0x7f0000000bc0)=""/186, 0xba}], 0x5, &(0x7f0000000d00)=""/25, 0x19, 0x7}, 0x100000000}, {{&(0x7f0000000d40)=@hci={0x0, 0x0}, 0x80, &(0x7f0000001080)=[{&(0x7f0000000dc0)=""/196, 0xc4}, {&(0x7f0000000ec0)=""/4, 0x4}, {&(0x7f0000000f00)=""/152, 0x98}, {&(0x7f0000000fc0)=""/192, 0xc0}], 0x4, 0x0, 0x0, 0x4}, 0x1000}, {{&(0x7f00000010c0)=@llc, 0x80, &(0x7f0000001240)=[{&(0x7f0000001140)=""/200, 0xc8}], 0x1, &(0x7f0000001280)=""/145, 0x91, 0x7fffffff}, 0x2}, {{&(0x7f0000001340)=@can, 0x80, &(0x7f0000001600)=[{&(0x7f00000013c0)=""/141, 0x8d}, {&(0x7f0000001480)=""/124, 0x7c}, {&(0x7f0000001500)=""/193, 0xc1}], 0x3, &(0x7f0000001640)=""/71, 0x47, 0x1}, 0x8}, {{&(0x7f00000016c0)=@hci, 0x80, &(0x7f0000002a00)=[{&(0x7f0000001740)=""/4096, 0x1000}, {&(0x7f0000002740)=""/186, 0xba}, {&(0x7f0000002800)=""/166, 0xa6}, {&(0x7f00000028c0)=""/235, 0xeb}, {&(0x7f00000029c0)=""/33, 0x21}], 0x5, &(0x7f0000002a80)=""/131, 0x83, 0x10000}, 0x7}, {{&(0x7f0000002b40)=@pppol2tp, 0x80, &(0x7f0000002d40)=[{&(0x7f0000002bc0)=""/123, 0x7b}, {&(0x7f0000002c40)=""/98, 0x62}, {&(0x7f0000002cc0)=""/70, 0x46}], 0x3, &(0x7f0000002d80)=""/223, 0xdf, 0x9}, 0x2cca}, {{&(0x7f0000002e80)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003f40)=[{&(0x7f0000002f00)=""/47, 0x2f}, {&(0x7f0000002f40)=""/4096, 0x1000}], 0x2, &(0x7f0000003f80)=""/4096, 0x1000, 0x1000}, 0x4}, {{&(0x7f0000004f80)=@ethernet={0x0, @random}, 0x80, &(0x7f0000005340)=[{&(0x7f0000005000)=""/22, 0x16}, {&(0x7f0000005040)=""/164, 0xa4}, {&(0x7f0000005100)=""/111, 0x6f}, {&(0x7f0000005180)=""/36, 0x24}, {&(0x7f00000051c0)=""/213, 0xd5}, {&(0x7f00000052c0)=""/69, 0x45}], 0x6, &(0x7f00000053c0), 0x0, 0x9}, 0x3}], 0x9, 0x101, &(0x7f0000005640)={0x0, 0x989680}) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', r2}) [ 285.093746] binder: 20241:20247 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 285.102506] binder: 20241:20247 unknown command 4743953 [ 285.108265] binder: 20241:20247 ioctl c0306201 20000000 returned -22 [ 285.183793] EXT4-fs (loop2): VFS: Can't find ext4 filesystem [ 285.240153] binder: 20265:20269 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 285.248859] binder: 20265:20269 unknown command 4743953 [ 285.270134] binder: 20265:20269 ioctl c0306201 20000000 returned -22 16:56:43 executing program 4: r0 = socket(0xa, 0x3, 0x2) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000200)=ANY=[@ANYBLOB="ff0001e4fdffffff00047b343d60e5ce6f94d8414afd5ab5bfe72614975c78881a10c8d5f7978358e23c0e3ff65d7f76869428998c30bb96688b323930"]) getsockopt$netlink(r0, 0x10e, 0x3, &(0x7f0000000080)=""/177, &(0x7f0000000140)=0xb1) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x2, 0x0) openat(r1, &(0x7f00000001c0)='./file0\x00', 0x480000, 0x8) ioctl(r0, 0x8916, &(0x7f0000000000)) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$PPPIOCSMRU(r0, 0x40047452, &(0x7f0000000040)) ioctl(r0, 0x8936, &(0x7f0000000000)) 16:56:43 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[]) 16:56:43 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:43 executing program 6: r0 = socket$inet6(0xa, 0x80801, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e9, 0x8001}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) preadv(r1, &(0x7f0000000240)=[{&(0x7f0000000080)=""/214, 0xd6}, {&(0x7f0000000180)=""/146, 0x92}, {&(0x7f00000002c0)=""/89, 0x59}], 0x3, 0x0) 16:56:43 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000006c00000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 285.963115] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 285.980488] EXT4-fs (sda1): re-mounted. Opts: ,errors=continue 16:56:43 executing program 0: r0 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r1}], 0x1, 0xfffffffffffffffa) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r1, 0x2) r3 = dup3(r2, r1, 0x0) write(r1, &(0x7f0000c34fff), 0xffffff0b) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) write$cgroup_pid(r3, &(0x7f0000000000), 0x12) tkill(r0, 0x1000000000016) setsockopt$IP_VS_SO_SET_EDITDEST(r3, 0x0, 0x489, &(0x7f0000000040)={{0x11, @multicast2=0xe0000002, 0x4e24, 0x0, 'nq\x00', 0x2, 0x1, 0x38}, {@multicast2=0xe0000002, 0x4e22, 0x0, 0xf682, 0x7fffffff, 0x4}}, 0x44) 16:56:43 executing program 7: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000080)={'bridge_slave_0\x00', &(0x7f0000000200)=ANY=[@ANYBLOB="100000000000000000000000000000000000000000000000000000000000000000000000ce5a03b33ef04ead019de02c3b2e4147dbc85afbd0a2adca4966c06befcb2caaad3793bce049409e65b7f341151cf1e809ec2a71baa41f3fe0035bac76e4396df23b4d536177cd1e703805ff587e7893529d9ed34b7cf4ad266cdfce5a2da771e771d2a2c0380443eb66feec1796f0b16d4f374d137f02394b5ce8529c1a127cd32a0080b9c864085aba595c66a4a2baf06e59100ad1a06c22e992b013ae42a83d1b3edd3872288ca14cf9e1f0659a20d1dc757d17e219a9c3703967a34faa03a82e87963c2fb835ad5bb7667e18adc74f69cbfee63552255c3bb080e85b447fd4a13828fabbb7541b739ed87f3f64888f"]}) 16:56:43 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f00000018c0)=[{{0x0, 0x0, &(0x7f0000001740), 0x0, &(0x7f0000001800)=""/151, 0x97}}], 0x1, 0x0, &(0x7f0000001900)={0x77359400}) getsockopt$IP_VS_SO_GET_SERVICES(r0, 0x0, 0x482, &(0x7f0000000340)=""/127, &(0x7f00000003c0)=0x7f) sendmsg$nl_crypto(r0, &(0x7f0000000300)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB="e00000001200010300000000000000000a7263333200000000000000f9ff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x1}, 0x1}, 0x0) syz_mount_image$xfs(&(0x7f00000002c0)='xfs\x00', &(0x7f0000000400)='./file0\x00', 0xfffffffffffff000, 0x5, &(0x7f0000001bc0)=[{&(0x7f0000000440)="a4ae3abf83ed5c76eba11d72bd0bdf71386e994e19832916b67cae0773db2fa230896cb1c1e65f4f58461467d355241b12a0f73e4ce76836a198e186b520a65cfe061c28", 0x44, 0x2}, {&(0x7f0000000580)="a2b6be18d72180a3d22676e2ae734ef1a7f204c5b90c378b5d6a9c531820bbd3d753b78ee621c3f4c1f427f9c0e14e18f4b831e2779b957c97708b42bc03a8bbe678e3f0e179acbe70841ef9e4d9e753ee98d68fc453f5fa23e7", 0x5a, 0x1}, {&(0x7f0000000700)="e1b63569e14eb78e6f2cb34769dcb9ed9e2b9c859fc914b0374aa1e886c6812cdface68c3afc6e2e85c3096e03ad51a975b31ae2015961f06f28a196896ad556b6da6b0c0a3573bb0f0d7ec119163b7437d1e864613c5758a65de6146e66a65deb4a7dc2dd55ba7ab49f27d3c45eb94f1da4b064ed8861f51b5586908b679de62d883976a848e2ca5374036160ea4e4a0e12e2afd0189d215553b0746a3131d80eb5ba28422e4f5f523d10effd1ddff0ca0d727abab2b5b53a235f79b056f94472f4abe57e012935bda65d74eace4033565a3944bb339ee0700650152c54de7d646f9ec9c0", 0xe5, 0x8}, {&(0x7f0000001940)="174526549b58c15f02361208b726fa26604b65921dac4d1478d44febe3a6697c7bb866c47d4e1bd8d14009344f06b6ae14daa38d94f1073aa2bfb09eb233489a4fbf7118ed12e7372f583f8f771952449c56060481fb52ffcae234653bdd028ff02e22af4b3e9e012bf1c13d9c01759014b50a68f29dae92463b364513db39295deccf222c9a7e8f8c36d0a9797418a9e12407f39fa4fc7aa7d1a64fbaf23bb9c85445f468a26ecbeeba39c03e69823f02e9c5fe02cfa886750108ae8d8d2f753cf84ed768e721c03e299d61d8547533b4ca65c29e31de521d2cfb46c8118fe94dddbd5dfefbbb17ef4f46ac1b6ad5762b94fc92bf4a8fec9b10f5d35056", 0xfe, 0x1}, {&(0x7f0000001b40)="e62082fbceac037f93c5fa5a494772fd738bfd40635e35cd2466c1d2a81afd8107d24d3fa15351bf4c8628a370ca1af7ce4d5196022ab0ef3e2b595f81eba62f75d49d79ab8237984423db061fc5fb0b741858", 0x53, 0x4686}], 0x2, &(0x7f0000001cc0)={[{@nodiscard='nodiscard', 0x2c}]}) syz_genetlink_get_family_id$team(&(0x7f00000004c0)='team\x00') ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f0000000080)) 16:56:43 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[]) 16:56:43 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:43 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, &(0x7f0000000380)="0ca43ef30fbd57b80f23c20f1366d26565df9d0500000066ba2000edc4e1d1fc37b8010000000f01d90fc75b05c744240098d30000c74424025f5539d6c7442406000000000f011424", 0x49}], 0x1, 0x24, &(0x7f00000002c0), 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, &(0x7f00000001c0)="640f602cd8a0020066b9800000c00f326635004000000f30dfdd65640f22930f01d1baf80c66b878ea428966efbafc0cb83e38ef262e642626360f2193cad3126766c7442400110900006766c74424021001c0fe6766c744240600000000670f011c24", 0x63}], 0x1, 0x0, &(0x7f00000002c0), 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xb1, 0x401) sendmsg$nl_route(r4, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=@getnetconf={0x14, 0x52, 0x200, 0x70bd26, 0x25dfdbfe, {}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x40800) ioctl$KVM_RUN(r3, 0xae80, 0x0) 16:56:43 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000ce0700000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 286.130173] binder: 20287:20291 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1811939328 [ 286.139252] binder: 20287:20291 unknown command 4743953 [ 286.144869] binder: 20287:20291 ioctl c0306201 20000000 returned -22 16:56:43 executing program 6: perf_event_open(&(0x7f0000000200)={0x5, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x400000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)=']securityvmnet0\x00', 0xffffffffffffff9c}, 0x10) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f0000000080)={0x3, 0x1, 0x3, 0x3, 0x9}) mprotect(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000000) 16:56:43 executing program 7: r0 = accept4(0xffffffffffffff9c, &(0x7f0000000040)=@hci, &(0x7f00000000c0)=0x80, 0x800) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000100)={0x0, 0xe9e}, &(0x7f0000000140)=0x8) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x2, 0x41) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/dsp\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(r2, 0x4008af21, &(0x7f0000000300)={0x0, r3}) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000200)={0x3, 0x200, 0x7, 0xe, r1}, &(0x7f0000000280)=0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x8003, &(0x7f0000000000)=0x22, 0x3, 0x0) 16:56:43 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[]) [ 286.235054] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 286.250906] EXT4-fs (sda1): re-mounted. Opts: ,errors=continue 16:56:43 executing program 7: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) setsockopt$sock_timeval(r1, 0x1, 0x14, &(0x7f00000001c0)={0x77359400}, 0x10) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000080)=0x0) waitid(0x3, r2, &(0x7f00000000c0), 0x6, &(0x7f0000000100)) io_setup(0x1, &(0x7f0000479000)=0x0) r4 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000200)='/dev/rfkill\x00', 0x4000, 0x0) setsockopt$inet_MCAST_MSFILTER(r4, 0x0, 0x30, &(0x7f0000000240)={0x4d, {{0x2, 0x4e21, @broadcast=0xffffffff}}, 0x0, 0xa, [{{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x1e}}}, {{0x2, 0x4e23, @loopback=0x7f000001}}, {{0x2, 0x4e20, @local={0xac, 0x14, 0x14, 0xaa}}}, {{0x2, 0x4e22, @rand_addr=0x88}}, {{0x2, 0x4e20, @multicast2=0xe0000002}}, {{0x2, 0x4e21, @multicast1=0xe0000001}}, {{0x2, 0x4e24, @local={0xac, 0x14, 0x14, 0xaa}}}, {{0x2, 0x4e23}}, {{0x2, 0x4e21}}, {{0x2, 0x4e22, @rand_addr=0x7}}]}, 0x590) setsockopt$bt_l2cap_L2CAP_CONNINFO(r4, 0x6, 0x2, &(0x7f0000000800)={0x1, 0x7fff, 0x2bf, 0x9}, 0x6) io_submit(r3, 0x1, &(0x7f0000738000)=[&(0x7f0000f73fc0)={0x0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f000079a000)="16", 0x1}]) 16:56:43 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:43 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c40000000000000000007ce00000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 286.372593] binder: 20324:20330 BC_REQUEST_DEATH_NOTIFICATION invalid ref 130940928 [ 286.386278] binder: 20324:20330 unknown command 4743953 [ 286.393105] binder: 20324:20330 ioctl c0306201 20000000 returned -22 16:56:43 executing program 6: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) write$P9_RUNLINKAT(r1, &(0x7f0000000180)={0x7, 0x4d, 0x1}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000340)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RREADDIR(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="2a000000290100000000000000000000000000000000000000000000000000000007002e2f66696c6530dc0e1fee1ea2474d61807f5fc27630954b715815909d6b7816a0b7f0a6b344d68986f832e9f8fa9336bd38afd94bbee8824d55cce9bdd562c5266c24b154739db1b198500aaa689c875cb1ca5a7832a6d9e32fd67cfd4dca057117b3983e8fb3088ecf25c78bd6a6a23a45319158a3b893e1de2df616311db78d5f57f2eca6f41b92eca9b0d89b6254638a032b924cd9259f4426e48832c28119920a78d901fbea9b4367f40f5af18dd5ea805b4841cc5cba963b629fedfde4ce681d17052fa4c4089e97735072d60cf385e8a93b69e5a2109e5741e342649f62af3c90f7f1abc242e9e51f81c7c64e873b33b26dbb2dcb71147df4aa0d847efb4a8e73"], 0x2a) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000900)='9p\x00', 0x0, &(0x7f0000000840)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) statfs(&(0x7f0000000080)='./file0\x00', &(0x7f00000002c0)=""/16) [ 286.499789] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 286.518907] EXT4-fs (sda1): re-mounted. Opts: ,errors=continue 16:56:43 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB]) 16:56:43 executing program 4: r0 = socket$netlink(0x10, 0x3, 0xc) writev(r0, &(0x7f0000fb5ff0), 0x0) fcntl$setflags(r0, 0x2, 0x1) r1 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0xa0, 0x400000) rt_sigtimedwait(&(0x7f00000000c0)={0x5}, &(0x7f0000000100), &(0x7f0000000140), 0x8) syz_read_part_table(0x8, 0x2, &(0x7f0000000300)=[{&(0x7f0000000180)="11a1ec0cd62a9e36d942b4f919480b5794ab23c2dcb07d33832f2a2838ad695e4cd474f41bb610e92d0809a1290645c83579a1c87b7d362b54bef04195a0609937e3c14f23b91a96b3deaadb081aef444932113d1e1fa9e89c6207478f6aba855ef4e0b0e501457f", 0x68, 0x7}, {&(0x7f0000000200)="502059dc944b56727f1dfb9a9944965d4b9612c7b1dc463b7837a07d312171b2dc1267ebbbc75995f6e968cfb99ae433f29ac1acacb47de8bf66c97a9485257e524f89529fbf7d4aaa66b704369f50d84a22be7774e9ac3c10ac667db16e0e28fa70e1c467a23908336129b1dd7cf934dac1a8022d9827c77958ec15f882b2565008bdc2a89b06fed92342b20758d09344f84a236e333ab0a922ad8b44781cd207ba5351e6b6b469ed4f32486d6a9876ac87750a40524d59a55e77c5ad256625329686ba605d96af4634d3788cff2aeb1567d6c1d8533152b65aa689fb5127630ff471792ebfa9d87802bcc87506549134000c1f2a", 0xf5}]) setsockopt$IP_VS_SO_SET_EDITDEST(r1, 0x0, 0x489, &(0x7f0000000040)={{0x2c, @dev={0xac, 0x14, 0x14, 0x1b}, 0x4e24, 0x3, 'lblc\x00', 0x10, 0x10100000000, 0x15}, {@multicast2=0xe0000002, 0x4e20, 0x10002, 0x1, 0x0, 0x2}}, 0x44) [ 286.629292] binder: 20351:20356 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 286.637986] binder: 20351:20356 unknown command 4743953 [ 286.643701] binder: 20351:20356 ioctl c0306201 20000000 returned -22 [ 286.655281] binder: 20351:20356 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 286.663984] binder: 20351:20356 unknown command 4743953 [ 286.669402] binder: 20351:20356 ioctl c0306201 20000000 returned -22 [ 286.804335] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing 16:56:44 executing program 0: socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendto(r0, &(0x7f0000000080)='$Z', 0x2, 0x404c080, &(0x7f0000000200)=@un=@abs, 0x80) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'lo\x00@\x00'}) r2 = syz_open_dev$dmmidi(&(0x7f0000000140)='/dev/dmmidi#\x00', 0x3, 0x40000) getsockopt$inet6_dccp_buf(r2, 0x21, 0x0, &(0x7f0000000300)=""/46, &(0x7f0000000340)=0x2e) sendto(r0, &(0x7f00000000c0)='fc', 0x2, 0x0, &(0x7f0000000180)=@nl=@unspec, 0x80) r3 = msgget(0x1, 0x440) msgctl$IPC_INFO(r3, 0x3, &(0x7f0000000000)=""/45) 16:56:44 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x0, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:44 executing program 7: r0 = socket$key(0xf, 0x3, 0x2) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000740)=ANY=[@ANYRES32=0x0, @ANYBLOB="e6f307000000085005000700040003000400"], &(0x7f0000000780)=0x16) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f00000007c0)={0x80, 0x100, 0x200, 0x100000000, 0x0, 0x8, 0x7ddd3fb5, 0x10000, 0x0}, &(0x7f0000000800)=0x20) sendmmsg$inet_sctp(r1, &(0x7f00000010c0)=[{&(0x7f0000000140)=@in={0x2, 0x4e22, @multicast1=0xe0000001}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000180)="545b6fadd56e578de0edf60ab150e27ee2cf93c0ff8996c6b84a1e0e693e2e20b1a36beefcbeb6cd541ab501d2cd617d54c50b09ebd0efc20dd82684dda5b9", 0x3f}, {&(0x7f00000001c0)="0622e3121cf9495cee8670aae1ac15dcd6782f79f9c5f39c154998391d46c114c3d4aaabff82f18819690d09195f6a0d9ec0bc6a9240a8132dab901adab8e22d9c088ee8fc690e63c2060306e57adf413198051f681296c31733d13f5f811b2e3c14319e6cc5f3ec8d2010a3f9a6d1b0124f5f3a97a72f25eb786609183f8a6bb844d754631919013dfe70db93ca1d4f2c60295f05883f6e5dba93997d3711eb194d5776d8fa8e", 0xa7}, {&(0x7f0000000280)="85793bca906acc9b0bc37eba47b6d29909fa9064e051fae6f8f4344b388b30520bc7f43a6bd62823a6fb1c198ee888f59671c24144517f7a5322323b9eaf0ea0c6e52da9a72b25cecf035d08b1a24979e381b711baefc339c61e760f66866c34ac7712c95c76c0095f9c8d799107710d712fe14252a906dc9dfe81554b112694e99715ed7fb2e0ee4090272df7b354edd125f1b34324f65cc02ca2d2fd6c82ddb1f3e39bdf04", 0xa6}, {&(0x7f0000000340)="55147d61b9eb72eadb379c6c80a81b556bb492a0dd9c3f0f576f279bd8241dfc72969baddb359a895ed2ccbf5c40e93ef44b63b3f29f2c5b4feb9fd39814428fd5425a2d73b6c3c99364025f907ce2b313a1413a114a57ccfe41967446ea979d1f58edfc30d8900491b2760f440957f264dac1b79ceaec2498c2d18dea158378e3079ccf1f2e6bf810a827b1fd9ee60bc3933555a6143beefb0a19247e71543df221", 0xa2}, {&(0x7f0000000400)="de69bc989e5e9d33f3fd529ca69fb90df4a7e971149087db41e3ca5d7f3efd03a3362314b3fe793409b1d12fb7340ae50671f46718237fc4c13579999d9c87171b045b", 0x43}, {&(0x7f0000000480)="53d5430e31564cdd3d4fddfb4ccd0aefa3f2533097e90266abfc91940b45a8618e989cbf870a3885683177ab16d9f95a861949825c7e9385e5ad579479b189a7918d6d5cece8f1a71d961d9e644f039668ec2b2a69deaafa5fdda35b06cdd7ec6ac658b6c6b14a1ebe3fc33bd778c9cd994a7c3fd2ae7bb8330a54d1d4628b9e3da0178f7526abcfbec5b2f01d65b11435ab1ce1f41ba6519f7268e7c2d6658ba2db11", 0xa3}, {&(0x7f0000000540)="cdc750376ab5e9206c6968ec3bf2cf4cca47352399bd951471f582948750366a8aa29468f9edd227104212d9282e9dbf995e5f255900c3c741f26ba4f4682d3ccac252b48a368ed3882fdca838e40b31d4772bd34d", 0x55}, {&(0x7f00000005c0)="8f678ad9da64c41640afccbbd0d726c72aa5222ad0fc7d6f3400254f3b46018044c6b08ca6b4ad42f4d1b020dcba63180040f11f7457f5127f9069d413e1c27e1c234a283cc86cf388381b91073af968bb0e9b20bd7e0c203cdb2982cf4b8ed1f3522028881b2f5020c69fd79c31db10dee37fcbcf05a55ccb68075f9c1ff9aeaec153016a06ca245a271a2f4ad4e7f010e3b9fbc6d8783cad7299426b6ba0e78ba7c484e0f4075dca3310f1b4536508131e25512a7674255ae5a30aaa64de6caceaffce6b4ccc6fb100dee8765d", 0xce}], 0x8, &(0x7f0000000840)=[@init={0x18, 0x84, 0x0, {0x400, 0x7, 0x5, 0x75e0}}, @init={0x18, 0x84, 0x0, {0x74, 0x0, 0x4, 0x2}}, @prinfo={0x18, 0x84, 0x5, {0x0, 0x97b3}}, @sndrcv={0x30, 0x84, 0x1, {0xb6bc, 0x9, 0x2, 0x7fffffff, 0x20, 0x401, 0x1e, 0x1ff, r2}}, @dstaddrv6={0x20, 0x84, 0x8, @loopback={0x0, 0x1}}, @sndinfo={0x20, 0x84, 0x2, {0x3, 0x9, 0xfffffffffffffffa, 0x2, r3}}], 0xfffffc9d, 0x4000}, {&(0x7f0000000900)=@in6={0xa, 0x4e21, 0x7, @dev={0xfe, 0x80, [], 0x14}, 0x6}, 0x1c, &(0x7f0000000a40)=[{&(0x7f0000000940)="e476b79918e78c9e1d2cb911f3cb2e7f6a787fadd73099436279d768c03456482b1540d8a0a5ca61539b029dab89c4b8c215777c904f4a344b7805e534a46dcad164348513f729834d3872bba41ebf081efffff71d43344dbf0d130ae79be6dea0c6d41da8f6a2ae14212fcc1e090b02ea5b217e357baf335bcfa40578546f31226bf29c297db4927b5bda1beb76c7779bfe5e16d26c17ca5138dda68f3fe681a3e62a82ea7371c03e9cd7f4add32d8ba14f89e879", 0xb5}, {&(0x7f0000000a00)="4098ea4209053746c72747a7b965597e44bdd0d702505292e733d2d058a2", 0x1e}], 0x2, &(0x7f0000000a80)=[@sndrcv={0x30, 0x84, 0x1, {0x9, 0x80000001, 0x208, 0x2, 0x9, 0xfffffffffffffffc, 0x6, 0x4, r2}}, @sndinfo={0x20, 0x84, 0x2, {0x5, 0x8004, 0x6, 0x8, r3}}, @sndinfo={0x20, 0x84, 0x2, {0x0, 0x8001, 0x7, 0x7, r3}}, @sndrcv={0x30, 0x84, 0x1, {0x4, 0x9, 0x2, 0x7, 0x100000001, 0x6, 0xffffffffffffff00, 0x1, r2}}, @sndinfo={0x20, 0x84, 0x2, {0x6, 0x0, 0x8000, 0x4, r3}}], 0xc0, 0x80}, {&(0x7f0000000b40)=@in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x10}}, 0x10, &(0x7f0000000e40)=[{&(0x7f0000001200)="50a914f4bceec5105fb014f960e80999938922b869fdbb42f6f75f00a6cf13663b45df23d0f4fe935115b4a18248f3268bb946cf6a43e767f286daef3390e561e03ce77c96417b909d6a705a2a93ead960e963d182dc1b374062", 0x5a}, {&(0x7f0000000c00)}, {&(0x7f0000000c40)="056eb6fb3885056c704079592b281232357699d390d5cf24212bb04a56d3cbfaf9b5f4954942f8f9981cd3a19467976164251ff86892be1594621b455ae946fc914e94b24c53a5f6921292d52809afd5733739a54f3c5ed9ee6ffc7abbb592e6cfb195cbdd6654702d1b0a2eeb193e09c2d45d0f9f7c68c2e1777d251f3e4c4a1c4fcd1eeac8f58f6b6a4a875e7f84083c3d14b447ce9124693b0d489a2fe17a2cd2c9cac65a8c5e4a1b5a03d177823363b006d96dcdb6d16541a0aefa4844d8edefce38f6ec8acd324156ed21e24edf41ce0b5a04e841d0f4f5b0954901618f5bfe0e27a0247031180510e928890355c0b180e9", 0xf4}, {&(0x7f0000000d40)="67f163f9c5191aa3b5fa38ef52b45895f4edceb860be17587bbdce21592cc2af2003ca8612e570f67a4b10db06d9ba1179b64ea41624bb161268d2ed62c7c2d5e3488380969cbfd50082a46d2b573f2fb905bc4ec874c39fa616d4939fe645338778c7ebb4187b39686e55287111b073ac9b93383892ce2df5e108b8b4fd25d9beac28f363ab8c2a5019558c7608782dccbe79bb0d3a0417e12b4fbcd1113b383f2e078d0a2d934545bc644023ef708731b699b0c15db5e1e4dc366fa52ae7a8497cf86ce80206660ce7c01aa1176c45a59e370734a4239f62325b9d39e1490fa15b00d2143654fc667a", 0xea}], 0x4, &(0x7f0000000e80)=[@sndinfo={0x20, 0x84, 0x2, {0x8, 0x2, 0x0, 0x100, r2}}, @sndinfo={0x20, 0x84, 0x2, {0x7f, 0x4, 0x200, 0xfffffffffffffffa, r3}}, @sndrcv={0x30, 0x84, 0x1, {0x917, 0x6, 0x8000, 0x39, 0x80000001, 0x5, 0xfff, 0xe8aa, r3}}], 0x70, 0x40800}, {&(0x7f0000000f00)=@in6={0xa, 0x4e24, 0xf08, @mcast2={0xff, 0x2, [], 0x1}, 0x401}, 0x1c, &(0x7f0000000fc0)=[{&(0x7f0000000f40)="2593ac848a8ed76c4aa0f7b84044e0418e6c9de5effc01e77f97cec744828f659a28ef96fc4dfd3f1ed356c9fb95f713238cb53f7584de9a37426021940168234a147279e36f1d65e02ed24199623236431ab9f39ee6732bce602025952a7c1247c7b48dcb3a82913b197697039bd41c4570cebc1d", 0x75}], 0x1, 0x0, 0x0, 0x1}, {&(0x7f0000001000)=@in={0x2, 0x4e21, @rand_addr=0xff}, 0x10, &(0x7f0000001080)=[{&(0x7f0000001040)="c54a5972b5d804a3b815df2f", 0xc}], 0x1, 0x0, 0x0, 0x20000020000000}], 0x5, 0x4880) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000000)={0xffffffffffffffff}, 0x0, 0x7}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r1, &(0x7f0000000100)={0xf, 0x8, 0xfa00, {r4, 0xa}}, 0x10) flistxattr(r0, &(0x7f0000000b80)=""/97, 0x61) 16:56:44 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000000000007400000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:44 executing program 6: r0 = syz_open_dev$sg(&(0x7f0000001000)='/dev/sg#\x00', 0x0, 0x0) mmap(&(0x7f000000a000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x0) madvise(&(0x7f000000d000/0x1000)=nil, 0x1000, 0xb) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000000)) 16:56:44 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000340)="ad56b6c5820faeb995298992ea54c7beef9f5d56534c90c2", 0x18) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$can_raw(r1, &(0x7f0000477000)={&(0x7f0000000080)={0x1d}, 0x10, &(0x7f0000000240)={&(0x7f00000001c0)=@canfd={{}, 0x0, 0x0, 0x0, 0x0, "b5a419fb5df128c83ad9430362a22a5abf1e4123efccc641602c2da3630b58d04766c58b254ff2a965ccb226c8c7355c33306c99adaa0aa59006f8dc9b01b737"}, 0xff89}, 0x1}, 0x0) readv(r1, &(0x7f0000001700)=[{&(0x7f0000000540)=""/4096, 0x1003}], 0x1) 16:56:44 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB]) 16:56:44 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x400}]}, 0x10) setsockopt$inet6_tcp_int(r1, 0x6, 0x2, &(0x7f0000000340)=0x1ff, 0x4) r2 = shmget$private(0x0, 0x4000, 0x400, &(0x7f0000ffa000/0x4000)=nil) shmat(r2, &(0x7f0000ffd000/0x3000)=nil, 0x1000) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffff9c, 0x84, 0xf, &(0x7f0000000140)={0x0, @in6={{0xa, 0x4e21, 0x6, @local={0xfe, 0x80, [], 0xaa}, 0x800}}, 0x4, 0x3ff, 0x6, 0x470, 0x2803}, &(0x7f0000000200)=0x98) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000240)={r3, 0x10001, 0x7, 0x0, 0x10001, 0xff}, &(0x7f00000002c0)=0x14) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) setsockopt$inet6_tcp_TLS_RX(r0, 0x6, 0x2, &(0x7f0000000040)={0x303, 0x33}, 0x4) listen(r1, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r4, &(0x7f0000000280), 0xfffffffffffffedd, 0x2000012c, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty={[0xe00000000000000]}}, 0x1c) getsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000300), &(0x7f0000000380)=0x4) close(r1) [ 287.292296] binder: 20392:20405 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 287.301124] binder: 20392:20405 unknown command 4743953 16:56:44 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x0, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:44 executing program 4: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x2000, 0x0) ioctl$TIOCLINUX4(r0, 0x541c, &(0x7f0000000040)=0x4) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) fcntl$setlease(r0, 0x400, 0x1) write$RDMA_USER_CM_CMD_GET_EVENT(r1, &(0x7f0000000080)={0xc, 0x8, 0xfa02, {&(0x7f0000000280)}}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0xfffffffffffffffe, &(0x7f0000000240)={0xffffffffffffffff}, 0x13f}}, 0x20) r3 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r3, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f00000001c0)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, {0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, r2}}, 0x48) 16:56:44 executing program 7: r0 = getpgrp(0xffffffffffffffff) r1 = syz_open_procfs(r0, &(0x7f0000000000)='net/ptype\x00') r2 = syz_open_dev$loop(&(0x7f0000000340)='/dev/loop#\x00', 0x0, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/tcp\x00') ioctl$LOOP_CHANGE_FD(r2, 0x4c00, r3) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f0000000040), &(0x7f00000000c0)=0x4) ioctl$LOOP_CHANGE_FD(r1, 0x4c09, 0xffffffffffffffff) 16:56:44 executing program 6: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'lo\x00', 0x0}) getsockopt$IP_VS_SO_GET_SERVICES(r0, 0x0, 0x482, &(0x7f0000000000)=""/71, &(0x7f0000000100)=0x47) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280)='/dev/sequencer\x00', 0x402840, 0x0) ioctl$sock_inet_tcp_SIOCOUTQNSD(r2, 0x894b, &(0x7f00000007c0)) write$FUSE_NOTIFY_STORE(r2, &(0x7f00000008c0)=ANY=[@ANYBLOB="2b0000000400000000000000000000000500000000000000070000000000000003000000000000000000008ee1ca2b03a5e4b6bae63019a298834b1ab5050b843f7c75137bf9d6b8d64412cf956545b9290eaae6348e4bce4b5a0143771948d9b61020bfed133b87b261769b99e0e055"], 0x2b) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r2, 0x40505331, &(0x7f0000000840)={{0x9, 0x4}, {0x400}, 0xff, 0x0, 0xa70}) sendmsg$nl_route(r0, &(0x7f0000000300)={&(0x7f0000000080)={0x10}, 0xc, &(0x7f00000002c0)={&(0x7f0000000940)=ANY=[@ANYBLOB="400000001400110100000000000000000a000000", @ANYRES32=r1, @ANYBLOB="1400060000000000e40600000000000000000000140001000000000000000000000000000000000155944370aeed6f41bec07f375116e6967b9a12bcf818e95ad77e9d1ac00682ebf28c0b0c45191fb6add3c82c716b8c09aca7cf7edbaba66013e3636c3f84292c7dc5910f4b9bab23f5ce66e715ecfe"], 0x40}, 0x1}, 0x0) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') sendmsg$TEAM_CMD_OPTIONS_GET(r0, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1240}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)={0x458, r3, 0x101, 0x70bd2a, 0x25dfdbfe, {0x2}, [{{0x8, 0x1, r1}, {0xa0, 0x2, [{0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8, 0x3, 0xb}, {0x8, 0x4, 0x2}}, {0x8, 0x7}}}, {0x5c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8, 0x3, 0xb}, {0x2c, 0x4, [{0x800, 0x8001, 0x0, 0x6}, {0x1, 0x7ff, 0x1000, 0x100000001}, {0x6, 0x7ff, 0x4, 0x2}, {0x80, 0x10000, 0x0, 0x49}, {0x1, 0x4, 0x4, 0x1}]}}}]}}, {{0x8, 0x1, r1}, {0x248, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x3}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x3}}, {0x8, 0x6, r1}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x3}}}, {0x34, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8, 0x3, 0xb}, {0x4, 0x4}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8, 0x3, 0xb}, {0x8, 0x4, 0x1f}}, {0x8, 0x6, r1}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x1ff}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8, 0x3, 0xb}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r1}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x75c8dd88}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0xa00000000000000}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x800}}}]}}, {{0x8, 0x1, r1}, {0x144, 0x2, [{0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8, 0x3, 0xb}, {0x8, 0x4, 0x3ff}}, {0x8, 0x7}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6, r1}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8, 0x3, 0x5}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8, 0x3, 0xb}, {0x8, 0x4, 0xfffffffffffffff8}}, {0x8, 0x6, r1}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x401}}}]}}]}, 0x458}, 0x1}, 0x8000) [ 287.330783] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 287.337592] binder: 20392:20405 ioctl c0306201 20000000 returned -22 [ 287.354677] EXT4-fs: 1 callbacks suppressed [ 287.354688] EXT4-fs (sda1): re-mounted. Opts: ,errors=continue 16:56:44 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB]) 16:56:44 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000200000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:44 executing program 0: r0 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000000)={r0}) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000000c0)={{{@in6=@loopback, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@multicast2}}, &(0x7f00000001c0)=0xe8) sendmsg$nl_xfrm(r1, &(0x7f0000000440)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x408000}, 0xc, &(0x7f0000000400)={&(0x7f0000000200)=@polexpire={0x1dc, 0x1b, 0xc, 0x70bd2b, 0x25dfdbff, {{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@dev={0xac, 0x14, 0x14, 0xb}, 0x4e24, 0x330, 0x4e22, 0x1, 0xa, 0x0, 0x20, 0x3a, 0x0, r2}, {0x6, 0x3, 0x4, 0x5, 0x4, 0x9, 0x1ff, 0xe45c}, {0x0, 0x7, 0x3}, 0x8, 0x6e6bb6, 0x1, 0x1, 0x0, 0x2}, 0x5}, [@replay_val={0x10, 0xa, {0x70bd25, 0x70bd26, 0x8001}}, @algo_aead={0x10c, 0x12, {{'authenc(tgr160-generic,xts-aes-aesni)\x00'}, 0x5e8, 0x0, "eec3ca83511e680a89f033e6b67c9f44bc4f0b9f611a5d095eaeb6aff85fad2a4d8b2afb546f25fb7ce3cc8d6d4cdab2c7c17c05d248fd5d40d38b9fdd12bcfce7148f90b9430322e7d928e1c54878d9e91ef57ec9ae289f9aeaabfe915efc63ec42049338b455ee35eb145e920ec49e69ca62f0a8e50e9914c2164c644e0cddb9bb9507f13ef17ae60ffe6fe442e3b338273d4b3af5708cc4f0563730f8f7cd43204654feac76f13225f73b2ba502f77390fe288d10fc0e57e2ab19b6"}}]}, 0x1dc}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) listen(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0xa, &(0x7f0000000080), 0x4) [ 287.386953] binder: 20392:20405 Acquire 1 refcount change on invalid ref 0 ret -22 [ 287.417583] device lo left promiscuous mode 16:56:44 executing program 6: r0 = syz_open_dev$audion(&(0x7f0000000280)='/dev/audio#\x00', 0x10001, 0x2e80) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000002c0)={0x0}, &(0x7f0000000300)=0xffffffffffffff1c) write$cgroup_pid(r0, &(0x7f0000000340)=r1, 0x12) r2 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0xe, 0x80000) setsockopt$bt_l2cap_L2CAP_CONNINFO(r2, 0x6, 0x2, &(0x7f0000000240)={0x2c16305, 0x1ff, 0x81, 0x29}, 0x6) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x10000, 0x0) ioctl$EVIOCGKEYCODE_V2(r3, 0x80284504, &(0x7f00000000c0)=""/162) r4 = add_key(&(0x7f0000000080)='ceph\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000000000), 0x0, 0xffffffffffffffff) ioctl$IOC_PR_CLEAR(r3, 0x401070cd, &(0x7f0000000180)={0xfffffffffffffff9}) mlock(&(0x7f0000ffa000/0x3000)=nil, 0x3000) keyctl$revoke(0x3, r4) 16:56:44 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x0, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:44 executing program 7: ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280)="cdb01cdb2cc9cb16762070") r0 = socket$inet(0x10, 0x3, 0x0) read(r0, &(0x7f00000002c0)=""/233, 0xe9) read(r0, &(0x7f0000000100)=""/94, 0x5e) r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x7c) r2 = geteuid() read(r0, &(0x7f0000000000)=""/240, 0xf0) r3 = syz_open_dev$usbmon(&(0x7f00000001c0)='/dev/usbmon#\x00', 0x69a, 0x200000) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000640)=0x0) getgroups(0x3, &(0x7f0000000680)=[0xee01, 0x0, 0xee01]) ioctl$RTC_AIE_ON(r3, 0x7001) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000880)=0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f00000008c0)={0x0, @in={{0x2, 0x4e22, @rand_addr=0x3e}}, 0x4, 0x3}, &(0x7f00000006c0)=0x90) setsockopt$inet_sctp6_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000980)=@assoc_value={r7, 0xffffffffffff7fff}, 0x8) getgroups(0x1, &(0x7f0000000700)=[0x0]) sendmsg$unix(r3, &(0x7f0000000840)={&(0x7f0000000200)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f00000005c0)=[{&(0x7f00000003c0)="543cfeaee909c507ca60e80518", 0xd}, {&(0x7f0000000400)="51ed59f6bdf5b1de6c9eb16fe165af97e6d86af4585e27f9a90828cf6c41c8605c4fe7416afbae27ff6c5fc65a3225a26e6093814224f0316ac49a393b533af75cea6da69acf78ecb7fb9569e4db044fb75bc96feccc710a72b0d1fbf3448ba2dec49142e6b8498144a982b36768ce560d08330e44a14793448589af16e8434c7f0252909706bd06cd08879e94448ae51df3616aa60ce4c43020b51a8cdba14b209fce42e472534412642ef47904df7a770cd64c", 0xb4}, {&(0x7f00000004c0)='xM', 0x2}, {&(0x7f0000000500)="6c786c53212671b7cedfa03d5d79860e7e066c341606e42cace5851a93ada716294d190e3772dc68c253289cce7c2d4e6fccad0644", 0x35}, {&(0x7f0000000540)="e9833e78c1668e4035fe013479f9f685192979fb5f777eea9b76e47293f036fff1e5113601d6f36dd93c965ede6696177ea63138dbed8d93d1f7bfccba3f087e30a6b03dfff3c14a8b219f3bdf11c0d9b1c1b416438c147b7e37141caa70a0d88bbdae3ffd02ae30d1b4", 0x6a}], 0x5, &(0x7f0000000740)=[@rights={0x20, 0x1, 0x1, [r1, r0, r0]}, @rights={0x20, 0x1, 0x1, [r0, r1, r1]}, @cred={0x20, 0x1, 0x2, r4, r2, r5}, @rights={0x30, 0x1, 0x1, [r0, r1, r0, r1, r1, r0, r1]}, @cred={0x20, 0x1, 0x2, r6, r2, r8}, @rights={0x30, 0x1, 0x1, [r0, r1, r0, r0, r0, r1, r0]}], 0xe0, 0x800}, 0x4040) [ 287.546918] binder: 20425:20436 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 287.555612] binder: 20425:20436 unknown command 4743953 [ 287.561546] binder: 20425:20436 ioctl c0306201 20000000 returned -22 16:56:44 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000004c00000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:44 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB='usrjqu']) 16:56:44 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23}, 0x1c) listen(r1, 0xffefffffffffff7f) getsockopt$inet6_int(r0, 0x29, 0x4d, &(0x7f0000000040), &(0x7f0000000080)=0x4) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = syz_open_dev$vcsn(&(0x7f00000000c0)='/dev/vcs#\x00', 0xc17, 0x101200) fstat(r0, &(0x7f00000002c0)) ioctl$sock_bt_hidp_HIDPCONNADD(r3, 0x400448c8, &(0x7f0000000100)={r1, r1, 0xffffffffffffffff, 0x401, &(0x7f00000001c0)="a79d9564292cdb240865102a04713adae075d3256e87e9487cb145831ad5cb1c8c89dc2067963e9e7de3d43bb75d299e594ae6b5845404ae4c6141d1f580e9f5867fde47cd5f6c0f3c06145703bc0ae46604e708283b21766bc76d37bf7f8772f2ff71498098919c26888d343ec41a8c2208f79344be4e0ab1984a1c7c1a0d493e8422205f7bbb1ad5aeeed8f4d6cc56401d01bd3ff6571758c321ab3fa3a9617dc6c172ee7a7cdd74ec22b15c94d94f", 0x9, 0x8, 0x2, 0x10000, 0x8, 0x80000001, 0xffff, "a51596da57d138ff2a3407266e486fbc498caee6788c"}) sendto$inet6(r2, &(0x7f0000e33fe0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r2, 0x84, 0x10, &(0x7f0000000180)=@sack_info={0x0, 0x20}, 0xc) [ 287.596791] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 287.612784] EXT4-fs (sda1): re-mounted. Opts: ,errors=continue 16:56:44 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x0, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:44 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000140)='/dev/snd/midiC#D#\x00', 0x7f, 0x2) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x400000, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000100)=0x1) ppoll(&(0x7f0000000040)=[{r0, 0x80}, {r0, 0x4000}, {r1, 0x1000}, {r1}, {r0, 0x80}, {r1, 0x200}, {r1, 0x1200}, {r1, 0x2}], 0x8, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x8) [ 287.742583] binder: 20459:20461 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1275068416 [ 287.750730] binder: 20459:20461 unknown command 4743953 [ 287.756918] binder: 20459:20461 ioctl c0306201 20000000 returned -22 [ 287.770749] binder: 20459:20461 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1275068416 [ 287.779685] binder: 20459:20461 unknown command 4743953 [ 287.785441] binder: 20459:20461 ioctl c0306201 20000000 returned -22 [ 287.835397] EXT4-fs (sda1): Unrecognized mount option "usrjqu" or missing value 16:56:45 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='bbr\x00', 0x15a) getsockopt$inet_tcp_buf(r0, 0x6, 0x1a, &(0x7f0000001200)=""/145, &(0x7f0000000100)=0x91) setsockopt$inet_buf(r0, 0x0, 0x35, &(0x7f0000000040)="94d8acb6f133cdac9dc1be7b1e00575b29055f70849ca7b05e353f5e3ed40693f0d8d1a3e431ae3d2420403b67de5b510cb007806d2d25741e9b905f0242f68bb69d31f3a87fa66b6b5ce524ff339082d2390f32c53c33a89bad37008fe4219fff5aaecb8798d1a372b3556d47fc8c577daa678108cb348a8cf3f45025b51ee34e165d30141b28b3bd2fb221e28ddd152c53b225f3608db24c36be5bbe9985b29a55668251d34e2740d970e9bf2b", 0xae) dup(r0) 16:56:45 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000740d02000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 288.247013] binder: 20483:20484 BC_REQUEST_DEATH_NOTIFICATION invalid ref 225705984 [ 288.255360] binder: 20483:20484 unknown command 4743953 [ 288.261559] binder: 20483:20484 ioctl c0306201 20000000 returned -22 [ 288.271549] binder: 20483:20484 BC_REQUEST_DEATH_NOTIFICATION invalid ref 225705984 [ 288.279856] binder: 20483:20484 unknown command 4743953 [ 288.285483] binder: 20483:20484 ioctl c0306201 20000000 returned -22 16:56:45 executing program 4: r0 = socket$inet6(0xa, 0x7, 0x8) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETFSLABEL(r1, 0x41009432, &(0x7f00000002c0)="53375728ae4d51858df1cd5ac5b02fc1c0cb0bc1aff01f371ddf7b344aa45b921c53152d2d3b90abc5f1e4b23b3b5e3dbbfb43dd4f4cf3b1f70723d3ca29773b4c2685fe3c14f8150e2fd804f6e46faca14c6b3a22d64e5640febc484e546e7d5ab5cc21965e8605e9480f524471c18e4f5fe8c9ab2fe2075a3fa985152005921230643d2321eb9cc77c6597dabc659ba39444454c0138842e934f22a016346bfd0fa1c7b1b0952c821234ad8160baee1d6329ac1a0d16609e47a602eb5f4ebaa820f026434540d07a343ac45f4490e7b9510e2b354de29b3d7c7a5d4119f1716819f94c45d075aa1af67925a41bf031901b54265a4565557c113b42457117d3") unshare(0x20000401) syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/pid\x00') ioctl$KVM_ASSIGN_SET_MSIX_ENTRY(0xffffffffffffffff, 0x4010ae74, &(0x7f0000000140)={0x7f, 0x9, 0x4}) setns(r1, 0x60020002) r2 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x1, 0x20000) shmget$private(0x0, 0x3000, 0x840, &(0x7f0000ffc000/0x3000)=nil) getsockopt$inet_tcp_int(r2, 0x6, 0x0, &(0x7f0000000080), &(0x7f00000000c0)=0x4) ioctl$TIOCCONS(r2, 0x541d) ioctl$TIOCSLCKTRMIOS(r2, 0x5457, &(0x7f0000000200)) 16:56:45 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB='usrjquota']) 16:56:45 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x0, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:45 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000000000007a00000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:45 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000100)={0x800000000000000, 0xf}) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) r2 = getuid() fstat(r1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x9) r4 = getuid() write$P9_RSTATu(r1, &(0x7f0000000140)={0x62, 0x7d, 0x2, {{0x0, 0x47, 0x4, 0x80000001, {0x80, 0x4, 0x2}, 0x2300000, 0x3, 0x6, 0x3, 0x0, "", 0x0, "", 0x7, '\\/{ppp1', 0xd, '{{[lovboxnet0'}, 0x6, '#bdev[', r2, r3, r4}}, 0x62) 16:56:45 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x0, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:45 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000680000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 288.409237] binder: 20494:20497 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 288.418056] binder: 20494:20497 unknown command 4743953 [ 288.425084] binder: 20494:20497 ioctl c0306201 20000000 returned -22 [ 288.438886] EXT4-fs (sda1): Unrecognized mount option "usrjquota" or missing value 16:56:45 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB='usrjquota=']) [ 288.603956] binder: 20521:20523 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 288.612663] binder: 20521:20523 unknown command 4743953 [ 288.618127] binder: 20521:20523 ioctl c0306201 20000000 returned -22 [ 288.635611] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 288.650612] EXT4-fs (sda1): re-mounted. Opts: usrjquota=,errors=continue 16:56:46 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="025cc83d6d345f8f762070") r1 = gettid() r2 = getpid() setpgid(r1, r2) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x5d, &(0x7f0000000580), 0x0) arch_prctl(0x1003, &(0x7f0000000140)="19c3119b2e9a71c7e45988144e59623685b76d681b0f65ae4d") r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r6, &(0x7f0000000100)={0x28, 0x2, 0x0, {0x2, 0x72e, 0x4d60}}, 0x28) sendmsg$IPVS_CMD_GET_SERVICE(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000180)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000440)=ANY=[@ANYBLOB="1080010070ae7c3f626e73124702ae65dc0efaaabc80284178c0190a2c31dfd8323a061de2d4890d639d02570ef95476b173d951ab7a864d94ee7cf91c8e6d0a8a5480e5cc304698f60d3617ff52de89b12929ff61e9c5dd90126a3d7ec92767f0e14319cb", @ANYRES16=0x0, @ANYBLOB="200427bd700000000000040000000c000300080007000000a81e7f125d0000"], 0x20}, 0x1}, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/vs/sloppy_sctp\x00', 0x2, 0x0) modify_ldt$read_default(0x2, &(0x7f0000000000)=""/3, 0x3) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 16:56:46 executing program 1: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000000380)='./file0\x00', 0x0) r1 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x2, 0x200) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_SET_CONFIG(r1, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4400}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)={0x104, r2, 0x10, 0x70bd25, 0x25dfdbfe, {0xc}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback={0x0, 0x1}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @rand_addr=0x40}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @rand_addr=0xffff}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x100}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x9}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x100000001}, @IPVS_CMD_ATTR_SERVICE={0x44, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6}, @IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblc\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x8442}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wlc\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x483d}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast1={0xff, 0x1, [], 0x1}}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x6}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}]}, 0x104}, 0x1, 0x0, 0x0, 0x40001}, 0x20000000) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f00000002c0)=0xee) rmdir(&(0x7f0000000640)='./file0\x00') 16:56:46 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:46 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000cc0700000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:46 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB='usrjquota=']) 16:56:46 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DAEMON(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="14000000e03f221b2a145db0513a05b9a595ded8604887ef30715f11dec4522608cbd9819a5629f3f26b2c82791e9395ef21531ed7151263d84012be9ab3", @ANYRES16=r1, @ANYBLOB="070400000000000000000a000000"], 0x14}, 0x1}, 0x0) 16:56:46 executing program 0: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB='usrjquota=']) 16:56:46 executing program 7: r0 = socket(0x11, 0x803, 0x300) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e20, 0x3, @local={0xfe, 0x80, [], 0xaa}, 0x2}, 0xb2) sendto$inet6(r1, &(0x7f0000000300), 0x0, 0xfffffffffffffffd, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @ipv4={[], [0xff, 0xff], @multicast2=0xe0000002}}, 0x1c) recvmmsg(r0, &(0x7f0000001e80)=[{{&(0x7f0000000100)=@ipx, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001380)=""/155, 0x9b}}, {{&(0x7f0000001440)=@pppol2tpv3in6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @remote}}}, 0x80, &(0x7f00000017c0), 0x28e, 0x0, 0x237}}, {{&(0x7f0000001840)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @ipv4={[], [], @rand_addr}}}}, 0x0, &(0x7f0000000200), 0x0, &(0x7f0000001b00)=""/140, 0x8c}}], 0x3, 0x0, 0x0) [ 288.863866] binder: 20547:20553 BC_REQUEST_DEATH_NOTIFICATION invalid ref 130809856 [ 288.871972] binder: 20547:20553 unknown command 4743953 [ 288.877556] binder: 20547:20553 ioctl c0306201 20000000 returned -22 [ 288.893943] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing 16:56:46 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c4000006c0000000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:46 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:46 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB='usrjquota=']) [ 288.922186] EXT4-fs (sda1): re-mounted. Opts: usrjquota=,errors=continue [ 288.932958] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor0: Inode table for bg 0 marked as needing zeroing [ 288.947381] EXT4-fs (sda1): re-mounted. Opts: usrjquota=,errors=continue 16:56:46 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000080)='\x00'}, 0x10) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000240)={0x4, &(0x7f0000000180)=[{}, {}, {}, {}]}) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f00000000c0)="c4824da82b66ba2100b801000000efb9270900000f323640a7650f30c4e2899c8e02000000f02046452ef3440f6fb800f0ff7fc42101dbc40f2047"}], 0x0, 0x0, &(0x7f0000000080), 0x0) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000040)=ANY=[@ANYBLOB="01000000001e00fb034d564b0000000001"]) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4008ae89, &(0x7f00000001c0)={0x2, 0x0, [0x40000073]}) 16:56:46 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) shmget(0xffffffffffffffff, 0x1000, 0x54001fa0, &(0x7f0000ffc000/0x1000)=nil) openat$vnet(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhost-net\x00', 0x2, 0x0) shmctl$IPC_STAT(0x0, 0x2, &(0x7f0000000040)=""/170) openat$audio(0xffffffffffffff9c, &(0x7f0000d0fff5)='/dev/audio\x00', 0x0, 0x0) ioctl$int_in(0xffffffffffffffff, 0x0, &(0x7f0000000000)) 16:56:46 executing program 4: r0 = socket(0x10000000000010, 0x3, 0x0) ioctl$sock_SIOCGSKNS(r0, 0x894c, &(0x7f0000000000)=0xfffffffffffffffc) write(r0, &(0x7f00000026c0)="240000002e00010000350000000000000000f9ffffffffffffffff000000000000000061", 0x24) 16:56:46 executing program 7: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r1, 0x4010ae68, &(0x7f0000000000)={0x2000}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r2, 0x4048ae9b, &(0x7f0000000240)={0x2a0001, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r3, 0x4008af60, &(0x7f00000000c0)={@host=0x2}) 16:56:46 executing program 6: bpf$MAP_CREATE(0x0, &(0x7f0000000180)={0x7, 0x0, 0x0, 0x0, 0x31}, 0x2c) r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x80) getsockopt$bt_l2cap_L2CAP_OPTIONS(r0, 0x6, 0x1, &(0x7f0000000040), &(0x7f0000000080)=0xc) 16:56:46 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000070000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 289.077109] binder: 20575:20577 BC_REQUEST_DEATH_NOTIFICATION invalid ref 7077888 [ 289.084958] binder: 20575:20577 unknown command 4743953 [ 289.090645] binder: 20575:20577 ioctl c0306201 20000000 returned -22 [ 289.101604] binder: 20575:20577 BC_REQUEST_DEATH_NOTIFICATION invalid ref 7077888 [ 289.109441] binder: 20575:20577 unknown command 4743953 [ 289.114992] binder: 20575:20577 ioctl c0306201 20000000 returned -22 16:56:46 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:46 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) getsockopt$netlink(r0, 0x10e, 0x3, &(0x7f0000000200)=""/219, &(0x7f0000000040)=0xdb) [ 289.209739] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 289.223379] EXT4-fs (sda1): re-mounted. Opts: usrjquota=,errors=continue 16:56:46 executing program 2 (fault-call:2 fault-nth:0): mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:56:46 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x9, 0x1d, 0x6, 0x9, 0x2}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={r0, &(0x7f0000000200), &(0x7f0000000040), 0x2}, 0x20) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x400, 0x0) getresuid(&(0x7f0000000140), &(0x7f0000000200), &(0x7f0000000240)) getsockopt$inet_mreqsrc(r1, 0x0, 0x26, &(0x7f00000000c0)={@multicast1, @remote, @multicast2}, &(0x7f0000000100)=0xc) 16:56:46 executing program 7: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ppp\x00', 0x280, 0x0) getresuid(&(0x7f0000000100), &(0x7f0000000140)=0x0, &(0x7f0000000180)) shmget(0x3, 0x4000, 0x54000814, &(0x7f0000ffa000/0x4000)=nil) fstat(r0, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$binfmt_script(r0, &(0x7f0000001780)={'#! ', './file0', [{0x20, 'rootmode'}, {0x20, 'rootmode'}, {0x20, 'max_read'}, {0x20, 'vmnet0'}, {0x20, 'blksize'}, {0x20, '/eth1'}], 0xa, "c017dfbfa4bea5ac39cb5aee9a23ae5a930287871d760546ec5d389ed8c8b1a0dd2e4851a38c8217ad72b46f6b9f03acecca7c0b5f89e353c4f1c21269442bb66f"}, 0x7c) ioctl$FIONREAD(r0, 0x541b, &(0x7f00000001c0)) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x800010, &(0x7f00000002c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@default_permissions='default_permissions', 0x2c}, {@allow_other='allow_other', 0x2c}, {@blksize={'blksize', 0x3d, 0x1200}, 0x2c}, {@max_read={'max_read', 0x3d, 0x4}, 0x2c}, {@allow_other='allow_other', 0x2c}, {@allow_other='allow_other', 0x2c}, {@max_read={'max_read', 0x3d, 0xfffffffffffffffe}, 0x2c}]}}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f000031f000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f00000005c0)={0x0, 0xe6, "1481e020a2a688aafdd3a33b52e181649a6e5f76e442253d71c0e27007aeeb45683143c183721378a1206f7b224016b836c671716c7c79604fd1fa8060dabe78168b50c58319995fb4288d7212d49bb9c5957030d9a22e666ba040df7cc497f0eacbf0d73ec2c2d5ff7212ac49eccab4dfd5766da9801c757df67aa6d3721fc8ac708a45fcd3ec006a56b44ccd475710d773f283f7f774c1e81b92a7e0fc9695115e327d3951dff053911d90ed6d281004b35f7cb2ff68a97ea50110b1359e0a33f1ff8cef7413dbcefeaf8fcf5fd7c4f6d4c07fdc0ab526c6276e12bdfbbd1f33fc88a746b3"}, &(0x7f00000006c0)=0xee) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000700)={r4, 0x1000, "c7dbcba3d767e32e40483656a22493103c4de738850f2a226de15ed6a3069566589c1c88fc937e989839eeea281a37c0f79bc21a7994054e6b22006979ea2ae35cc1f0732aac2ea0d31b25040f257aab2495c9c5e72bcf7d94ea3a5787976ae13308a1cb747b48241e6937b65da7b8608f8ad08c370ff650d4a0b9906d2c9b6bab397a8e31110f708040a0899a29f23e6b34c7d26b8b893a6161003b0b781b9069bcf2ac322a315d97a95f83cda1de4df1475965c20acec3c5c72420499cf0a9eb8f487bc4c5a1d02b6ffa8da3834007d15ebe1863dc8d5d0d1585226ce28a8b23cbb1c94ac318cf88684a774fff138ed4864f4a9c0b79a2def7d5de09fe5c88bf9c7dd4e9944122e89169535489353fc0f0705d421761a9380f8dfe706bed77d90c0d23c8de03917a60a64fb1338ee1603128015c35643fee3b0513651e2c07de8642bd5fdc737097fe64d2dd8a362066b60fdfb6e597295d740e90536f260def99969e1a7eb819d0177bca7748d8500aa3116f925a90c9043f0bdd3f08a48b04cbdcb20d9baa65b04a85fcb6aa9d5c4d1c402879767a40b441c4139c12cb13ade65607e923c24fabd2ce7cb56bc8ed8aea1dcc6bab40bdad5c2d781c2c5606da635a2e007cd06433f5a1c74faf0791e9ca0b0c12b5b06cc003aebc4f7982b31a7ea8aae317bc62d37bbf053ee25f8105ca9e24e813708959cd641e634f6a6943205396a1ace2ed9562eecc52cbe7771a667c796a7fa69f5565cabb3245ddc65c50dddd86531b1509b4c28d6619e99379eabe42c1d312f59106501a628d028d91f00187d8202c39ff6e170fc88be55476f1433e7b7f106ff83f4417e70817fdfc3259e7479914d87294cab0b5e67f635bd7d11cad44a125fa2fed1ed10dae30ec272c0d0311f32803f32933f777c89c26c6e5554612ea1588b1b4fee6e18ef91d3e8f6bd4a8164d5cda45d33817beefa976ac3e33b9a0573ae62a56131f4dfbf52cb69148b3cf5e26e4138a20d48de691abef913df6cda405ed860ef3eb1bb3ca64583d1e212630ad618c48e642b7ede8e15013366c521ec4d3b6ca7d5a72c93df776d04e19700733b95132bf429d5bb19c8516a17070a8b5ba8238694374d30662e1413f0b4fd20f50f26d3e724dae251a6940ba13b0282a8ed62f6ff0a50d5e2ab30906daa29a5ddb7ea01a761cd613e03a9e9352c30b30d54c200e2513a4f0f3c52cd2bda2f801629299a11d47d7ed6c909cffa8434de8ff923b1ba25d597068fa9afab1d61b86a17e9e525fee0f62142888436751e26308078e52237ea72268844532ba828214ec8491891c02f4af2d1d45506cd274c16a6b98425f24ae883f14c6bcebd2716eb5b0a29fec6f589f069b49ecd87dd49d32c15292c55f91b16d5efc2de75c7def8ae93db8914768cf0b8cd2b39862db717174295bb15564d43ee93936f9bcfdf193506b364647fdb35bc4e17b8ed61d6460326d5e164878be0bcb859371d4a49d5682d2e870d45e9d116ff3f6f0780fd5be0c42e6c126672dcdc54c58777584a3ea931511cf71aad7fd4f9c1c7664fc68c2f9e1f085e05ff76777dc4b753f596d1fa29fecf69c2e0b6c6d2fab795df75ecc1dc4de7ee4a428ca4a16ef1abd4c01aa8df8540535d7432faabc6d0da76821d7bce02b54ec7f00649c01a86fa150507a18d01a3877f49866a6ffc4422a7bc158036c9aa019fe27091564df644544088c1b207fc2c280855a5cc20b5e11cca05bd381af4e1c5b7fcc149e5adf0080c8c766b9c95b61865896c3a50f18fde42ea389cf1e478a65a75e76617bcae5bfb5b745ac4019a1ffdb817d1cf2d750f6e31ce9648b83423c2a69ec0c954bedfd0277eb5342ecfcda23ae9d087c6015d991246476bd03239fc2f64e8d151d2025706106f3849eaf0e497de0fcb9aa953a585ab4116f8498afa24dcd9db68c7d97b6baf4b9248de091fc7d7d184dbb1df413f0570be260c9a291ecadac3afb4b6d47503a5b372b2d09bf910b0529a043e8dad8dafce9fa129401f738b09610a80443a077d756472a005f3b0230536b7ad2259d9b27f52edc67e85e9279bd663b2bdd53f2a489e177076bb7a5140d22b12d449bc737c2dc1c33e880f55774e279976e1efa26e19d5d7f70a8545706abc26389cf56b9dd480284efdcdcf65f929a12d1b33512ec213b3a92c4a4c7cd4d3ea72a204f880c65c82a3ff0483a07c448beac94be8850fadbe143c6b2d8e4121f8a2fc4ca7e18a17dae4882aacbf0d9de05647b611d07056cf2ab4fc9022578f89296e58b61a5da03834d32b717f575a887cda8c6ea57b7824b0a662f492c8daae2f8e82753cf6d059f9dc7021189225fbb4a96c23f7bb7bf67b400e0a49cb20a202b5492211d5d935ad685dd647c9f24e7d26eeeebcb5aa4ea9151945426fb0d11c63d82675c36a62267d7184da592c5e8f1c83c871d925ce7d4558d3ef31a5e9af7fb18d0236d869fd2b5cd942fca6fb3d8d1931c3df8b35f62923c62641b4a9b6f2afe257ace1c5ee40da9fdc6a8fc13dea2a070f1543c9bea96dca039890d5c6bd51fcfb206206243a729832b139147334541ce4acee54e859bb353981991e81a7f166dd66d565bad57640db8e493e752967d94d97928d5440b27bae3eebd0da9ed4a8064926a135121b044cd0b37ae49dc92cb7b46d9de05ca4faaee466c8ca3b60c526e99f3adb5f673c4941a8aac59e43b693fcc47294d3bcf7f719ffbf1e0af0c80439f57815d038ef6c2bdd87b82314817bfcc6cdcd8b781960f12d97d42877f5d70630947375fef4be1a493c3cbbbf6a6f43dc8a29fe5ef6509c387d8d949d31ee7e734edd48201c8393e87a5ea325750fc50774530debaf63472b3498cb2ce7c164f8db5579a42d3730c208e3be601556da5ce7c9ae73dfc69417a22b079c9969ecebc24fa7d0f990775b4ebaf5d7aa8b0290d8b1ae8bb36a6dd41d5e2fa7d04ab6602cdce7af2273611b0ff0714a5f70a34ecc70402ae6bb97a481db7a84f5adcdcfd17b22002864c7e008fc0deff36a2a0ccfcd8f5e87e910bb361cf99649e31437118cf4d05576e37051821613f5c4c4a7b367368cf57d7b4a5ba702362530bbd7a8fabf806c0584fa45f6c42cc1486af9202d02606b46eba4f6f600e92edf1c250b90f8fce770cb899a7250971d715f3af13ae67a81bd88b868babf20ec613fadc666aa2f67887697fd16e9b894ed6a64ee9eeb5269e7b445fb2fa7d5374ad90ab4eca0e423795595a85b87a9e99d7ba3a1f07ecef69ce801de7cbbd4d5d8c14c73553b234e38f2e2a6ceaec00e628fbb6907a88bb03b3660face6c82e9d1637c8e041e77deb01159119a77616bafc5fc664600bdd574380ad1f29053a20c52793d1d5adff7514b58e26bf581940af1978e7ad8ec13b0f5ada6b64dfadb13dc20310a4017914912353e7a71067ae6d1691f6b382a19d7000201f9837cf16c9a3a6298ed875883c6b9cf751edb83ccd3393bf9bd3b2eaae165c4d4db7c330a6f0c2e323816bd3c0a669994bf3d90e34caa155835e39bdbd79443d5d325be07108a0650a212b3d366337e070e75c4e925a242aa239226717835a60807b1cccee2d28abec7dabe95b53c0e2e442941240196c83054ca452496fd69c0c38d80ffde102717ef637d00e6143e9a2c263429b55b7661b42173ea7160603b5bd0be8cd5de88a137b50f5423b0bfadf3e182aee8e7df9befcdeb25db45f1ecc75f32c0a8a151efea3de5064630ee8062b5ba7c594a32db813a968b68ed83e9f88efb80f6c3e7264bd28c9b0c4468ac8de885edb4a4e1df960381ff2d2f936e1241413156fe46070a6aad7af21ff27333e2ed94bb66baa2c3c432e038488549fa0489418cb4b45df9d59ff69afa51c2b4ced65d073ed9ad90cfffddf73073932af910b51a5e370a388b5a8f4c291669f9d8fa82bed3f13cdda7903f2db1ea804d23b680b0ce9d022a9fa7bb7bce3c6a24d8fa27c802ff9d2f3311aa4abc221f0762f86d591d37c13d4c3b10ae316fca67e0fed03adf5b1d927120f5b95edefdcb088763c77bb210811bb9fa727e8759e3f0ce18f1b46d73f3a1acc3aa1ed067732b2c6bb9adc47070133730bb83a17996b0fcbe744a91c0aee0cadd1824adaa65388e8bc8ccaf6e0edf73996e0fbc22ba06f17b3c5fdb8fa20c0db2fbf712d52f77b9e95a32a8f04764b393583eca0adf8df1173dcd3446b4dfeed585c41292d6e5ef400de8740572bb158e491ab47adb9e1f7ae90b2f9d4a1d86959431a09fbd8fd2b28d383919c52209120325aae4a9a5efe21e39b97f3442625a814e22a9d6eb4584cd117cdeb4362b56e8ed26f96bc0e099c9ecb85a3d593a8911309307d667d35923f64537b3ec6f2c00d440e14ca85635176e657da4d91812a4f20742e015f81f6a312ffd30565487393755dd738ff1bd160a25d5b2b79d323018768f0bb0bfa0fb8c73354eb237520fb84d1480c45f3e0281de194ac537de3e254474f717b0daceab6281242be1b0f146bec9c0995243d74f3e539f82b9e4f9de4b18037883c759c4f10344b1603173bb9506b6b226a2d129de98ce228a8ee94a2b916a125ea9c88fad2e74a9e62516745475488162389a40c4053019368e7bccf4bd09c71f063ec0217b6fc6b882ea0cee3e88437d97676f17cf1d47213631a693cd35ead736d05430b3d9d1cd546a83c1568cb48ff0fb77c430a2f72663af7e37210de5127d4e7e4ab22fdd4fd573730357c6bcb4ea980da3d5f7a3ba565c74676bda6d5d70934e789df8ff58644bcb5c012bdaa8a6f36b7e0da4c085723913c7a3012a10a27bb30c50655a6309006c82ab5805e887b3eb19a268605c721e31c744878921a84b3a431b5585d5e60fadffbc65f5f7ebaa19b8f4f25511ab0fd04479d2480d29bf995fcf7f597d2c6371282f08d191858bc738f4a4e1751a4044131821d31dd04095aa4eabf56346028ac3b24256d0d2e45a505c0f4f86fe49b41eb9add71d2b0539bec2d4b3a2a49e27ffbeb3fb324b561a5fd3877d89a489fcd21da6323cc7ca006f5f33c0ea89750bb1735b37020504149af583b8b743287d26984c7c049de97f8d36fbc8757f7e63f902bf1d6ffb786e0b84dfa662e4072412c0e7a96f4212c117690800c5bd8c07690101ba4f7baa4cbdace06b49e9b26e6522ec616f65c8604a2243d0277e6f501d2363e1c3da9f340d39a9afe37439a36459033b6f1c7df922dd8ed78c5d465f1313fcedce3916b0a7e7e47d988ae816e0dfc25e15621cda16f94b46dc5ae265adb809c3f51323e57f12770c9bad44ea0033efc8828d020efc87b6dc4374c28d68a3dc811120522eaee503d3c3a17b570fbad9f3219f8e56db8477f0f07834f88ddf53001ae47a339d4e458e98ac72d93ff32747c29c00571d9484e7aefd601f0388cfcce50df198a92d81ce5fc3c3909d1b85b9d0ca94a1431f9f69edcdb78ce27f29aeb4aedebd74cd503256e13c7310f2c9ce13aebba9e97b5b88395ce0f5629b045530c6a13a9024a0293707542fd4aefbe8f12fcfeaf0977eadcfb47d73c4f1e76c526add8ca0fd297a33d6fc96811b18765f0248d9f62d16f97566f74cfb3b15c815f71a11df2a81492de8d1bdcaed714a5e51878f5ea0d74ce1e44634181cba6b0508cd8ae7cbb9d0c9056eaa08bee21a7670d63035e46cda059c19c7856839c84036782bb164e8035e51b699d1f02d0e396c6a953a047ae9b9d34f6b0365a0c1eedbb9474bddd9999c0048896260276029da8dda030"}, &(0x7f0000001740)=0x1008) getsockopt$inet_tcp_buf(r0, 0x6, 0xd, &(0x7f0000000200)=""/121, &(0x7f00000003c0)=0x79) r5 = perf_event_open(&(0x7f0000348f88)={0x2, 0x78, 0x3e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x1000000000002, 0x0) r6 = socket$l2tp(0x18, 0x1, 0x1) pwrite64(r6, &(0x7f0000000440)="1b1bf180e336a64a13a189ab08dde7f0d98e1f00db624319253b5b960e0b496093896c04409839afb44d78809574afb15c6730686bc1b425219fbe86818c89cd61f8ff1aebc577065fb71194ea38d53dd0cdf14d86f1a519f4c277b3ee54329d52a47ce70273b6d3e4c90a3a1911c810693161177dcda087766e654d096125a6bae222e2a525b0b8988e7ac454764aea608b00b305879fbacdaba2dee822145e2df4a762f8740ec12c988402b495e1ab0ed62013332894919f3ffac609cf45c71ac8c8e4c9cfbf3b9058f36757f3c4f0db8f874bfad98ce4d338d0c055a3cc257af612cf1e8e", 0xe6, 0x0) ioctl(r5, 0x8914, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000400)={@dev={0xfe, 0x80, [], 0xa}, 0x7e83, 0x3, 0xff, 0x3, 0x758, 0x77c, 0x3}, 0x20) r7 = perf_event_open(&(0x7f000025c000)={0x2, 0xfedd, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x566d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, r3, 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x2400, 0x3) shmget(0x0, 0x4000, 0x800, &(0x7f0000ff9000/0x4000)=nil) 16:56:46 executing program 0: syz_mount_image$xfs(&(0x7f0000000000)='xfs\x00', &(0x7f0000000040)='./file0\x00', 0x36bd95a7, 0x1, &(0x7f0000001300)=[{&(0x7f0000000100)="9e452370c163dbecb3a8d5e585746c20b9a57ffab99a70c0b7f16b483f39857c2a6f3f84da3e2b6e128d34ba287c7b089d7db12cb35765b60128136068e0003dcb0512941bcfa6edc64ebf37da99a3affcc310d971d5c85dd2f49038e4ce67dcda91a5091c6aa13258033c6d03ed5f990d1d6abd0e12235dc14501afa80661f62dafd2697c2785ac5e2de0d9af79887452e739d4a7513840d82fdd30f1e75474ff32f8f6aa8458b9fc5829c17e7ab82668d2901006f6af11473e319cf555351a95db6770a163d115d6764b37e611059546fdcb1f68e283dbbf", 0xd9, 0x3}], 0x0, &(0x7f0000000080)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000780)={{{@in=@dev, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in6=@ipv4={[], [], @broadcast}}}, &(0x7f0000000880)=0xe8) syz_mount_image$jfs(&(0x7f00000000c0)='jfs\x00', &(0x7f0000000200)='./file0/file0\x00', 0x1, 0x8, &(0x7f00000006c0)=[{&(0x7f0000000240)="529d3de3f1643e282e6a9ba1f13aa12cc4e0fbfa0f13e7502c8e57a915ed85d3e22e44d696986ab5cedeb40c93a94c4a7dde6a5eb4899e", 0x37, 0x4}, {&(0x7f0000000280)="6d79f5061ef7423f7144dd4cdd318cd129c8d32acf6b5947a42bff5cfb54ee3c1ecb2f410b11aa9bf69bfbd53e3d2d9e7144daae33f3e7", 0x37, 0x1a1}, {&(0x7f00000002c0), 0x0, 0xe0}, {&(0x7f0000000300)="79195aa83a8eb50692c83e55ac917683f979fe31eb0370871b834a9cbc403c9ca31c785f982143ba913c3c9881876fe092dc7752350367ad7d0f6c96b7213a53ed989476cb027771d37899702eff08e30711c067d0a7e46d18ba5e9585baf63efd3aaa68e2352fa7d5b9d7645030436cd45df9844cc903f8f87d24165e6287e4914b69eac31ed0bfbb1dbb04e9406d0891dd1493e5c3f74ae32bf1526dd57b11659e851d79ad8c1b", 0xa8, 0x3}, {&(0x7f00000003c0)="d4718e9eea64e78208009b0e46e9ba866258e74f53186ee887a7e715168a6a48241e647aa9ed77e1a3c7ac093da6503df3439020dd45df1529ba58aa540b6172a7e839747fd010f59b573dcb8ec163b748eb622faac7665a5873be7a3ff048ce8760b8b5206eff3d4ac0ebf9cd255dd5cd97f965416c69ab82f8fa0e83bce53dd9cd38c9a40594d7", 0x88, 0x6a}, {&(0x7f0000000480)="45beea4474c26fb21d75f7bc948fb7179df66dc247834ebfd844c714959b2d6ef65ffb5fd4e2120f4b8ecf968120087335731c7127cd1a3eca08f72b36cb9b7c6e31ae3b7e9e59ec8174fcc4d155a8cd41866546ff1ffde5e56a9f6fb7b31a8f5504e2e9ae4c9310f7fe715174610eb7622af7dd2a831c288b78afd7bdf8e6e0e53f39ecf3783c3b798eb0226e80e38f1c9f6aef665732fbe302e31f68b4c74e39885c8ca8148919d2dd69d8ce1ea14a4d062be04c6b9c892b163f2c8d835038093f53ee42", 0xc5, 0x7}, {&(0x7f0000000580)="87486d2cc26cd189756ffebf9291c6ecb3815ee78a0ef9a49502fda08c0f7388bf239c91b61c71c3f9c13cc058e7a1c42a508ece8fd8cf68339fe243c17657a122627828137a280870d8d99af97b123409bc96b7aabf160fc76b811104c66b0d0569422ca3f1efd8fa91c0e6839767121a323d604410d88f94d1c0ef5ef95b4534c4b8520b5c000d268eb3a2c19aff84685b8877e2202f1ffabcca217556b9e338dfe5", 0xa3, 0x80000001}, {&(0x7f0000000640)="f4777e0fb9cfe7fa1b05f55f65a2450cb84bcf6132863b0e292a4cba9c337140413f33710cd539cce36a74aeead4da297602ba9e1f9f2352f43556ca66701f8dd78064b6095b2b3cf31d5cb2a4b0fdc61829a5bfc95cccae0b24aa97de3d532ae08d1d2552ea7103f48e1b5420dc8ddde6463979db033eeca60ca872734e", 0x7e, 0x7}], 0x2000, &(0x7f00000008c0)={[{@usrquota='usrquota', 0x2c}, {@uid={'uid', 0x3d, r0}, 0x2c}]}) 16:56:46 executing program 6: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x20, 0xffffffffffffffff, 0xfffffffffffffffc) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000440)=0x0) syz_open_procfs(r1, &(0x7f0000000480)='net/hci\x00') vmsplice(r0, &(0x7f00000015c0)=[{&(0x7f0000000040)="7b25bdcd2e35a9fe359dbb131953d241630c94e63c572f83cbe51a22", 0x1c}, {&(0x7f0000000080)="be08762029b6d8c9d77922ff76d2ee0da1ff6751c4ddb424492521e2a58de9314c1cb521fa431e5e4fa3915e4eee44e9d24034f62707bcb7b63c939670e2e73ff77e0c4c3c462ca90b5b7f9d8c7fab6ba3ec5e069ce9e3415d8f2a47ef7bad1d938fd73a0d1388a5c5b8ccd14deee639ba2a71fb38b97a956e616436bd5ac340495e005d42adeda826633887e703ae446eca0162ba53edb4fbb8ff9709", 0xffffffffffffff4e}, {&(0x7f0000000200)="a5add72101be77128b60e57dd69054fc612202b6c89e97e59386a433f60b788a3f95b4cac565e4677cb63ffddf0cd0e02c9875272e976aa48585d5c36030ab239698d1a1e0d5449d66fbad0d9f0b06debc780bf64aa236542355fe8991dfc2132d9986410fd368d87fd8b783cd4fc6c8f4e119c6c18b2e4ec9dc0a56661c63", 0x7f}, {&(0x7f0000000280)="cb00b7c6076a15a9b226cdb104aea4870f56197ccd44f98f88e1194b58eb13b385b364aea7758b98b21d7b0b52ad8d0c53ab673ffbd9a0e03afb86b7e1762bdd6c0d9b4fbc800bbb5493370539d4e5082ae2efee8eaacc5c7f063dff", 0x5c}, {&(0x7f0000001700)="a9c623fc17b1d901446a76d172e717fd815d6a5dbcb06e2067540e377ff44b3a2ab60f484b9cb9e346df203a21d9c48cc49e3843c74255dc4e279dc4bdbde84feeaf417047273677da7363887740ab2522bf7d8e9ba3638d36a1816fe593bee43029b487a5988ee86b3adf7b0a1c1fc2d79ae17eee28ff0e557e06ffba5a33e3b2ce969bd4b74daefbaa63d05558643b11ecf6ee5a01a9ae775176bab41e699a52c4659790497250403a4f33ade297a892698a0997c03ca4a6c83952bf6d59101292a38a7cd64afc7aa28ebd7ed55f723ee6f4e9bff995e3cdbb1c7d03952eb44b4c15c9cb90f5d3a277595dfbfc8ad083cddcd45e602c71a554e07675dd9322053225e004e931ac081cff11658bee5baf7c0757f23eb995b8fba70a68e2c9ff3c79db77aaf8f79bca72af8ed40b74f7a6cea26d4ee7859d25a36f4a81105572aa572e107dd456dd8214df6a950baccf89a8dab36c80e1b00c49d4c7be359a6e666b1e7eebdd5050365d04b9f7cd976c289ff4b5ea5feb7c9c67f3de1314669e678472027fada01199b66384d54bae2f44d5d04c64724e3241814f96c760d1ef7ba6a1c0b3c0e5102a2d91739ac0ef4ac7ea398dc627b417d6c5101294de8dba3e2b3a2ce96d04d90ba17546f2ca7438cc8b9e99d41e0c9f20d0a0184f5e97729fd86d36f993616d63a5729f4a535bf7a92c65dc8b57be439d7f81afc3175fc92d4fce949a66ca421b577bae277a8c38a914883f5cd22e2a3c91fd195dbd76020e342f6b0699b4442d6b192216ba8f570b8f2442b6a5d1977b046e3545b6819fd413db3ebd0b6890587936a74fbbe43a7bd4391dfe0c7f2239021b1d6aabd15695aca4f1644581251b831a46aed6321ccbd1c9da2e5afeb7a4449483ad4307c12238e83f51a443325cbda214b8d7a12b3da0c73945d489ef38377a2142be9b9ddf854518749aea29a6a509c7d77286f3aff8353c63174e1cb1ac9d760658a520737b72df25540f2051b6411b2fb3a164551fa92955e97c5a5812a030a025ae27066227725021cc084a83a1f570b499a95f96c6c837a242d8bfd96027beb4eeaebb0ec4f626fda8ff7eedb32f915bbff232b8596554d70b700a54aa3a1c818a9fcb4d9f0415a7cea8cccb4f7ceebd30b5e8031def649b7d81ff49e81cb8446edaa42159f0d3ac79740fd4616932d086056db1e7399eea7d0de539efac84e3deea6ca0b43e062fb8873f391480a8580780d29d0497301dda3a20c38e832878d56f95a74873d325f5c82a54d2698e213aae90c5a53627d74168d5cc0724250d4a4b826bb0450e9bb20c0318a20f2dee8d2446b938b298564bf6737a6cc8fc71e1ec5fcd762019b4678479b56594439dc5cec067305d3e11d0ac884594542f965209e8c72229d6f5fa1610bb97767c4f54f2fdd7af8ce59f540e89991a685641a3145000577a881db26d06504cfae7adfeb599f59b8a1ddb147ec48fff480d1f16fe1d6de442d258b01612809a9c0590b9572a69e673232246ee786de39eda8630cf8d563a1783c508e02672e93370143b18070afde44791ef17f490842580919ab3553b4582a0692c986460e71727101b88fef5df11103459f5193c52723d1e5a16b501090b31e46208a53ae5a43db8d0e1febaeaff18a4bd70cd988a181f10c10fc16b0363418f679ae20c7357e00947c51fbc88ae518dbeec0f1e360cbbfe4423d0ebaa9df71a7b667a8dc11b9e2f8eadbd28a8a57a176c0cc90e3913d84b5fe706a8a7820182432d692a5a4c2cd0c18fa9b00068fe60e4334d8addd93417ec337843ef2426cfc9fab39360f1dbdc35530d853cba91d7396319a4c653528dcd71310cd4c1de2dfb663406aa2ffbaf836b1ec6963a2c4fb20929b2b13bc1b3b8c0ba51dc3795f02a90721a635352732f8f66531e71b9c59ec8ba8799a7e75fc2f726cc0023e1ef906e04a8c016803f84cd6baea09a59abda37ec0f9b0398b2afe6d59efaf5b8dfdd26c068b8412f6ed44319d3f16da7af6661528e569ee8ac93740257aabdab9219cc452f02bce9a5162ec1a9a5a14dbf9d4dd3d2b9f83abef3b465d3fa8edd0a15fd25249ede65c37f17c0d583dabad2559c290811ea93739f2354059c7bcb6fe096609c77c83512f9efacacdece5943eb19f9714f7f5a761b44fa59f60e04b06ce84cef9a0ac8c23b32edb0f5877a71c63c75205b5d63bcc8952184a5556ff95bb2197f3909f1175b8dd9616913d2afda84acc95bdac54db86c3240ef6c302665c2c4c0282d8a16a5b5976adec2d6eafeb4298d82b995f6887f8fbdcea78e6b33a51807818155e5145cecc2561efef66e55fd04f0ce35963da13a50f173f20ac1ecb787aba0945209da50bc121e18fecd5594a40693c85f3e619953ea7433af908dd43bc2c7b224c49b7fff3cf14e9aa90d5dca54824e83596b69072b450b795702aebaeae0085647f2aa45e50bc337ff2e3a7896dcfdbfd93518c9e0b4bf1cdafad60fac4ea363549ddd3e05b52088e0ad2feab596d9f622bb5bb00f205ec1ddcd256cc82f89a13b3b008207479cc29c7c0682fc56080de50c1e974deda2f6d840ca363bf98df16985bec929206ddb0525c05392115450ff623681e36b9516dd43ae061687ab86dd611d33a9eecc145ab24da29a5d44764a1df8878e04919fe5b247897e5e95cb499504cc785f7ec7cf4d49de5bd40e23574568c183354bfa5ca35ba833eb7db9025c67d08b1dc2a513eb9f69c26d534c13c32c2df3a70e438e4070f7f75906f8eea4b5b8c5a43ad2784a146ee3a926741beb677f221ee1df08adb61ee0d5c2d250c51a0aa184f0e5b0441149be8293b83d1c90a43b9deaa05ec096f3bac54ad103f30909378764257e2d892dad95fb36d856f588fbb0473a5526dd31a79e3cef25e46400525cdffc0eb0a0de6403ed7d56a10ffb11e552b1c0c2a0a46161198824a6e1a17208bff7930148db21ce6d2c15be8b5a45f48f4e7266c1381bc8244e40ac0f154f3caf802fd6b4fe8670fdc7cad7ba1442ad9e39fca6a2e7ad631f80a937ceee0e097657dc5ad2a2e7e21a5e606a19aa22e758da7ae9cd82e84cec6ab131a7d2d456e5257e096db682f8393526349c573dbb432768d8acc8964c84f902ab2e0aefca920cf7b7cdf2b18d4f8f777e61835f530f6d77905295ef388f3bd008adbd9d2114503506b1a6ec166c00738b160b7d948fb2d168cbbdea52d59c938dd9a2c2539cb8f6f3649d86822488329c47f37e6b37f4b252684bf560b9c0d1575631794a4bf148b2f032b4f522965b8feb8f465dd637febd6b8abf6d5a346f00e7f406d51d52dffa3b36805e21f2bd3d70c25631259af26a11f529c432c2c9f3fc9110667d70fba15176cef5bf46099b5c1e36aefd8c4e55437d2d10123902cb5ac25bde703bb603299f3db670048dc7cf1cdbb1004f98a6910d9c74d384e41e3443ca8fc35e003b3c60933d9deccde7b38b3d696dc2692d10833e2e7f16964467464609cf9edab57a4625dbc3ce17fb32bd0f816a77bf3e414c51465899247c4adae3de1bdfbbc16fad6afe5ce78039c931f3e91b71f391aee49269d06e5cdb5ba1283f39a29d70d18e2a3e9fe960bfbbcc4ad0962af866eb5cf68d7a132ce8550c97b83daf3fc7c14bf51cd4d5ab39d7794f5b29549efed1d00777c7735b75998d143742867b1007290d5326975100a42291f1767c1276eef5fccb3024e6c646a749ba57a3c77b98bf8a25fb0b19bf7bf84158a0d296d9d3f8150be4e42b6d9cae7b16aa0c3def34a8811b8d68db11c76ca8ad8f31fe56a78a00563e94ab6f6841259ba89351e181b3dc0aa0e9426f797a385add35c4c1735828b88bdd98dcfd02c7ecea9c981e2b96f33cf54aee5158a9f3e543cc447d9c28a9445c6c06e6e941c686d946d292e1292e6ba5b9043e266cc13bb996c8884357f956690d19280b9d88d80f9a7a614731ddcc9ff7a3f933995c6c67a17b4a3868dbaf38a1948fcaaa97dddd8ee2c6599cea461cf2918e6cb460a726b53f915cb0848557a5dd59f7749a64ab5e5a50a5bde774773bfe72801621a3e914ef47cdf27ce3efb9242aa367752ea96d6f77137478215363c12dbac41381af0af630c78d1f43e5cd626ff1f5428c49e885860b88ed38a13f7317fde20b514da9caa87af316dc4ffd68c205ce41c6006f2b398d28e82149fbd11b31be734a369afe62d6ab770ecc6add3f0189e0b6cad9d71538424de7ff9578f4fa33b1c57939f1dc9c58a60575f7154814b4876420f9cf6d1cd9de1a49e934d503c5f2c7d571ed649f7e9d02f089d73881f1fc8599b9d205e8d795964236f5ccb34907f59a78c78ae4865f5ce2353c0a3f79a22c0a4156f6905e449e7d4f9dc74cd92c01549dcc2412aae343e0406edc684f937c86e176af3ec7afe06dd8dfa78bea5eb6d69fef08353727b8e3d4165a14a9565b468784c1d6f8301bcc5079e0f7ee380c58a2d45ad40a01f234804b1639527d5030eed1b77bbca9f418900639e841516ce0e8e7565713ffb5abfdb40ca411194ed8c9b9d1d287463c73a1fe0de497bfb84212e5192f89f418452fc218c37b79cbeefe16962161d07219e529583742e1818861b2ab0e4e4d32cc2a0314a376495cd2b62925841d73346e5009ddb4bc6217951f5077f81d301caef4599c1728609b5b26536e177c883eec32f951b2ba4bdaba5e7b455e108f2173db12f2cf7b36f2923397f221d8c254a6d18794b4335ee6f94fbef31e3aa2a00b84368608135f0548272fae4d411688fce47e95492a8a4c124f6aba07381d18ed8700ea4513c26d505000373a1203c6af86ce4af37016bdfdc1d1bd29b1a768bd60e0438a8ecb169a3b682df7be511de5c60eb7cb9af9a306707f2e68ff42019af6eafdae82a5fccb3b398c143f8777f0aa6f3523c6b50362c81087c34f6a36f698cba27459c66825b28af88ea7aa477b075c7cddd6fd28d5e42edd2441a4b6407c551a4e7acf2b6a0ee8be34fc86ee72404100f6afc797059c5ea3199af9c331d6130fabf6836286c158dda0e03e791880108b5b8a739735598929198f8b55a8c972fada937016b49273b388acf88eb6eccf0d258141af2c840f334bc8de384cbc199b493c987fe0c9bddbccfc54eb8a3f59394cfbda3477358bcf2dea430611d41d008645af2405e45552919cce604fe253b4334d095de617dbe5be996fe6fceb910ec3969d20fe54b7621b6d4f25b85a272c1db79020b3675f7ad8da02315e54a277065e1680857c20bef517dfafd9799d75e70c397b9cbb446ec43bf76b4c070583df7922fb8ae789e680f46b36877078c390ad651e0af90d5e038f9adfc8c71d96ce5a272e16a69ca99ace35bd4646b63d5b9fe6b013516540d133b132ec264de61210fda060bf6e312a60d76d6430e4f7a76aaec5756cdb876794f984a8db99d306d55661954cefab8aea02a53bd221aa3cbc14f977673e8202d5dfc4b8ba0073836fdd136555aa9451bffc4c895599ce58ab532d9e3041b5f8fc1903e0e3dc7062ac96355bcaa4a34bb6292f390a25cfbbd1206a82802ab36321be423b61d5232f693f9b907d0afdbd80ee16b783804542217d9770bd47d59dbe0e5ba9efe1303f7cbcd947e215acbcef62fe16dde9eba191ab29cfef3627f61230cd36da63e388aa7a89cc9df27e81c702a7f11a51f9f4f5361fbc5ca5b398285c289767b403525cc3ff597227041d54ad7fa5d77ee830c8fe2d9f96d505a9dccfcfb4304464c0019cb2eb4cde7a7f59aba2dd5b5c70", 0x1000}, {&(0x7f00000013c0)="136068714731809597ce0530d258516dd2d478ff64692f12dc758b055776aa04fd2b46c32914ec2fa0422190ed70240be77e086025727e88c45104fabaf7224b06e3b0c4f8c32f4b822e239c6544c5db0edaeff70ee19637763184f06e38fbd544cc8ee4f4be32d60bd2f8ac0400632be8d4fcf634b3605caf752e0b6efaa470196c1fa0b156c59bb93ad3d11fc981daa15d602d9914d1f1aa989a03282d2b19b1340fd3b24397fff674d333de703150b6b10d2542c8c4c5737fb08a8f9730920761a1a882b017", 0xc7}, {&(0x7f0000001640)="fe93822914909216357474bfc020e84d1583bf94d1bae27c7666b8edffdf1f850bd3484e8547464983aabf55ca1c898ca94852a52c71f97d396d2fbba2b677c4f8a9e3df3be9cec29e47f158c725ebcb1f3f7df46206b68bddcd855e68f9c9f1a43ca99b26d1d23214d2e26dc4e221ede789d7ce490f0bbcfbd06ea0f7a62fbbb07752e0cc0820eb66a31ef5232406b8e75e07930caf74a18346ca7f76768fbc1e0c1dc4750d5137d9187e8f7f", 0xad}, {&(0x7f0000001580)="7c47a41a5641bd77255f3c3b7836883f21682f2f7ef26a81847ec1c9340215c2e843906d9f7875d5083f8da1e29111eaf58a7b7774", 0x35}], 0x8, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f00000003c0)='/dev/snd/pcmC#D#p\x00', 0x5, 0x2000) setsockopt$inet6_udp_int(r2, 0x11, 0x67, &(0x7f0000000400), 0x4) sysfs$2(0x2, 0x0, &(0x7f0000000300)=""/136) 16:56:46 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000004800000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:46 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0x0, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 289.361198] binder: 20606:20609 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 289.369967] binder: 20606:20609 unknown command 4743953 [ 289.375517] binder: 20606:20609 ioctl c0306201 20000000 returned -22 [ 289.387664] binder: 20606:20609 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 289.396347] binder: 20606:20609 unknown command 4743953 [ 289.401844] binder: 20606:20609 ioctl c0306201 20000000 returned -22 16:56:46 executing program 4: socketpair$inet_sctp(0x2, 0x5, 0x84, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_mreqsrc(r0, 0x0, 0x26, &(0x7f0000000100)={@rand_addr=0x6, @local={0xac, 0x14, 0x14, 0xaa}, @broadcast=0xffffffff}, 0xc) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[], 0xfffffffffffffdc2}, 0x1}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="02130000020000000000000000000000134157f50bd5417bd95df4a1ccbf97b7b7b6c83dd4d2b39948b2cdd447bd200a0eb82d2b7a085b5fae2f6a7f99ac16539b345cd41034ad63482691c36168d65e2008b2df1f59a74a46e71811689e1da544c3e99e286a34e615a9360dbeeb04e90fc52439bd17b392"], 0x78}, 0x1}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021200001100000026bd7000fcdbdf2501001400790000000800120003000000000000003800000046003270b4a69956a98fe40000000000ac1414bb0000000000000000000400000000000000000000000000000000000004000400170000001f000000000700003f00000000000000030000000000000002000b00050000000100000000000000"], 0x88}, 0x1}, 0x0) sendmmsg(r1, &(0x7f0000000180), 0x400000000000117, 0x0) [ 289.530671] FAULT_INJECTION: forcing a failure. [ 289.530671] name failslab, interval 1, probability 0, space 0, times 0 [ 289.541958] CPU: 0 PID: 20626 Comm: syz-executor2 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 289.550369] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 289.560078] Call Trace: [ 289.562665] dump_stack+0x1c9/0x2b4 [ 289.566283] ? dump_stack_print_info.cold.2+0x52/0x52 [ 289.571465] ? get_pid_task+0xd8/0x1a0 [ 289.575350] should_fail.cold.4+0xa/0x11 [ 289.579400] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 289.584490] ? vmf_insert_mixed_mkwrite+0xa0/0xa0 [ 289.589324] ? lock_downgrade+0x8f0/0x8f0 [ 289.593487] ? proc_fail_nth_write+0x9e/0x210 [ 289.597970] ? proc_cwd_link+0x1d0/0x1d0 [ 289.602027] ? lock_acquire+0x1e4/0x540 [ 289.606021] ? lock_acquire+0x1e4/0x540 [ 289.609988] ? fs_reclaim_acquire+0x20/0x20 [ 289.614310] ? lock_downgrade+0x8f0/0x8f0 [ 289.618459] ? check_same_owner+0x340/0x340 [ 289.622781] ? rcu_note_context_switch+0x730/0x730 [ 289.627712] __should_failslab+0x124/0x180 [ 289.631934] should_failslab+0x9/0x14 [ 289.635903] __kmalloc+0x2c8/0x760 [ 289.639432] ? strncpy_from_user+0x510/0x510 [ 289.643825] ? fput+0x130/0x1a0 [ 289.647102] ? __x64_sys_memfd_create+0x142/0x4f0 [ 289.651934] __x64_sys_memfd_create+0x142/0x4f0 [ 289.656612] ? memfd_fcntl+0x1e80/0x1e80 [ 289.660696] do_syscall_64+0x1b9/0x820 [ 289.664572] ? finish_task_switch+0x1d3/0x870 [ 289.669067] ? syscall_return_slowpath+0x5e0/0x5e0 [ 289.673988] ? syscall_return_slowpath+0x31d/0x5e0 [ 289.679342] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 289.684346] ? prepare_exit_to_usermode+0x291/0x3b0 [ 289.689352] ? perf_trace_sys_enter+0xb10/0xb10 [ 289.694017] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 289.698859] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 289.704036] RIP: 0033:0x455ab9 [ 289.707214] Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00 16:56:47 executing program 2 (fault-call:2 fault-nth:1): mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:56:47 executing program 7: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000011c0)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x3312, &(0x7f0000000040)) ioctl$SG_GET_ACCESS_COUNT(r0, 0x2289, &(0x7f0000000000)) 16:56:47 executing program 1: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}}, 0x88) setsockopt$inet6_group_source_req(r0, 0x29, 0x2b, &(0x7f0000000140)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}}, 0x108) r1 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, 0xfffffffffffffffc) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280)={0x0, 0x0}, &(0x7f00000002c0)=0xc) getgroups(0x3, &(0x7f0000000300)=[0xee01, 0xffffffffffffffff, 0xee00]) keyctl$chown(0x4, r1, r2, r3) setsockopt$inet6_group_source_req(r0, 0x29, 0x2b, &(0x7f0000a83000)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}, {{0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x108) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000000)={0x1, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}}, 0x90) [ 289.726411] RSP: 002b:00007f088c102a88 EFLAGS: 00000246 ORIG_RAX: 000000000000013f [ 289.734118] RAX: ffffffffffffffda RBX: 0000000020000180 RCX: 0000000000455ab9 [ 289.741382] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000004ba6a1 [ 289.749168] RBP: 000000000072bea0 R08: 0000000000000030 R09: 00000000fbad8001 [ 289.756434] R10: 0000000020000180 R11: 0000000000000246 R12: 0000000000000013 [ 289.763693] R13: 00000000004c220d R14: 00000000004d3c90 R15: 0000000000000000 16:56:47 executing program 6: set_mempolicy(0x4001, &(0x7f0000000040)=0x9, 0x7) mkdir(&(0x7f0000578000)='./file0\x00', 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCSFLAGS(r0, 0x40047459, &(0x7f0000000000)=0x10) [ 289.811230] XFS (loop0): Invalid superblock magic number 16:56:47 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000001c0)={'bond0\x00', &(0x7f0000000000)=@ethtool_link_settings={0x3}}) sendmsg$nfc_llcp(r0, &(0x7f0000001680)={&(0x7f0000000040)={0x27, 0x0, 0x0, 0x5, 0x5, 0x8001, "1967fa6b687c917595d7177b391248a2339a6597d5bb400f8a69f07e97c9464482e8fd66c03692bb18f8129f14d98ef1667d0b8afaba1ecd79d30c53a9826f", 0x1}, 0x60, &(0x7f00000014c0)=[{&(0x7f00000000c0)="507912d18c70604b8253c78c6851d78a975bfbf51bd2cb2dc3b32f36dd2ae19925f1d9f4eaf4d80f5b6c590ed7523ee14a3a38b314bdb29ece7fd5077ebc3af35647548fcf331aeea4a154968755b38ef164e384d2b58f65591cce47c06b5492102e85448734bfd9ca481c9844b7", 0x6e}, {&(0x7f00000002c0)="df9405fe1c620d93b220bd944be408be288b258dde0bdc2a7e00526cd99c86ea0ab5cb01874588cd6222bc3b6b9d0f889d428851c7b1f7d1c5b959ee0ed2e18f7439af0dce2dd6f7cecf4c718977bc7d346afee515562852530a40bcc523a5a753097b7c4116de270e2c5c6372039103f8c0d2b61d5b83f7e2d26b9b77afb0bd5f2ae8565ce88e0f5166c72336bb00b045995a694eab6be725a61868d87850357e2908a6a24d60be45de98fb5020a4e3e697692184ce748cc7c237989166a2c4ba5410d3b1b4154d65144f92edbc066154a750db0493b12a1cde39a5ef78d840e9b5acf6d5dcec65be05d3dad2967edddaab0116f613f7ce99ca28a3808d4fbe07bf185a1eb1aac2946868bcbc96ac3b90aafa751ea93a8df7682a19bf87d8251ada30d58ba52405cf3dcaae3987a7ab95a1930954b12615eb8775a7ac6e919ea3f26365dfa5983d0b3e955d2dfa79ed38e6acfe90480c194c894c12d7fc524177e1fc9f24b6a91265945659f178241b20664e6380f1efbc40c14f8c4638340201d41985ee5c8e76631c5edf957c15efc8d6f6188dc7a7ead402cba14efcd3faec30ed74d14917d463b71cad3ff0f48a47c7cb3c4107e5357a85ed2364409f3cad2ddceb0a813534c35a7e5090a406b69d49467750bc3f100783e2c866fa10afe3c3643c616821f13069847495dfe729b9fb86396736276eb985923c2caa201539d6a11ce8c140bb82c90105ce622674b0e0b3024ef6c0062fee763f0ffa77f676c95e0f32d147080dcd70a8d5fa7b2e6c6e6aff09a594c9a723d35103ec15980f782566bfe4167f31b9ce36130001a1cc2936ea9a9f7e628628d6d914333458823de5c8619ddcbe3a0a1d97f6dfbb7acd9c6edbab00e12712b7012ff678622ed0ec67d5a908bf51dffcfcbb2956c0d2458a26e037e52e542fbd0b6cb2770b892878e3c54563bf75b9207454180b790864ea1603caf99c6adea473e2d1e5974894c2430c531f2ef362d6e96026f64397fd7fe3fa478d7917062ef5f500406265e0869fa25fdfcc9077cfa7188467ab55493e2db2e7cc50479849d15cede6146652c2a22986c7f46d4c5181e25dd18d07ada2f725eb5d4e087eb961926c7027e1c8c0b365b76444261b7f8164fc155ccc9dc6a563a3e4fc63e746735f20ae3a64e418653fdbf50a52ce7afea6e781c9f044118f1c79b6b3b04a595d4fc462bf0861e584559c446113caefe49270c06fc5037db304729b2bd3276423dd1ecf04d654fd72fa80cf06b064dc653ab69d23f8d064f5bc86cf1eaad955a4a829bbf564c4a8ef0585cf233992c51a38672b644370d576740d527d0bfe05324b516b4df1e9618a3aba730c01fe34fe655af500b8aee226c4fe43db6eb5b26330985bf9456b1604d257d604dd34650e8b7215302a3cd79f2d6a06caa0934370f6155761978636b2fffbffa0b4ffb4f6114ce1715c2d1efee3316bfd6ef33a74e623fc0d3a34898e01a720921162fc0af2377226c52a0e370421f7754caafd48e75f0cc54090010306ccc4d62dcd6bba083f08d8f35f6a52cd750364c3d860b72b50089602c6e52d78ddb97235794b5f2bb1ebd66fe915e8d34b5c4b9001412ef38de7b6e58f628de5d5baa438a1970cf9d899fd7045befd7c9f1499add4382e6927cc363370f6cab4a19d4e5064a78bb8a92b5dc28efa9389a50431aa61689e2f6b9c84e781569ed712e911b8161c9c292a0de51a8e583c353b9b9a1eb8ff63f4debd24d0a516b8cfcdbd95bb6bb16d8d86582d3ed092f73bb8852a349a3fd2c0027e9e59a31f9ce5912a7b83c0079789028f5fc6829c3a7df898697e587396c7f6e429061e712a5202605f5f45dc9a9bdc67930aba1884d58f2037984058f20a3399d8074bcab197e4ee88ec1b5116cc4e0b620e7ebeb3ead31c0c6e769fc7a7ef546e2ab60194d8946a71b1155a4314fcde0f44a5be0b18d62cc2f0efdbdecc9bd9cc9f309d7aa0378f83660f82a62b08e9b454ab34c530cad11e8b7e14f72da813fee189aafed871aa676728d3de16eaf1bc7a440012436b554d98aac2f6501a6834bea7124f2fce0617fc9946fb0eefdb618765345a11733ebd381d39fabbf82ee33a170152bd05414cfffb1e3a1a9201b5f4349bd33e9eec686e10105a97497cbdf1e6bf987c0bdcbfbcf9b4783aeb67c10f2e1994aa370e357a89f352e9f44f8049270dd7f4f0059968b357d9f0bdf69dd7e945352995decf1411a90c32f6d5adff20bfeadcac94fd6bfe4ee3641f63c414deebf71b9dae8e1b2f8c482b24b0a2e84531bdafea73d00c236cb0148861b09b48b4e4c54491d964ec8a4067110a1844ce33c0b239683e24edfacd153ec29ef7ae67a19c97addc2d64576a0637ce294455af3b91f5a0ffecf6391d373580075d4cdb7873dcd66e3fc8dfff2f1f81f483607279effdde8ac7e40aeda83bf1d81dd390e59b8b1a97183ec83988f6a6c0f1e9f21a2fcb17765ed02933d355f69f28f8147df1d29eef21382a8761e7c83525eaff5074dced3ccd159cc804c2a63e4bec79493d813c86212598e4e3d66f4e4365cdf1a79349c74c97261d7df6da690ea1644212908b235268164bb7ade1c742eda11403e62a993bc67e37938b23137d9217fba361d6c897abd10ee5e2bebc68347bd0884519324f23c7154aba847625857faeb64754f2297fb934a7f8b167cf0c7306e725a4f11f4087251ccea414d25d52094fd270017e7ddf0401af17c9eac15ffe868a1f9af77f7a24b91199dca803099a0eae010f758bbee00c8ba4aabd5fe0b40cde4d8783990cf4fc0d2fc599416b8a4f1cbfce7aa2c2d68981079108ba4d301d2b0f80a79be4f34272abfa6c25af22e501eaa3f573c857dbe653d829d3f6edef9c390617f516417252a4437926fc42bbc92a86e78f0cece36cf764e65e3ba9184499391f6720a7d3bf37f6b377bfde65e55181e48592e216acd9148110f3224854dd8b1f70a231ddb863d5fbddc1e0b3ef4f98aa4b2116800f4914fa3d2a94067f2193c24c230bf94da4cdeb81c82508977b93bb4376b10a993bcd9e325c749fbbe1bca58058aaf19d95895014429c9cc6f4b903c84cba1cf27ba43591472eb5e4d0dc00cd60442465742ba8d5b97b9c35193aca84c8a54969b38221d9c0b984827e0e32e13cd2686e3c40f37144a6f99eb7b2730dd9730506267394cd011ec3b75be4bc7470d8154b1ffe3f705ceac7cb073ce5ff05ea2a109bf0501b6141178500d69a2e90ff8d5bedb125054b6acac50a79cff7f44660f44727a4eba0ec409954f16af17db527d54414387644d73532dcb177e7a0a99e7a7f28e0a692efa97c5cb0520eb965370c4b020d958de5f4e743fec34af70419a6ee89bffa2d35bca02b1dae461425d8264e940074866816430542b85a3007e1699be832b8736fb9515ec72be261f3a7e403496f03756f052bdf3325bccb1058d364d877f1294583c6602f7f8100e0453f06f8364c8deb908cac6788d1db4627e222dc5f23a542c1b567695e91991260cddfd907a1887701d874a88eec16e3cb1ad50b4c67782bcb9e8fd6f2fa33f641a91af9d0e6d751f034b9d9619c7971882c150ac09f6fe374e665ffbc5f24befcc3ed44f359b570ef19957661590f9d8b3106aa1005ba5849184c8d12dbebf0538fbae0690f76ef08ff68cf942dc706362f664dcf86a6610244b3834d5cdae31b4975eb4e90c877f1932051231a65944c8be575d603837c822ded5bf3da8b6a57bde967afbc3de9ffe72713acba33f892d08b34f23c1d9facaf7c25aad90204c619604f5ff297d8540ad2434dbdc4779f81f9845a6325bdc4e2b6ffa3c8eda9c9bba860b538d1dc35d35e0a7ba19780ef8e54013560e1936ab21f6fb4abddd593cbb00d5e2749adda3d4923add442a4ac9b9b7e0b64162732e2941a28e696088061a326208f0415f2c057929f3fb44fe9bd4e4f8b18158d35c111b9a7c2e09dd7fc57bedf791a0b188e212f8384056d27b0460f1db41339f26e27c7579e2c780bc771f91c54acb3f701cac09bec4ff0f679034eae6b2e3aa763e424440505dd52562ea6bd2c706d2d09819883524705f3b73ac507b0d1e0fdf26aba80b41af3ef393d0a7a216e4d428ca6bd52e820ec5e9ee58e534fa87d8354d892042a705bcdd7e4c3aa361352d18961f40d4a83a07f454241f5f1e14055b0ba25510623fc84eb84061ae7491aa408e179499bcc064fb744685ae36e8e7d61f00d5190c770a73d235575bcc9f7d670f4d8cae5b3be3e2fb4e3c6d19702fe380574050ec7ea89afe50b8180d41b521116bad6f4f7eedbe5391b1849d587db52f0d7149f1ffa8eefb6849c1804a619e2299a8a83090780f9d9b7e185bcdcc17ff880c11d96653a07894eb0a62b14116717b5b36e81f792e1d3be619580785187d7bdbbcee3919a1173d43485bc1f6f603d46c0bd778d0a6760ee452c0fe55492093df8a71043c9e0fb2d1fbc21c1f99268cc139051a525f6e44e10347ab8668e1ab9983dd8747c187f4e9dca3fb17dec236dbfcc30a68a3424b44a50981697850dae50e82d9eeaf43191d1be69d2d47502dd40b79b6f8769605a0a9d64cb489263d553d50524c4391ef42598cd6d75a5749dc88588594032721692935b75a652969eb1cce979d89f7f13d65daaec0cd17c5232c985676c82333f6ea73e98fe0911b982c49dc0aa8445ef53ea260a5b3a5c6c78ac200f89e3f0ece57eab6e583851dd4567589dd3310637df2b3396190aa3a55404c24201d68594b2c7cd5df7a6813f9c4a7602593608f34e65aa7238a91a77fc701ecc4ee861feed4a12f2e0811ae508a15b4e8a612540686038277376c28cc2fd1438f30fef19e133f613302159bf6a3f085d6d97f000a2bce871b9314fb5a6e82ecfee80662eb9cc04e71561106773c5a982fcb8dae2e0babec51f181d900097ed215624ba3841a39e66c43f3083915aaa8ba9c573da7c79eba657ef4fb6bd74c164c3a9c77243ce1550c14e3778c738e0563125f61c4da5e62dff0746a3e9356d69bf1ae07505b79eff9dc7f7cd5956c60952f0894e26b7c1e3a1e0835a554fcbed77eeeda0d3c178a36c4b47aefc3f1dc74dad3866a8ae7681df4c111bc3f92697cd8715cd09762d32cf1e7fa8b31cef4bf2e6e1071587e2206f0d615834943951e89351203d24ed86c429802f161c6aadbc046cfe16f1f02cd5091ba46812a9db47631907c5243cf9a76bf683aa58634f3f7d5da0bf0d47087b47d70d2eec379b3f4056519623343af890ee0a848a79c8e061549bb376eb734753a7d125ea53b3ea5da7200ef09f13582955153710dbb6025152daf5636498f82c0b4413e300cf818d13840ff631523571a9e8f496e83e7c42f7653c8380923ce5bcf745f8de6a8a55da406de6bb7db20cb6978b17d3575df1acb1336e8a73759fa43784f4c54d73b24b93eb8b83097605b5d7305b738f2696e31239a02fee48e0e90f3384995efabfc3cafa04231dd475ebc3e8ac72ff374c9beb2bb3633a044b71b27239835bce262650ae5420e12a80c7e31cd254e3d52e83a40a632f48c02195f8db372cf490adf0517cc160486426e7610cc1af7c0d4e9bf832f8bb56044a104a886c9b6426c41210678d6a3faefd877457a4ef91d14734a4b640956de31308eb7aa257c7b0425f42e6c668cbf46238b0738038de150f9d1080461713891bb617124c48cfc6f26b330deb7795ba52ec76841c416d67718eb640f768ea8384274fd02266d6bee370b131", 0x1000}, {&(0x7f0000000140)="95f44d4c2fbdee7adb236537bafa2cacdb95cf9cb62f7839297c182aee54d2d54fb2a62336912f806f13e78dc70cd731dbf8c6bb734bf2bf3638ed0827e04ef1f13d7f59b04713daca84f0db1170e03123251b19d5f85516321a17c2a1a2cab30001fb18cb083943d54c", 0x6a}, {&(0x7f0000000200)="4d087037c1c1addb1d32e7bfcbd2c3ce566683069b9408d09238f9fe79a1c91499fff2433f957642aa5a33597d04221ca56f602b8a7583f3c46677b78e4b07cc27974aadda4d1055bb0890f6d724236871c8a4c65a9763421f07e54f14cc1c407533d6f23dd41006a1c21c5c80422e176335bd40", 0x74}, {&(0x7f00000012c0)="809e6070769c884c24922a4155f3f2dc925f1a62bbb781adbdc324d97532617b718facda49eb4738137f24271cb4b2e99b1f711910a26539cb8546aa9a3f0404ebe5d4c70a2f3b7bcef31f51b96acd7cbeea371a91fe01fd266b9dbe3d2a674ca1aeb00a34303c79305245aa60e12ed6f9779ea8267e65205e3149f72c5d", 0x7e}, {&(0x7f0000001340)="dbb3a4ecccad7424c6c8f5102d3d29a0a6329dc0ce86b68897eb60d88b79adc677840b78a677e561b5d508f796724f", 0x2f}, {&(0x7f0000001380)="170316d258f83865940e9d231018b580392b57cc3390caa00d4758d29b2fd5e73666feead286b471577a7bb72cd75b14f3728d5c74cc06a7c873d4f8ec877c2c5c1e5634d9e0c1bd6ebc36941f5764bb711362729969cedd274a5cf01344098fcb27cc0cdac24d5e34fab7ac95a2f06307b7bf524c89c9e1617a656fe3", 0x7d}, {&(0x7f0000001400)="835d0a4e32119b89975566eb90e7a914224c93f252efb875d6db068dc2adc91fbb02f82110d9f62de601000ac84e251f69346f535cff66738bdcab952728adeb74f17fd2700bee20eae2838614f6d57b2328348d2302a2ca58192c76a408f3b3cc91e21d25f6298c4eb51dc7e57df0d0c3ddc4cc", 0x74}, {&(0x7f0000001480)="9a9d165ff7380a66727381ead0fd37dcafd26adcb656e987afcfd52e5f17f19ddce9147705eecf463533ce5531806dff4da78c41b0110cd39d2aeeb23e", 0x3d}], 0x9, &(0x7f0000001580)={0x100, 0x10e, 0x8, "85373225594c28478fd4fe2ef6db93818f4cbe951754ad7baad6576daf7ad4b4cda765cb47bbf09e8bea8296ab877a88c8fc54329e849a26ca1986cc456586e2b2451e0f48b52971ac31532a1e2bc97a79b6a265ef9e46deb8c90c893cddcdbcb91bc30faf4ed231e78c3911c3cd812c4abe1b736ebd98251ac0114256febb2bb77f84972a0addac2336b0b521c788a31f7b20ccc9beb743029f0f099f3ac7e0719b95424530883b6d509ec4c6b5a80dde98a158ec4d6171f77f6d06d732b2f9afbafbf856cb413ac008b31d356271b3142232f5042e7456e025af871738175ea84673d7869657bd3a1a5e6e314c"}, 0x100, 0x4000000}, 0x1) 16:56:47 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0x0, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:47 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0}, &(0x7f00000001c0)=0xc) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xffffffffffffffff) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") keyctl$get_persistent(0x1d, r1, 0x0) r2 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x5, 0x10000) setsockopt$RDS_GET_MR(r2, 0x114, 0x2, &(0x7f0000000180)={{&(0x7f0000000080)=""/92, 0x5c}, &(0x7f0000000140)}, 0x20) ioctl$TIOCGETD(r2, 0x5424, &(0x7f0000000040)) [ 289.921910] binder: 20650:20657 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1207959552 [ 289.929949] binder: 20650:20657 unknown command 4743953 [ 289.935482] binder: 20650:20657 ioctl c0306201 20000000 returned -22 [ 289.956111] binder: 20650:20657 Acquire 1 refcount change on invalid ref 0 ret -22 [ 289.964337] binder: 20650:20660 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1207959552 16:56:47 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000600000000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 289.972718] binder: 20650:20660 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 289.979895] binder: 20650:20660 unknown command 4743953 [ 289.985313] binder: 20650:20660 ioctl c0306201 20000000 returned -22 16:56:47 executing program 1: r0 = socket$inet6(0xa, 0xe, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") prctl$intptr(0x18, 0x7fff) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000440)='/dev/dsp\x00', 0x8200, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(r1, 0x89e1, &(0x7f00000000c0)={r0}) mknod(&(0x7f0000000040)='./bus\x00', 0xffe, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) r3 = syz_open_dev$dspn(&(0x7f0000000200)='/dev/dsp#\x00', 0x0, 0x200100) getsockopt$bt_BT_VOICE(r3, 0x112, 0xb, &(0x7f0000000240)=0x7, &(0x7f00000003c0)=0x2) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000600)='/dev/vhost-vsock\x00', 0x2, 0x0) r4 = getuid() setsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f00000002c0)={{{@in=@dev={0xac, 0x14, 0x14, 0x18}, @in=@local={0xac, 0x14, 0x14, 0xaa}, 0x4e24, 0x8, 0x4e20, 0xa0ac, 0x2, 0x20, 0xa0, 0x3a, r2, r4}, {0x100, 0x1, 0x8, 0xbad, 0x3f, 0x0, 0x2}, {0xbae3, 0x3, 0x3, 0x20}, 0x98bd, 0x6e6bb6, 0x2, 0x1, 0x3}, {{@in=@remote={0xac, 0x14, 0x14, 0xbb}, 0x4d6}, 0x0, @in=@broadcast=0xffffffff, 0x34ff, 0x2, 0x2, 0x800, 0x4b94f891, 0x1, 0xffffffffffffff01}}, 0xe8) write$FUSE_DIRENT(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="900000000300000000000000090000000000000004000000ffff00e06f7070300000000004000000000000000800000000000000060000005ae0b93f0000087465616d300000000200000000000000e90000000000000009000000000000002f6465762f6473700000000010000000040000000000000002000000000000000000000008"], 0x90) execve(&(0x7f0000000000)='./bus\x00', &(0x7f0000000100), &(0x7f00000002c0)) 16:56:47 executing program 7: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000000000000000000004000000000000000000000000000000000000000000000000000000e9ff0000000000000000000700000000"]) 16:56:47 executing program 6: r0 = open(&(0x7f00000001c0)='./bus\x00', 0x40, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x11, r0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000100)='/dev/snd/midiC#D#\x00', 0xe440, 0x1) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000040)="025cc83d6d345f8f762070") write$cgroup_type(r1, &(0x7f00000000c0)='threaded\x00', 0xff4c) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000000)={0x0, @local, @loopback}, &(0x7f0000000080)=0xc) bind$bt_hci(r0, &(0x7f0000000140)={0x1f, r3}, 0xc) [ 290.087635] FAULT_INJECTION: forcing a failure. [ 290.087635] name failslab, interval 1, probability 0, space 0, times 0 [ 290.099548] CPU: 1 PID: 20673 Comm: syz-executor2 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 290.109003] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 290.118360] Call Trace: [ 290.120959] dump_stack+0x1c9/0x2b4 [ 290.124598] ? dump_stack_print_info.cold.2+0x52/0x52 [ 290.129804] ? mnt_get_count+0x150/0x150 [ 290.133868] should_fail.cold.4+0xa/0x11 16:56:47 executing program 0: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000240)='/proc/self/net/pfkey\x00', 0x20000, 0x0) write$P9_RREAD(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="b5000000750100aa000000cbd03289fc65dcf6c5692a0ffea750d567704de5e002000000bf92893407d2bc987a4cba3e9932db6946b6506ffe63521c710b4f9822930284713de2f7a5b7ac6cbd812f1974a427220ab346a6d5d5f999c97f089b2686431d5c3532782a2f098249b7a10f0fd79601d6118abb15e5e87f4980e5844ebbc9eeeba0ab8ebf3743e97794a78e85b0152404dcfd277c866ffede5941da5806fa9987e4db562c867300000000000000000000"], 0xb5) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) writev(r1, &(0x7f0000000400)=[{&(0x7f0000000380)="8a", 0x1}], 0x1) fgetxattr(r0, &(0x7f0000000040)=@known='system.posix_acl_access\x00', &(0x7f0000000140)=""/64, 0x40) lseek(r0, 0x11, 0x5) [ 290.137939] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 290.143057] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 290.148195] ? bpf_prog_kallsyms_find+0xde/0x4c0 [ 290.152967] ? lock_acquire+0x1e4/0x540 [ 290.156951] ? is_bpf_text_address+0xae/0x170 [ 290.161457] ? lock_downgrade+0x8f0/0x8f0 [ 290.165619] ? lock_release+0xa30/0xa30 [ 290.169607] ? kasan_check_read+0x11/0x20 [ 290.173771] ? lock_acquire+0x1e4/0x540 [ 290.177743] ? fs_reclaim_acquire+0x20/0x20 [ 290.182095] ? lock_downgrade+0x8f0/0x8f0 [ 290.183495] binder: 20682:20687 BC_REQUEST_DEATH_NOTIFICATION invalid ref 6291456 [ 290.186261] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 290.186278] ? check_same_owner+0x340/0x340 [ 290.186292] ? rcu_note_context_switch+0x730/0x730 [ 290.186306] ? iterate_fd+0x4b0/0x4b0 [ 290.186323] __should_failslab+0x124/0x180 [ 290.186341] should_failslab+0x9/0x14 [ 290.186357] kmem_cache_alloc+0x2af/0x760 [ 290.186374] ? lock_downgrade+0x8f0/0x8f0 [ 290.186390] ? shmem_destroy_callback+0xc0/0xc0 [ 290.186401] shmem_alloc_inode+0x1b/0x40 16:56:47 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c40000000000000000007cb00000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 290.186419] alloc_inode+0x63/0x190 [ 290.194755] binder: 20682:20687 unknown command 4743953 [ 290.199038] new_inode_pseudo+0x71/0x1a0 [ 290.199050] ? prune_icache_sb+0x1b0/0x1b0 [ 290.199068] ? _raw_spin_unlock+0x22/0x30 [ 290.199085] new_inode+0x1c/0x40 [ 290.199098] shmem_get_inode+0xf1/0x910 [ 290.199112] ? shmem_encode_fh+0x340/0x340 [ 290.199132] ? lock_downgrade+0x8f0/0x8f0 [ 290.216527] binder: 20682:20687 ioctl c0306201 20000000 returned -22 [ 290.220201] ? lock_release+0xa30/0xa30 [ 290.220216] ? check_same_owner+0x340/0x340 [ 290.220232] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 290.220246] ? __check_object_size+0xa3/0x5d7 [ 290.220266] __shmem_file_setup.part.48+0x83/0x2a0 [ 290.303330] shmem_file_setup+0x65/0x90 [ 290.307292] __x64_sys_memfd_create+0x2af/0x4f0 [ 290.311947] ? memfd_fcntl+0x1e80/0x1e80 [ 290.316012] do_syscall_64+0x1b9/0x820 [ 290.319884] ? finish_task_switch+0x1d3/0x870 [ 290.324363] ? syscall_return_slowpath+0x5e0/0x5e0 [ 290.329280] ? syscall_return_slowpath+0x31d/0x5e0 [ 290.334208] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 290.339222] ? prepare_exit_to_usermode+0x291/0x3b0 [ 290.344226] ? perf_trace_sys_enter+0xb10/0xb10 [ 290.348881] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 290.353713] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 290.358887] RIP: 0033:0x455ab9 [ 290.362057] Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 290.381233] RSP: 002b:00007f088c102a88 EFLAGS: 00000246 ORIG_RAX: 000000000000013f 16:56:47 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000140)="02c0913d6d1b0000002070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)="2e2f6367726f75702e63707500eac5bea7af575a45fddd5af3a7709295a69e7bc5fd0592bf2a4dc8ace908be8842141ca2a714ed0163d4afd8ac48123d4869e05556a93347d6a7430e03a5f2beb186f16bacf2e4dcdcf3b9ff1d99165ce38d996e7798fe471d9a0d81acd08788fcc9892a2487efcde7a649614b14ba1c18", 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.memory_spread_slab\x00', 0x2, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) r4 = socket$l2tp(0x18, 0x1, 0x1) signalfd(r0, &(0x7f0000000180)={0x4}, 0x8) connect$l2tp(r4, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, r3, {0x2, 0x0, @multicast2=0xe0000002}, 0x4}}, 0x2e) r5 = socket$l2tp(0x18, 0x1, 0x1) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x300, 0x0) r7 = socket$inet6(0xa, 0x1000000000002, 0x0) r8 = getpgrp(0x0) write$FUSE_LK(r6, &(0x7f0000000100)={0x28, 0xfffffffffffffff5, 0x8, {{0x2, 0xc83, 0x3, r8}}}, 0x28) sched_getaffinity(r8, 0x8, &(0x7f0000000240)) ioctl(r7, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$KDDISABIO(r6, 0x4b37) connect$l2tp(r5, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast1=0xe0000001}, 0x4, 0x8}}, 0x2e) close(r5) ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000000080)=0x91aa) sendfile(r2, r2, &(0x7f00000000c0), 0x5) [ 290.388926] RAX: ffffffffffffffda RBX: 0000000020000180 RCX: 0000000000455ab9 [ 290.396196] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000004ba6a1 [ 290.403447] RBP: 000000000072bea0 R08: 0000000000000030 R09: 00000000fbad8001 [ 290.410699] R10: 0000000020000180 R11: 0000000000000246 R12: 0000000000000013 [ 290.417965] R13: 00000000004c220d R14: 00000000004d3c90 R15: 0000000000000001 16:56:47 executing program 2 (fault-call:2 fault-nth:2): mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:56:47 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0x0, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:47 executing program 1: r0 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000000)=@broute={'broute\x00', 0x20, 0x2, 0xe78, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200007c0], 0x0, &(0x7f0000000080), &(0x7f00000007c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'veth0_to_team\x00', 'ipddp0\x00', 'bridge_slave_0\x00', "7465616d5f73ff5e76655f30004000", @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @link_local={0x1, 0x80, 0xc2}, [], 0x938, 0xab0, 0xae0, [@among={'among\x00', 0x850, {{0x1, 0x0, 0x0, {[], 0x1, [{[], @dev={0xac, 0x14, 0x14}}]}, {[], 0x3, [{[], @dev={0xac, 0x14, 0x14}}, {[], @local={0xac, 0x14, 0x14, 0xaa}}, {[], @broadcast=0xffffffff}]}}}}, @helper={'helper\x00', 0x28, {{0x0, 'H.245\x00'}}}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{'syz0\x00'}}}, @common=@SECMARK={'SECMARK\x00', 0x108, {{0x0, 0x0, 'system_u:object_r:usb_device_t:s0\x00'}}}]}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'bond_slave_0\x00', 'veth1_to_bridge\x00', 'syz_tun\x00', 'eql\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0xa8, 0x1d8, 0x308, [@mac={'mac\x00', 0x10}]}, [@common=@SECMARK={'SECMARK\x00', 0x108, {{0x0, 0x0, 'system_u:object_r:var_spool_t:s0\x00'}}}]}, @common=@SECMARK={'SECMARK\x00', 0x108, {{0x0, 0x0, 'system_u:object_r:bsdpty_device_t:s0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffc}]}, 0xef0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000140)={{{@in6=@remote, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f0000000240)=0xe8) setsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000000280)={@broadcast=0xffffffff, @remote={0xac, 0x14, 0x14, 0xbb}, r1}, 0xc) 16:56:47 executing program 7: r0 = socket$inet(0x2, 0x0, 0x27) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000000)=0x1, 0x4) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$IP_VS_SO_GET_VERSION(r0, 0x0, 0x480, &(0x7f0000000400), &(0x7f0000000440)=0x40) 16:56:47 executing program 0: r0 = epoll_create(0x143) r1 = epoll_create(0x4) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/backup_only\x00', 0x2, 0x0) fcntl$getownex(r1, 0x10, &(0x7f0000000040)={0x0, 0x0}) ioctl$SNDRV_CTL_IOCTL_ELEM_REPLACE(r2, 0xc1105518, &(0x7f0000000200)={{0x8, 0x7, 0x4, 0xffffffffffff0000, 'syz1\x00', 0x25}, 0x4, 0x10000000, 0x100000001, r3, 0x3, 0x3, 'syz1\x00', &(0x7f0000000080)=['#!\\\x00', '-self:\x00', 'ppp1vboxnet1\x00'], 0x18, [], [0x7, 0x0, 0x4, 0x642]}) r4 = socket$rds(0x15, 0x5, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, 0xffffffffffffffff, &(0x7f000000e000)) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r4, &(0x7f000000d000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000ffa000/0x4000)=nil, 0x4000}}) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f000000dff4)) r5 = epoll_create(0x46c) r6 = epoll_create(0x2e02) move_pages(r3, 0x6, &(0x7f00000000c0)=[&(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil], 0x0, &(0x7f0000000100)=[0x0, 0x0], 0x2) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r4, &(0x7f00000001c0)) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000140)=0x5) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r0, &(0x7f00004d0000)) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r6, &(0x7f0000d5dff4)) [ 290.587652] binder: 20705:20707 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 290.596347] binder: 20705:20707 unknown command 4743953 [ 290.601848] binder: 20705:20707 ioctl c0306201 20000000 returned -22 [ 290.617643] binder: 20705:20707 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 290.626412] binder: 20705:20707 unknown command 4743953 16:56:47 executing program 6: perf_event_open(&(0x7f000001d000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x4) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 16:56:47 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c40000000020dd40000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 290.632251] binder: 20705:20707 ioctl c0306201 20000000 returned -22 16:56:47 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8000008912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r1, &(0x7f0000000000)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) r2 = socket(0xa, 0x1, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000040)={0x2, {{0x2, 0x0, @multicast2=0xe0000002}}}, 0x88) setsockopt$inet_int(r1, 0x0, 0x2, &(0x7f0000000100)=0x8000, 0x4) 16:56:47 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040), 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:48 executing program 1: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x0, 0x0) getsockopt$inet_buf(r1, 0x0, 0x2f, &(0x7f00000000c0)=""/205, &(0x7f00000001c0)=0xcd) ioctl$sock_ifreq(r0, 0x89f2, &(0x7f0000000080)={'eql\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x005\x00', @ifru_settings={0xa06d00}}) [ 290.736146] FAULT_INJECTION: forcing a failure. [ 290.736146] name failslab, interval 1, probability 0, space 0, times 0 [ 290.747459] CPU: 0 PID: 20722 Comm: syz-executor2 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 290.755866] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 290.765210] Call Trace: [ 290.767881] dump_stack+0x1c9/0x2b4 [ 290.771508] ? dump_stack_print_info.cold.2+0x52/0x52 [ 290.776693] should_fail.cold.4+0xa/0x11 [ 290.780744] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 290.785833] ? trace_hardirqs_on+0x10/0x10 [ 290.790056] ? unwind_get_return_address+0x61/0xa0 [ 290.794988] ? __save_stack_trace+0x8d/0xf0 [ 290.799305] ? perf_trace_lock+0x920/0x920 [ 290.803526] ? perf_trace_lock_acquire+0xeb/0x9a0 [ 290.808361] ? kasan_slab_alloc+0x12/0x20 [ 290.812509] ? lock_acquire+0x1e4/0x540 [ 290.816466] ? fs_reclaim_acquire+0x20/0x20 [ 290.820782] ? lock_downgrade+0x8f0/0x8f0 [ 290.824928] ? check_same_owner+0x340/0x340 [ 290.829268] ? rcu_note_context_switch+0x730/0x730 [ 290.834194] __should_failslab+0x124/0x180 [ 290.838415] should_failslab+0x9/0x14 [ 290.842214] kmem_cache_alloc+0x2af/0x760 [ 290.846369] ? lockdep_init_map+0x9/0x10 [ 290.850421] ? __rwlock_init+0x2d/0x140 [ 290.854386] __d_alloc+0xc8/0xd50 [ 290.857828] ? mpol_set_shared_policy+0x9d0/0x9d0 [ 290.862659] ? shrink_dcache_for_umount+0x2b0/0x2b0 [ 290.867662] ? ktime_get_coarse_real_ts64+0x243/0x3a0 [ 290.872852] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 290.878383] ? timespec64_trunc+0xea/0x180 [ 290.882608] ? inode_init_owner+0x340/0x340 [ 290.886927] ? _raw_spin_unlock+0x22/0x30 [ 290.891064] ? current_time+0x131/0x1b0 [ 290.895039] ? timespec64_trunc+0x180/0x180 [ 290.899348] ? __lockdep_init_map+0x105/0x590 [ 290.903846] d_alloc_pseudo+0x1d/0x30 [ 290.907643] alloc_file_pseudo+0x158/0x3f0 [ 290.911861] ? alloc_file+0x3e0/0x3e0 [ 290.915650] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 290.920663] ? __check_object_size+0xa3/0x5d7 [ 290.926360] ? kasan_check_write+0x14/0x20 [ 290.930584] __shmem_file_setup.part.48+0x110/0x2a0 [ 290.935588] shmem_file_setup+0x65/0x90 [ 290.939546] __x64_sys_memfd_create+0x2af/0x4f0 [ 290.944214] ? memfd_fcntl+0x1e80/0x1e80 [ 290.948273] do_syscall_64+0x1b9/0x820 [ 290.952178] ? finish_task_switch+0x1d3/0x870 [ 290.956658] ? syscall_return_slowpath+0x5e0/0x5e0 [ 290.961574] ? syscall_return_slowpath+0x31d/0x5e0 [ 290.966497] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 290.971499] ? prepare_exit_to_usermode+0x291/0x3b0 [ 290.976498] ? perf_trace_sys_enter+0xb10/0xb10 [ 290.981153] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 290.985985] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 290.991186] RIP: 0033:0x455ab9 [ 290.994362] Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 291.013582] RSP: 002b:00007f088c102a88 EFLAGS: 00000246 ORIG_RAX: 000000000000013f [ 291.021279] RAX: ffffffffffffffda RBX: 0000000020000180 RCX: 0000000000455ab9 [ 291.028540] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000004ba6a1 16:56:48 executing program 2 (fault-call:2 fault-nth:3): mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:56:48 executing program 7: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_DEL(r0, 0x0, 0x48f, &(0x7f0000000040)={0x0, @rand_addr, 0x0, 0x0, 'dh\x00', 0xeda23595b0e89424}, 0x2c) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000000)=0xd40a, 0x4) [ 291.035799] RBP: 000000000072bea0 R08: 0000000000000030 R09: 00000000fbad8001 [ 291.043051] R10: 0000000020000180 R11: 0000000000000246 R12: 0000000000000013 [ 291.050302] R13: 00000000004c220d R14: 00000000004d3c90 R15: 0000000000000002 16:56:48 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/ip_tables_matches\x00') getsockopt$SO_COOKIE(r0, 0x1, 0x39, &(0x7f0000000000), &(0x7f0000000040)=0x8) pread64(r0, &(0x7f0000000200), 0x5000000, 0x7) 16:56:48 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000007a00000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 291.223460] binder: 20733:20737 BC_REQUEST_DEATH_NOTIFICATION invalid ref 33554432 [ 291.231279] binder: 20733:20737 unknown command 4743953 [ 291.236861] binder: 20733:20737 ioctl c0306201 20000000 returned -22 16:56:48 executing program 6: bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x884}, 0x3cfd5fe93131e974) bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x9, 0x5, &(0x7f0000346fc8)=ANY=[@ANYBLOB="180299f737ba4f154a7b7beb10ac5b57b9c84530b175"], &(0x7f0000000000)='syzkaller\x00', 0x8001, 0x36e, &(0x7f00001a7f05)=""/251, 0x0, 0x0, [], 0x0, 0xd}, 0x48) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x80000, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000001c0)={0xffffffffffffffff}, 0x106, 0x100b}}, 0x20) bind$netlink(r0, &(0x7f00000004c0)={0x10, 0x0, 0x25dfdbfb, 0x80}, 0xc) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000500)={0x15, 0x16, 0xfa00, {r1, 0x9, 0x0, 0x0, 0x0, @ib={0x1b, 0x10001, 0x3, {"a47d3eb5a9aa1150cc074d134365c0dd"}, 0x8, 0x1, 0x1}, @in6={0xa, 0x4e22, 0x2, @local={0xfe, 0x80, [], 0xaa}, 0x2}}}, 0x118) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000240)={0x15, 0x110, 0xfa00, {r1, 0xb1b7, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x8}, @in6={0xa, 0x4e20, 0x83a9, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}, 0x9}}}, 0x118) getsockopt$llc_int(r0, 0x10c, 0x0, &(0x7f0000000440), &(0x7f0000000400)=0x4) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000080)={{{@in=@dev}}, {{@in=@broadcast}, 0x0, @in=@rand_addr}}, &(0x7f0000000180)=0xe8) 16:56:48 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x200000006, 0x70, 0x2, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x81}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f00000002c0)={0x2, 0x4e20, @rand_addr}, 0x10) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000500)={0xfffffffffffffff9, {{0x2, 0x4e22}}, 0x1, 0x5, [{{0x2, 0x4e23, @loopback=0x7f000001}}, {{0x2, 0x4e21, @multicast1=0xe0000001}}, {{0x2, 0x4e24, @multicast2=0xe0000002}}, {{0x2, 0x4e23, @multicast2=0xe0000002}}, {{0x2, 0x4e22, @local={0xac, 0x14, 0x14, 0xaa}}}]}, 0x310) r2 = socket$inet6(0xa, 0x3, 0x101) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") setsockopt$IP_VS_SO_SET_DEL(r1, 0x0, 0x484, &(0x7f00000000c0)={0xff, @empty, 0x4e23, 0x3, 'nq\x00', 0x33, 0x2, 0x44}, 0x2c) r3 = socket(0x40000000002, 0x3, 0x8) r4 = socket$inet6(0xa, 0x1, 0x0) ioctl(r3, 0x4000008914, &(0x7f0000000100)="295ee1311f16f477671070") getsockopt$IP6T_SO_GET_INFO(r3, 0x29, 0x40, &(0x7f0000000240)={'mangle\x00'}, &(0x7f00000001c0)=0x54) bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x4}, 0x2c) bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f00000008c0)=ANY=[@ANYBLOB="18000000000000000000000000000000000095000000dd76fed83f211907049dd17c718d9b1c62e547f83869c226661ec4b21d77459132e6fc48af7206bb5e7050a07e58fe58dca6ea1b232a1e677d734fc4ea23631eb51746a082c6ffe6c6a32a430045a90d6c552199dd1b3932e86b4089eb426e191d9174aa29c7e8a6e1"], &(0x7f0000f6bffb)='GPL\x00', 0x0, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000380)={{{@in6=@mcast1, @in=@rand_addr}}, {{@in6=@local}, 0x0, @in6=@dev}}, &(0x7f0000000300)=0xe8) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000140)="627269646765300000000000000200", 0x10) readv(r1, &(0x7f0000000080)=[{&(0x7f0000000040)=""/4, 0x4}], 0x1) sendmmsg$unix(r3, &(0x7f0000004840)=[{&(0x7f0000000480)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000001500), 0x0, &(0x7f0000001540)}], 0x1, 0x0) listen(0xffffffffffffffff, 0x0) write$P9_RMKNOD(r0, &(0x7f0000000880)={0x14, 0x13, 0x2, {0x5, 0x0, 0x8}}, 0x14) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) r5 = socket$packet(0x11, 0x3, 0x300) getsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000840), 0x10) sendto$inet(r1, &(0x7f000099bf26), 0x0, 0x20000000, &(0x7f0000000340)={0x2, 0x4e20}, 0x10) sendto$inet(r1, &(0x7f0000000100), 0x229f, 0x4008000, 0x0, 0xb4) sendto$inet(r1, &(0x7f0000000200)="a5", 0x1, 0x4000002, &(0x7f0000000180)={0x2}, 0x10) 16:56:48 executing program 7: r0 = socket$inet(0x2, 0x2, 0x0) getsockopt(r0, 0x20000000000088, 0xb, &(0x7f0000000280)=""/203, &(0x7f0000000000)=0xfffffffffffffd2a) r1 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x3, &(0x7f0000000040)=0x10000, 0x4) 16:56:48 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040), 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:48 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000ac0)=ANY=[@ANYBLOB="bc04000052f2ac73d2843e6888324f2c9875e5670cd6d70b30acf677462fcf1d8361d26f71f8f0a124b0cc2419cfb10a19f6d39b6030c2c7bdb77d12e9f3c0311e4cc66173f4a60a8f554a200ef06d0e1fdd1df71c79b0862e767d34d7857bd45a1033cce3cadc74cd16a4e92c458dffbf587b195e27688a390245e4770a76c529fd98ab59fc40d5979eb63a9abc90f9efa5151228c787908d2f84ea8f3f2dfccf6ff562c92a3eec45c946f5b1ea3ef70cb1e47656cb54e65b746cf5bd402f588e4fd77f7c32caee44b9a4f658af47b69f1ed79c5ce1a82dec1f9f8b434da68acc9a25b4bfe18a014e6f154bc02cf1389e68e7fd36a19e888c940dc0c0de1db3370b16cef2e28d7e2da8ea6a9310760b207e4633c78a36c7a3a8e99d43b5b9f466dacc027193fc90a374461cf4c270441db1f4660e864b203dbae79ddf19cf0df72af72fd0addd1515f9381b3bf773de0781bf77c739d5e4eaee4af2e9616f9d9f688e036c3bac0e5166eb90971d22c2c265f393a5342e249816dfed70aeef1138912da6c5f13bf8afb0362fa2d59f27c842169e0ad1f415c9efa263a1a3a6e3849b2f988d6828cad122508df65d3e728c4e061e86abdbce2ec90ecfc736417db69c8c6fd4794f261c97e2eaf69857e27309fae3815a032cf705a3decb6b944b96ae02ede75f51efd547d9518cb2e9633177d5c5d9cb618dd9a469bc42e7c4a0881c4c90ab2158f868615b5aa4cb93f336a70424371abfba32340a32e80ad983f460a2872aedb714d1ef79bc4a9149bd135232fae3425d32c9329da7b83a2f220ccc259770e87adc31268ae7cf875628af8d19838331e93987117f91486824e2fa38ac867de54afe9c598a7584126905c75df0921401d6f17a149684b518290d028ace983cfec3512aa66ac7e5fc71d2815a833081cecb76bd60117eb0d481ed6a075679413928e2b348d9c18f5eacd47a9983c01be9e8621fa8e5d2b33a15543600d632b5eb973c038928627c59f46d5d81df0cb453e0c2309acbae403d9a5c6483f0acc12ab46eefdf1e5a326991baafb8d326da9eef18b7a756209a1aa680ded1526d92a35b0008c3d6c84f610bc24cc4f7dca4b44d8aa977eeae2941ba203a937e792486cf6042bd0e19478edff047dfed57afa324e73318a2b3f37866205aaa350c94a78918188a1843a88f6573dba01c54d9db88d30a3ce7992f52761477b8b4b969fcdb789aee1abcf2b9457080c640027312c8c823fa2d38bc948594d2821e88dda0aada9a51203bc3ff4b850f7268605264c41641e078a88bd359499a9e38bc77afbc466fcd1631a539f649ae9935f08a096fe47dae75d4f104aec452277bce963cfe7753c01d1786b7bec4bf23e900666e9203d97bdcd234b33a5f911e2e939425c3f5aabf25d4d7f989ee11e1e1413fe91e20454e92dd39c0016fe728c6d02d3b07d944604acae6e57064ef6151e7fe956ddfdc671cab26245bb8b345f963a4bfcef2c0250f50b7a17d918cf5ac4e6cd14281660be520501805e86bd441c8537957c21c886f85750dbc0c6f365f2bc1e3c7829c40c8f27a74e4bc0f3c839c1be00bd04a123146abc2e7a173d65f6cfa90a2e6e07159416f40fc4d055c85dc762c271cfff2da21deb17e1db35a5cc9904b5bb75e041fc54117d0cce75377b7acab7adb8392a9502fdabbedc5cff9fb08ab498c03b90b65a2b2be8133f41410"], &(0x7f00000001c0)=0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x5d, &(0x7f0000000580), 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f0000000000)={0x1, 0x1, 0x0, 0x6}, &(0x7f0000000a80)=0x10) ioctl$KVM_SET_VAPIC_ADDR(r3, 0x4008ae93, &(0x7f0000000080)=0x4) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000013000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000040)="c4e32d7d0b02dff40f22e70f01d165660f3881ab00000000650f01591bc4c3715cd700c4e3314ca9897e0000ba3e0fc76ec88fc9d89ade", 0x37}], 0x1, 0x0, &(0x7f0000000100), 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 16:56:48 executing program 0: r0 = socket$inet6(0xa, 0x80002, 0x0) ioctl(r0, 0xffffffffffffffe4, &(0x7f0000000040)="5fd0c83d6d345f8f762070") setrlimit(0x7, &(0x7f0000a9cff8)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.events\x00', 0x0, 0x0) ioctl$TIOCSBRK(r1, 0x5427) inotify_init() [ 291.362661] FAULT_INJECTION: forcing a failure. [ 291.362661] name failslab, interval 1, probability 0, space 0, times 0 [ 291.373937] CPU: 1 PID: 20764 Comm: syz-executor2 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 291.382345] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 291.392227] Call Trace: [ 291.394852] dump_stack+0x1c9/0x2b4 [ 291.398499] ? dump_stack_print_info.cold.2+0x52/0x52 [ 291.403708] should_fail.cold.4+0xa/0x11 [ 291.407784] ? save_stack+0x43/0xd0 [ 291.411430] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 291.416720] ? __shmem_file_setup.part.48+0x110/0x2a0 [ 291.421923] ? shmem_file_setup+0x65/0x90 [ 291.423426] binder: 20766:20768 BC_REQUEST_DEATH_NOTIFICATION invalid ref 2046820352 [ 291.426078] ? do_syscall_64+0x1b9/0x820 [ 291.426098] ? trace_hardirqs_on+0x10/0x10 [ 291.426112] ? lock_acquire+0x1e4/0x540 [ 291.426130] ? percpu_ref_put_many+0x119/0x240 [ 291.450845] ? lock_downgrade+0x8f0/0x8f0 [ 291.455015] ? lock_release+0xa30/0xa30 [ 291.459006] ? memcg_kmem_get_cache+0x3a9/0x9d0 [ 291.463698] ? mem_cgroup_handle_over_high+0x130/0x130 [ 291.466803] binder: 20766:20768 unknown command 4743953 [ 291.468982] ? fs_reclaim_acquire+0x20/0x20 [ 291.469001] ? lock_downgrade+0x8f0/0x8f0 [ 291.469017] ? do_raw_write_unlock.cold.8+0x49/0x49 [ 291.469040] ? lock_acquire+0x1e4/0x540 [ 291.469052] ? fs_reclaim_acquire+0x20/0x20 [ 291.469070] ? lock_downgrade+0x8f0/0x8f0 [ 291.475744] binder: 20766:20768 ioctl c0306201 20000000 returned -22 [ 291.478735] ? check_same_owner+0x340/0x340 16:56:48 executing program 7: r0 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x2000, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffff9c, 0x84, 0x9, &(0x7f0000000100)={0x0, @in6={{0xa, 0x4e22, 0x5, @local={0xfe, 0x80, [], 0xaa}}}, 0x7ff, 0x5, 0x57, 0xd4}, &(0x7f00000001c0)=0x98) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000280)={r1, 0x68, &(0x7f0000000200)=[@in={0x2, 0x4e20}, @in6={0xa, 0x4e23, 0xfffffffffffffffb, @loopback={0x0, 0x1}, 0xffffffff}, @in6={0xa, 0x4e23, 0x4, @mcast2={0xff, 0x2, [], 0x1}}, @in={0x2, 0x4e23}, @in={0x2, 0x4e24, @broadcast=0xffffffff}]}, &(0x7f00000002c0)=0x10) mprotect(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x4) r2 = socket$inet6(0xa, 0x80003, 0x2b) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xaa}, 0x7}, 0x1c) sendmmsg(r2, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000000500), 0x0, &(0x7f0000000000)}}, {{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000003740)="1bb6e2a674cc41e96fb2d732889138c2ee60a9042c461029ec4d496e55fba6015d08f690135abd7e1b1587c7e380e2cdca595c1e56b1635e6c3f4452d0fc84647fa6afd396794eae98f9b53151048a297d7342967496a01ea897592c9c1cd5faa71d619480fcd6688341f7b631dc0ca2ab25542bc28294faa3ef143b7bbec25610f60aa0f1ca4915111fe50c6ee18d4c71bdd469b2bef2d0653465a018c95edebc20cdd91d955ded39577099e011b882a1389ac990e3479db2f67154b4da2cf2ec5f20643afba767fd19861a63888d1a81646c9042f664d98d72254c94bfea2726fa6ac994a482080a8740282de5e80022e76904bc1f857b2fd041020ef3c5cf9f993c1ff73bfc56812f27796c39f31647fc2739b1e3deef088a423728183af747f99550b7c94489004fba6d0a5207d2943669fe7d5d8986e43a26d7598ef7a247441f1576547ade32191c04cc4efb6ce41d8999e136bc3aa0f2366f2d1c1b098c669e28692064fa5d61056bc04dba9b5019fa60c350e7e9025d6e1129242e37cd03472ccb214be37788fe1ecf3d209ffd1857fb01f653f202276c32bf73495a11521db00e6439adcd5593ee1f66bc9b0c78fd49da57625bf252629a2ae0dc5a08c6c41694917653a763d3dcc8740ad5b0ed08e08438a15b456d62f5da2f98bbf8b198abc5debcebc0b3995868510bb0eb5237d0f8f8224ce8d6238737a87f5f5d6255fcda93a288767b7b9a2a701b19fa19694b8f74ffbdb1fc81556a1abcd1acabba16381eb89ab8e3d1160e13d6ca3b172947ede0e1d9df26d156c073d94f3841113f46ca71b44615d7e15088239859317246786ce0fd0509a918dda7f91623c7c3fd6623202bec7724be0165de0a69356acb6f7a4a5047a6cf5a67664e17a446a90dbb80ce03ff892451920cf1f89129219dde2f80b723bbdbcf1a54a2a046acebee754fa4ecebb859be364a9dc7ce53e89246af82e14527822f0af46064b96d0d7d45b1c0e69dea099476378287805cf18699298c1a42bb9f4e9b8acb1bcbba8ef9abcd4db27b2a7ad1d6677c0a79cd1b4b69b7af211f2554b122c72fc7d1b92c556555e55ba4586f0399ef2a2198f72be6df2130547ee7d02f74566307781b7da34736dcfdd63816e5def8353d36183cfc0d9cf7460cdd2f66d5f93bfcc5a5e1bdeb70e9ec60204ffe3ba874fc37a245cd5ecb46a0858818e5d41658c33196516a8275c2622c2d831552d1be40124a0175e0451228b52fae4dd73c5d2503ff862294b3034a9f0114daad6e39e24d0d45276b4406b33e25617edf8aaf383db13f97f2580db2d040c0a71d15c186bdcf46cd25328a45de222886da5253292d6c7c51b3aaa9df434a93427cc490b17eb3ced0cd2d9bc2430bfb33b8a56f508bc789bda7e40c03a340d96f8cbc2ac83323b68fefffc050dae75d394520c28d5c967d2aafa2657d77b3137418de623c40cf0307acc7b1d8ae07f29ae4764a33e75c0dbf785674d7b851c498a47f2c13f581fc02dbe992216b392df11576b32defcec402dbc988b7faa53698b8e1a9274ffc75d9b50ebcd1c284a786a7bb08d15e8d9e20610154bc1c00224355ef2f53dc9ae1e0de8232745eae82ed2f0fa26aeccd613a9399dfcb0c8745bd60ae06993d2c467303768ce2707057d44e87be71245f4c8cf1ddf94dc81506b2060322086aaff7b804d35613bb7a599d4f162be44e81ccadf1455d76bc02e12aecb95cbd5e9737ebccfdfbf18613a4faa8cbdc34f828c189509c319a4c685c8d3fa99e007aad6468ec279b30bf7e10f4c32e5c70751e122cdf94ebac0933a59483e2e790e04429c3d93284aaa4f9e21d6879431ca94d4c49b86dad4ec2b79b68d1", 0x52d}], 0x1, &(0x7f0000000a80)}}], 0x2, 0x0) [ 291.478753] ? rcu_note_context_switch+0x730/0x730 [ 291.478768] ? kasan_check_read+0x11/0x20 [ 291.478782] __should_failslab+0x124/0x180 [ 291.478796] should_failslab+0x9/0x14 [ 291.478809] kmem_cache_alloc+0x2af/0x760 [ 291.478824] ? _raw_spin_unlock+0x22/0x30 [ 291.478838] ? __d_instantiate+0x522/0x750 [ 291.478854] __get_empty_filp+0x11b/0x620 [ 291.478867] ? d_instantiate+0x79/0xa0 [ 291.478880] ? proc_nr_files+0x60/0x60 [ 291.478896] ? kasan_check_read+0x11/0x20 [ 291.478907] ? do_raw_spin_unlock+0xa7/0x2f0 16:56:48 executing program 0: r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, 0xffffffffffffffff) keyctl$setperm(0x5, r0, 0x80000) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0xc0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) write$FUSE_NOTIFY_STORE(r1, &(0x7f0000000080)=ANY=[], 0x1e) keyctl$join(0x1, &(0x7f00000000c0)={0x73, 0x79, 0x7a, 0x0}) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000080)) keyctl$join(0x1, &(0x7f0000000180)={0x73, 0x79, 0x7a, 0x0}) 16:56:48 executing program 6: r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) getsockopt$nfc_llcp(r1, 0x118, 0x0, &(0x7f0000000000)=""/210, 0x4c) 16:56:48 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000300000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 291.478919] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 291.478937] ? kasan_check_write+0x14/0x20 [ 291.570060] ? do_raw_spin_lock+0xc1/0x200 [ 291.574307] alloc_file+0x29/0x3e0 [ 291.577851] alloc_file_pseudo+0x267/0x3f0 [ 291.582093] ? alloc_file+0x3e0/0x3e0 [ 291.585903] ? check_same_owner+0x340/0x340 [ 291.590233] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 291.595070] IPVS: set_ctl: invalid protocol: 255 0.0.0.0:20003 [ 291.595259] ? __check_object_size+0xa3/0x5d7 [ 291.605699] ? kasan_check_write+0x14/0x20 [ 291.609949] __shmem_file_setup.part.48+0x110/0x2a0 [ 291.614978] shmem_file_setup+0x65/0x90 [ 291.618965] __x64_sys_memfd_create+0x2af/0x4f0 [ 291.623653] ? memfd_fcntl+0x1e80/0x1e80 [ 291.627729] do_syscall_64+0x1b9/0x820 [ 291.631734] ? finish_task_switch+0x1d3/0x870 [ 291.636238] ? syscall_return_slowpath+0x5e0/0x5e0 [ 291.641187] ? syscall_return_slowpath+0x31d/0x5e0 [ 291.646148] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 291.653865] ? prepare_exit_to_usermode+0x291/0x3b0 [ 291.658897] ? perf_trace_sys_enter+0xb10/0xb10 16:56:48 executing program 1: creat(&(0x7f0000000040)='./file0\x00', 0x46) syz_mount_image$ext4(&(0x7f0000000400)='ext4\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f0000000140)=[{&(0x7f0000000280)="0001000000ff000000000000c9030000ec000000010008000000000000000000002000000020000000010000000000006e5fbe5c0000ffff53ef0100010000006e5fbe5a0000c9ca68e30d69e5000000000000010000000000800000002c0000000000008893", 0x66, 0x400}], 0x1, &(0x7f0000000000)) mbind(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8003, &(0x7f00000000c0), 0x0, 0x4) pipe2(&(0x7f0000000080), 0x80000) [ 291.663580] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 291.668447] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 291.673638] RIP: 0033:0x455ab9 [ 291.676828] Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 291.696074] RSP: 002b:00007f088c102a88 EFLAGS: 00000246 ORIG_RAX: 000000000000013f [ 291.703792] RAX: ffffffffffffffda RBX: 0000000020000180 RCX: 0000000000455ab9 [ 291.711505] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000004ba6a1 [ 291.718782] RBP: 000000000072bea0 R08: 0000000000000030 R09: 00000000fbad8001 [ 291.726062] R10: 0000000020000180 R11: 0000000000000246 R12: 0000000000000013 [ 291.733340] R13: 00000000004c220d R14: 00000000004d3c90 R15: 0000000000000003 [ 291.746772] binder: 20801:20805 BC_REQUEST_DEATH_NOTIFICATION invalid ref 50331648 16:56:49 executing program 6: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x20000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = syz_open_dev$dmmidi(&(0x7f0000000140)='/dev/dmmidi#\x00', 0x3, 0x1) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r3, 0x84, 0x15, &(0x7f0000000040)={0xe95}, 0x1) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@textreal={0x8, &(0x7f00000000c0)="f20f94ff0f01cf0fc72f6436f0f79b450066b9800000c00f326635000100000f3066b91a09000066b8fdafa70566ba000000000f30650fc7a900700f01cf642e3e0f005a0fb800098ee0", 0x4a}], 0x104, 0x5e, &(0x7f0000000100), 0x0) r4 = add_key(&(0x7f00000002c0)='asymmetric\x00', &(0x7f0000000300)={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000000340)="6d1bfe9cf0b7dfbe4f01f0b8e3392599deb3373ca1505e2c2450b9fd0e4c0260b13baebdd102752e0b10b3dba24ced1fe41882d4ef596456bbfa30c9902fdd125cb097a55a0092c960acae61057afa2670ff8f7b35215e9f1eff3cf3288eadade72e03159c4b6dd10d68059987c5248821adca6e61affade8f0f0b7eccf87b8d6f7089ed0092fb1286dbf1", 0x8b, 0xffffffffffffffff) r5 = request_key(&(0x7f00000004c0)='cifs.idmap\x00', &(0x7f0000000500)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000000540)='wlan0selinux\x00', 0xfffffffffffffffa) keyctl$instantiate(0xc, r4, &(0x7f0000000400)="ec0dcc694dc2d382c63206c760bbef2d6f89ebc42218beef748ef6ede62ca2050ac2e0a417111a495501a513daf4824138ad6cb424db144350be89198ff083e88f76a0f0659bbe945864c9a56a331cfb99b3a91df3c6d6c111c2a9c7be9ca832413c1435573ce8306ee382c95a1563ddc40804a6a8186c0f4c54708bc1a2b2841579800f0a97", 0x86, r5) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000200)=ANY=[]) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) r6 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f0000000080)={0x2, 0x0, 0x8000, 0x0, 0x2, 0x6, 0x7fff, 0x100000000, 0x0}, &(0x7f00000001c0)=0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r6, 0x84, 0x18, &(0x7f0000000200)={r7, 0xffffffffffffeba7}, &(0x7f0000000240)=0x8) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) 16:56:49 executing program 2 (fault-call:2 fault-nth:4): mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:56:49 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040), 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:49 executing program 0: r0 = socket$inet6(0xa, 0x80803, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000003fe8)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000013e95), 0x4) getsockopt$inet_sctp_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f0000000240), &(0x7f0000000280)=0x14) sendmsg$TEAM_CMD_OPTIONS_GET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000080)={0x10}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[]}, 0x1}, 0x0) close(r2) close(r1) 16:56:49 executing program 7: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000002680)={0xb, 0xc, 0xfff, 0x80000000006, 0x1}, 0x2c) sendmsg$rds(r0, &(0x7f0000002780)={&(0x7f0000000240)={0x2, 0x4e21, @multicast1=0xe0000001}, 0x10, &(0x7f00000026c0)=[{&(0x7f0000000280)=""/26, 0x1a}, {&(0x7f0000000300)=""/36, 0x24}, {&(0x7f0000000340)=""/13, 0xd}, {&(0x7f0000000380)=""/242, 0xf2}, {&(0x7f0000000480)=""/4096, 0x1000}, {&(0x7f0000001480)=""/4096, 0x1000}, {&(0x7f0000002480)=""/173, 0xad}, {&(0x7f0000002540)=""/248, 0xf8}, {&(0x7f0000002640)=""/2, 0x2}], 0x9, 0x0, 0x0, 0x1}, 0x8000) r1 = socket$inet(0x2, 0x5, 0xcc85) setsockopt$IP_VS_SO_SET_DELDEST(r1, 0x0, 0x488, &(0x7f0000000080)={{0xaf, @remote={0xac, 0x14, 0x14, 0xbb}, 0x4e20, 0x1, 'dh\x00', 0x0, 0x0, 0x65}, {@broadcast=0xffffffff, 0x4e21, 0x2000, 0x36f70e1a, 0x10000, 0x6}}, 0x44) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/net/pfkey\x00', 0x28100, 0x0) write$P9_ROPEN(r2, &(0x7f0000000200)={0x18, 0x71, 0x1, {{0x41, 0x4, 0x5}, 0xfffffffffffffff8}}, 0x18) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000000)={r0, &(0x7f0000000000), &(0x7f0000000100)=""/19}, 0x1a1) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r0, &(0x7f0000000040), &(0x7f0000000140)}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000140)={r0, &(0x7f0000002980)="4bd68abd00b9", &(0x7f0000000040)=""/5}, 0xfffffd1b) r3 = semget(0x0, 0x1, 0x104) semctl$GETNCNT(r3, 0x3, 0xe, &(0x7f0000002840)=""/99) getsockopt$bt_hci(r1, 0x0, 0x3, &(0x7f00000027c0)=""/14, &(0x7f0000002800)=0xe) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)={0x1b, 0xfe4, 0x9, 0x3f4, 0x10, r2, 0x200}, 0x2c) 16:56:49 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000500000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 291.767839] binder: 20801:20805 unknown command 4743953 [ 291.774761] binder: 20801:20805 ioctl c0306201 20000000 returned -22 [ 291.910340] binder: 20822:20828 BC_REQUEST_DEATH_NOTIFICATION invalid ref 83886080 [ 291.920304] binder: 20822:20828 unknown command 4743953 [ 291.927128] binder: 20822:20828 ioctl c0306201 20000000 returned -22 [ 291.974274] FAULT_INJECTION: forcing a failure. [ 291.974274] name failslab, interval 1, probability 0, space 0, times 0 [ 291.985634] CPU: 1 PID: 20835 Comm: syz-executor2 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 291.994054] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 292.003413] Call Trace: [ 292.006363] dump_stack+0x1c9/0x2b4 [ 292.010006] ? dump_stack_print_info.cold.2+0x52/0x52 [ 292.015206] ? lock_release+0xa30/0xa30 [ 292.019190] should_fail.cold.4+0xa/0x11 [ 292.023692] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 292.028800] ? lock_acquire+0x1e4/0x540 [ 292.032787] ? shmem_setattr+0x50e/0xda0 [ 292.036893] ? lock_downgrade+0x8f0/0x8f0 [ 292.041067] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 292.046617] ? timespec64_trunc+0xea/0x180 [ 292.050865] ? inode_init_owner+0x340/0x340 [ 292.055202] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 292.060736] ? fsnotify+0xbac/0x14e0 [ 292.064457] ? lock_acquire+0x1e4/0x540 [ 292.068438] ? fs_reclaim_acquire+0x20/0x20 [ 292.072757] ? lock_downgrade+0x8f0/0x8f0 [ 292.076892] ? check_same_owner+0x340/0x340 [ 292.081199] ? rcu_note_context_switch+0x730/0x730 [ 292.086117] ? notify_change+0xda7/0x10f0 [ 292.090720] __should_failslab+0x124/0x180 [ 292.094945] should_failslab+0x9/0x14 [ 292.098741] kmem_cache_alloc+0x2af/0x760 [ 292.102873] ? do_sys_ftruncate+0x42d/0x560 [ 292.107196] ? lock_downgrade+0x8f0/0x8f0 [ 292.111342] getname_flags+0xd0/0x5a0 [ 292.115136] getname+0x19/0x20 [ 292.118322] do_sys_open+0x3a2/0x720 [ 292.122033] ? filp_open+0x80/0x80 [ 292.125561] ? do_sys_ftruncate+0x44e/0x560 [ 292.129865] __x64_sys_open+0x7e/0xc0 [ 292.133649] do_syscall_64+0x1b9/0x820 [ 292.137521] ? syscall_return_slowpath+0x5e0/0x5e0 [ 292.142432] ? syscall_return_slowpath+0x31d/0x5e0 [ 292.147349] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 292.152363] ? prepare_exit_to_usermode+0x291/0x3b0 [ 292.157369] ? perf_trace_sys_enter+0xb10/0xb10 [ 292.162040] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 292.166887] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 292.172068] RIP: 0033:0x40fd11 [ 292.175235] Code: 75 14 b8 02 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 b4 17 00 00 c3 48 83 ec 08 e8 8a fa ff ff 48 89 04 24 b8 02 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 d3 fa ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 292.194379] RSP: 002b:00007f088c102a80 EFLAGS: 00000293 ORIG_RAX: 0000000000000002 [ 292.202088] RAX: ffffffffffffffda RBX: 0000000020000190 RCX: 000000000040fd11 [ 292.209347] RDX: 00007f088c102afa RSI: 0000000000000002 RDI: 00007f088c102af0 [ 292.216607] RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000000a [ 292.224038] R10: 0000000000000075 R11: 0000000000000293 R12: 0000000000000014 [ 292.231306] R13: 0000000000000000 R14: 00000000004d3c90 R15: 0000000000000004 [ 292.432506] IPVS: set_ctl: invalid protocol: 255 0.0.0.0:20003 16:56:49 executing program 4: r0 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x3, 0x8000) ioctl$TUNGETSNDBUF(r0, 0x800454d3, &(0x7f0000000040)) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000fc7000)={0x5, 0x57, 0x4000000000080, 0x2, 0x1}, 0x2c) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000080)={0x1, 0x0, 0x2, 0x5, '\x00', 0x3}) r2 = socket$inet6(0xa, 0x806, 0x0) sendmsg$nfc_llcp(r0, &(0x7f0000000500)={&(0x7f0000000140)={0x27, 0x1, 0x2, 0x0, 0x9, 0x8, "b03a61a939da1aaf24055628bd14a8a38df411c69e8bb3d82c2815ddca3715aca68cae140e404f33ba702c90e4ff64bcde714125b75dda9794c50ef40048e0", 0x34}, 0x60, &(0x7f0000000400)=[{&(0x7f00000001c0)="bb4a12c12ddbb44e81bb960726081702a046bf568585da27017949a8d6b99e5c9c30b4fb7614bc898a70254e61e650c63724e055a1fcb9eaaadf44fa6882ebb5a93e403df3058c6a891ef94316cbdf80c1af2d5f90671d76629a384335c9b0f98d6329f55c332618be63c7b2cd2ccc1bb577396871592ec7d4012328", 0x7c}, {&(0x7f0000000240)="4f701d33af06a8e305335b04f705483bff97af4dafc79f45e42094c5a24d64f9c0ae5c424310092864cbad07788d853cae4991d82c2c40ce69971b0875a9526526cbb0910fe850fa11ff1f648e289834c2f95e", 0x53}, {&(0x7f00000000c0)}, {&(0x7f00000002c0)="c418f833a8012294b5c83f8558030068129c91a1e5fb712aa3038bcccd3232697e1f450f60246f2630654117ac5a7d2c1041adf579f87069f0c1a551bec46886fa91633a71c862af9d17166502304d7ec5a7f32e06161b2547473a79fe16fcdaae7d7fb0f18fea017f5d96576a0b977725acbfa6084f959be6dbea0d86e52a581730abd10692490800ef439e77c673ff122e1d5c293e628736", 0x99}, {&(0x7f0000000380)="07f9b84b8e394f6061ecf5cf2b4b46a373ec20a47eb799a00b2e881218a9038259897439f1ea511f51ec78a22f0f24a6791917d10d8599da6e0dba405f7c4cae8eebfb611bba8dbe984af38cdb56b5d18e95771f396fc36b19", 0x59}], 0x5, &(0x7f0000000480)={0x60, 0x0, 0x2, "05ba32f5e7e5f1f217984dcd230f911ad5e7ccc9aed9ff0712345264947d56978609746c5fe98718892596b45c2ffa0c31845c320138fd11720fee8ec730aa13494f9ba6f1e85722314a84"}, 0x60, 0x800}, 0x40000) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000fcb000)={r1, &(0x7f0000fcbfff)='X', &(0x7f0000172000)}, 0x20) bpf$MAP_UPDATE_ELEM(0x4, &(0x7f000051e000)={r1, &(0x7f0000fc5000), &(0x7f0000950000)}, 0x20) 16:56:49 executing program 1: socketpair(0x11, 0xa, 0x2, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x2, 0x17, 0x7, 0x10, "23adbe375905913b078b4ac3f04b3bff1b26b3ff635b46ac7ea9485200026e96d4375e16b777794fe361fea55d8e9e5fde1ab001da81c609745913e2d9b47348", "533b3579b079be1890442379980a14b42c05f4164828685685394d6909b830f3", [0x4, 0x896]}) sched_setattr(0x0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x1}, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x1, 0x8000) ioctl$sock_inet_udp_SIOCOUTQ(r1, 0x5411, &(0x7f00000000c0)) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) readv(r2, &(0x7f0000dcdff0)=[{&(0x7f0000cd8000)=""/1, 0x1}], 0x1) ioctl$sock_inet_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000200)) ioctl$TCSETSF(r2, 0x5412, &(0x7f0000000080)) 16:56:49 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:49 executing program 7: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'xcbc(camellia)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x10) r1 = accept$alg(r0, 0x0, 0x0) r2 = accept4(r1, 0x0, &(0x7f0000000080), 0x0) sendmmsg(r2, &(0x7f0000001b00)=[{{&(0x7f0000001640)=@hci={0x1f}, 0x80, &(0x7f0000001a80)=[{&(0x7f0000001980)="32ec300c5df63e3242d635250dede6bfdaa12cdd02db72b0f44ce1362088b949e4", 0x21}], 0x1}}], 0x1, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000140)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@dev}}, &(0x7f00000000c0)=0xe8) ioctl$sock_inet6_SIOCADDRT(r2, 0x890b, &(0x7f0000000240)={@mcast1={0xff, 0x1, [], 0x1}, @local={0xfe, 0x80, [], 0xaa}, @loopback={0x0, 0x1}, 0x0, 0x4, 0x9, 0x0, 0x80, 0x1080080, r3}) 16:56:49 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000600000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:49 executing program 6: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) mmap(&(0x7f0000012000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000001fe8)={0xaa}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x20000, 0x0) setsockopt$inet_udp_int(r2, 0x11, 0x6f, &(0x7f0000000080)=0x1ff, 0x4) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000019000)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) openat(r2, &(0x7f00000000c0)='./file0\x00', 0x100, 0x28) 16:56:49 executing program 2 (fault-call:2 fault-nth:5): mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:56:49 executing program 7: sched_setattr(0x0, &(0x7f0000000040)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) getsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000080), &(0x7f00000000c0)=0x8) read(r0, &(0x7f0000000200)=""/250, 0x50c7e3e3) write$binfmt_elf64(r1, &(0x7f0000000340)=ANY=[@ANYBLOB="7f454c46000000010000000000000000000007000000000000000000000000004000000000000000000000000000000000000000000038000100000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x178) ioctl$TIOCMSET(r1, 0x5418, &(0x7f0000000000)=0x424e) 16:56:49 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket(0x10, 0x80002, 0x0) r2 = accept$unix(r1, &(0x7f00000000c0)=@abs, &(0x7f0000000140)=0x6e) bind$netlink(r1, &(0x7f0000177ff4)={0x10, 0x0, 0x1}, 0xc) write(r1, &(0x7f0000df8fd9)="2600000022004701050000000000000005006d20002b1f00c05d080a4a51f10101c7033400b0", 0x26) connect$netlink(r1, &(0x7f0000e8f000)=@proc={0x10, 0x0, 0x1}, 0xc) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000b4bffc), 0x4) r3 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x400, 0x1) ioctl$RNDADDTOENTCNT(r3, 0x40045201, &(0x7f0000000040)) sendto(r1, &(0x7f0000000000), 0x0, 0x0, 0x0, 0x0) sendto$unix(r2, &(0x7f0000000180)="ce8a4debe6b62eb27778b9bfad01450f8802ac5dbef8660a476df143d6cb84f89a26b74e411393c331ffb387bec2968c28fddc2617fdccb177cde30d372ac699bfe9cceefc7a1209de25e234dec3ccc57cadc9ee57db453d37716766fe6841f42639dad97f1f6389e2c719fe697e316dee1f2e5014cf8ff4", 0x78, 0x0, &(0x7f0000000200)=@file={0x1, './file0\x00'}, 0x6e) r4 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={&(0x7f0000000040), &(0x7f0000000140)}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r4, 0x1000000000016) recvmsg(r1, &(0x7f00005b5000)={&(0x7f0000000000)=ANY=[], 0x0, &(0x7f000094f000), 0x0, &(0x7f0000546000)=""/145, 0x91}, 0x0) [ 292.663831] FAULT_INJECTION: forcing a failure. [ 292.663831] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 292.675687] CPU: 0 PID: 20854 Comm: syz-executor2 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 292.684097] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 292.693451] Call Trace: [ 292.696050] dump_stack+0x1c9/0x2b4 [ 292.699676] ? dump_stack_print_info.cold.2+0x52/0x52 [ 292.704868] ? trace_hardirqs_on+0x10/0x10 [ 292.709111] should_fail.cold.4+0xa/0x11 [ 292.713166] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 292.719225] ? save_stack+0xa9/0xd0 [ 292.722932] ? __get_empty_filp+0x11b/0x620 [ 292.727254] ? alloc_file+0x29/0x3e0 [ 292.730951] ? alloc_file_pseudo+0x267/0x3f0 [ 292.735342] ? trace_hardirqs_on+0x10/0x10 [ 292.739571] ? bpf_prog_kallsyms_find+0xde/0x4c0 [ 292.744319] ? lock_acquire+0x1e4/0x540 [ 292.748288] ? is_bpf_text_address+0xae/0x170 [ 292.752767] ? lock_downgrade+0x8f0/0x8f0 [ 292.756916] ? lock_release+0xa30/0xa30 [ 292.760976] ? kasan_check_read+0x11/0x20 [ 292.765114] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 292.770645] ? should_fail+0x246/0xd86 [ 292.774517] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 292.779603] __alloc_pages_nodemask+0x36e/0xdb0 [ 292.784256] ? lock_downgrade+0x8f0/0x8f0 [ 292.788389] ? __alloc_pages_slowpath+0x2d00/0x2d00 [ 292.793392] ? timespec64_trunc+0xea/0x180 [ 292.797613] ? inode_init_owner+0x340/0x340 [ 292.801946] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 292.807491] ? fsnotify+0xbac/0x14e0 [ 292.811194] ? lock_acquire+0x1e4/0x540 [ 292.815166] ? fs_reclaim_acquire+0x20/0x20 [ 292.819499] ? lock_downgrade+0x8f0/0x8f0 [ 292.823645] ? lock_release+0xa30/0xa30 [ 292.827607] ? check_same_owner+0x340/0x340 [ 292.831911] cache_grow_begin+0x91/0x710 [ 292.835970] kmem_cache_alloc+0x689/0x760 [ 292.840111] ? do_sys_ftruncate+0x42d/0x560 [ 292.844426] ? lock_downgrade+0x8f0/0x8f0 [ 292.848578] getname_flags+0xd0/0x5a0 [ 292.852369] getname+0x19/0x20 [ 292.855543] do_sys_open+0x3a2/0x720 [ 292.859237] ? filp_open+0x80/0x80 [ 292.862770] ? do_sys_ftruncate+0x44e/0x560 [ 292.867088] __x64_sys_open+0x7e/0xc0 [ 292.870873] do_syscall_64+0x1b9/0x820 [ 292.874751] ? finish_task_switch+0x1d3/0x870 [ 292.879249] ? syscall_return_slowpath+0x5e0/0x5e0 [ 292.884193] ? syscall_return_slowpath+0x31d/0x5e0 [ 292.889119] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 292.894122] ? prepare_exit_to_usermode+0x291/0x3b0 [ 292.899122] ? perf_trace_sys_enter+0xb10/0xb10 [ 292.903785] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 292.908617] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 292.913788] RIP: 0033:0x40fd11 [ 292.916956] Code: 75 14 b8 02 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 b4 17 00 00 c3 48 83 ec 08 e8 8a fa ff ff 48 89 04 24 b8 02 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 d3 fa ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 292.936173] RSP: 002b:00007f088c102a80 EFLAGS: 00000293 ORIG_RAX: 0000000000000002 [ 292.943870] RAX: ffffffffffffffda RBX: 0000000020000190 RCX: 000000000040fd11 [ 292.951130] RDX: 00007f088c102afa RSI: 0000000000000002 RDI: 00007f088c102af0 [ 292.958389] RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000000a [ 292.965639] R10: 0000000000000075 R11: 0000000000000293 R12: 0000000000000014 [ 292.972904] R13: 0000000000000000 R14: 00000000004d3c90 R15: 0000000000000005 [ 292.982559] binder: 20850:20856 BC_REQUEST_DEATH_NOTIFICATION invalid ref 100663296 [ 292.983788] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 292.997671] binder: 20850:20856 unknown command 4743953 16:56:50 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:50 executing program 2 (fault-call:2 fault-nth:6): mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:56:50 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000700000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:50 executing program 1: r0 = socket$unix(0x1, 0x5, 0x0) bind$unix(r0, &(0x7f0000000480)=@file={0x1, './file0\x00'}, 0x6e) listen(r0, 0x0) removexattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)=@random={'system.', '\x00'}) pipe2$9p(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x0, &(0x7f0000000180)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c}) accept4$unix(r0, &(0x7f0000000000), &(0x7f0000000080)=0x6e, 0x0) r2 = msgget$private(0x0, 0x200) msgctl$IPC_STAT(r2, 0x2, &(0x7f0000000240)=""/119) shutdown(r0, 0x0) 16:56:50 executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000080)=@assoc_value={0x0, 0x1bc}, 0x8) getsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000000)=@assoc_id=0x0, &(0x7f0000000040)=0x4) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, r1}, &(0x7f0000000240)=0x10) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0x4040, 0x0) ioctl$VT_GETSTATE(r2, 0x5603, &(0x7f0000000100)={0xdb6, 0x42f0, 0x68a}) [ 293.009310] binder: 20850:20856 ioctl c0306201 20000000 returned -22 [ 293.024946] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue 16:56:50 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000003c0)="0000a78d6e4bc40ff1") fcntl$getflags(r0, 0x405) ioctl$KVM_SET_LAPIC(r0, 0x4400ae8f, &(0x7f0000000400)={"aaa58efafc3f6b5cf1f2164747db17f25c665e0be05822988da106dd42526296341f4713060d66b167670db85120028f8a5ecd4cf8da393096a6d2141c2593ab89bcf52e5f4bc3d9d1873b57b67c127ec75342c2a037a144805029f095035eadc09ac6683f7e54da3d4b308f6d0e8fe655a678a7392bfbfc75a751f00a0f76d911b7e0579541d24c225ffdc1b8a7716a48c8fde9796737976c3c10f7e90f67c3bbab5df4e8c06650ecdcf73a5398e57c70bf59b91bcbec5e747c4d6c0cf400c0d6c167a0af6e3f196662159dc5d3df46345c274dffeef34e0aaea764d735ba3f5940936343609ac655767fba660d7dfe1c64a180479527d1c75a6fcb1cb6a2fa9c427b480c202513337b4e44c95f0047cfddd7f8781b857abc15613d77ad1c2e9eb6e48a1c21061712851170cd04f7b455f888ce0d9771a1222fcabd5568366891baab4c119fcd6836adc1f75c63600caa9fb9d0ddddca73ca60713cd7131269e8d3ebb9e74df7474dcfe5c4d770ed6b33a6c41e7f6f2a26e0cf9438905d512e5d1c1978b967485825b30ad82619687ed3ca026f90e4a23438172f280cff4be457686c7ba0130842c5f54e29a0ec91c14c2fe54ede39dfb83c657e264a783f5e958890673eb4a65b6b2fbcace858a38facd223825a3c2dd7645aeef0f37aa46edbac7b60bcc2590d36c944675a7ebdb695a5454d9638487fb8488e180833318d8f3639894d104301d1cf6ca31e804b205133c885bc797f0f9a4b0473db7dbb3042dc0e5c54ab1dbe77ce88712b06744cd9b2003426c313ee6f35b75cf46deaa25d3d7b05fdacb6c9ee5996b820caac75e470b52fe084ed4e4550d21d6dd7650ab1399ab5104839bb65e1a7b817ee056ed047decc1209e585e953ac27163907228b7bb9ca2ce520918eee87e65893ecdb8c2b691253f397dffef7c826feb9c4f23ac8f862ba53be73bb746fe5a41e7e1338992a0db342578892eee6e42dfe99525b129724cd33131c046cf4ec34da5f94040e2fc9923ab11b02bd1fc6bc5f31b4478c29b9c42d884f37611ba79864e5ec37d895f5c8f35ac64947c02d77c2417861f2992d0dfd88355caf83e2b1eeb0a24ce8ef5554396eb87d1e3b79981f4122e1b8d377f3fb93e671b0e8ca47bbc3f08c69290e4b48f9276c1f3260a6e545ce8d6c164395c0896965eef01d69726b0606ffbec29b247d7e235e25b26fc2c548b85fb8c250069721c994959c7c6d1f35e8893112d095c2f6d1c71e1f66331da425b5d2fbee1921f70afac47a2c0eee5c1b1349c7629d8743c059acdc4e8ffb7e9538777ab2215cce8cbfef24895ec56e92f399d63f85c789d32db046f9b78866e62353125aab8aa45878b3be541a6acdf820311793f75af4ec99a584498608bcb11e87e931db92d6cf0c9645df25dd057e4afcba9d6662c167678a28a6e3493d"}) 16:56:50 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(0xffffffffffffffff, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 293.263181] binder: 20882:20892 BC_REQUEST_DEATH_NOTIFICATION invalid ref 117440512 [ 293.274891] sctp: [Deprecated]: syz-executor0 (pid 20893) Use of int in maxseg socket option. [ 293.274891] Use struct sctp_assoc_value instead [ 293.277247] binder: 20882:20892 unknown command 4743953 [ 293.294546] binder: 20882:20892 ioctl c0306201 20000000 returned -22 [ 293.297332] sctp: [Deprecated]: syz-executor0 (pid 20895) Use of int in maxseg socket option. 16:56:50 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000050000000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 293.297332] Use struct sctp_assoc_value instead [ 293.317399] FAULT_INJECTION: forcing a failure. [ 293.317399] name failslab, interval 1, probability 0, space 0, times 0 [ 293.328673] CPU: 1 PID: 20894 Comm: syz-executor2 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 293.337083] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 293.346434] Call Trace: [ 293.349022] dump_stack+0x1c9/0x2b4 [ 293.352654] ? dump_stack_print_info.cold.2+0x52/0x52 [ 293.357849] ? xas_descend+0x20c/0x5f0 [ 293.361750] should_fail.cold.4+0xa/0x11 [ 293.365830] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 293.370947] ? trace_hardirqs_on+0x10/0x10 [ 293.375203] ? alloc_set_pte+0xaf6/0x1790 [ 293.379370] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 293.384411] ? trace_hardirqs_on+0x10/0x10 [ 293.388665] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 293.393772] ? bpf_prog_kallsyms_find+0xde/0x4c0 [ 293.398546] ? lock_acquire+0x1e4/0x540 [ 293.402534] ? fs_reclaim_acquire+0x20/0x20 16:56:50 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000000000006000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 293.402954] binder: 20903:20904 BC_REQUEST_DEATH_NOTIFICATION invalid ref 327680 [ 293.406865] ? lock_downgrade+0x8f0/0x8f0 [ 293.406886] ? check_same_owner+0x340/0x340 [ 293.406906] ? rcu_is_watching+0x8c/0x150 [ 293.406920] ? rcu_note_context_switch+0x730/0x730 [ 293.406938] __should_failslab+0x124/0x180 [ 293.414760] binder: 20903:20904 unknown command 4743953 [ 293.418613] should_failslab+0x9/0x14 [ 293.418632] kmem_cache_alloc+0x2af/0x760 [ 293.418655] __get_empty_filp+0x11b/0x620 [ 293.418670] ? proc_nr_files+0x60/0x60 [ 293.418691] ? lock_acquire+0x1e4/0x540 [ 293.424089] binder: 20903:20904 ioctl c0306201 20000000 returned -22 [ 293.427126] ? is_bpf_text_address+0xae/0x170 [ 293.427143] ? lock_downgrade+0x8f0/0x8f0 [ 293.427159] ? lock_release+0xa30/0xa30 [ 293.427178] path_openat+0x110/0x5430 [ 293.427195] ? rcu_cleanup_dead_rnp+0x200/0x200 [ 293.427207] ? is_bpf_text_address+0xd7/0x170 [ 293.427221] ? kernel_text_address+0x79/0xf0 [ 293.427237] ? path_lookupat.isra.45+0xbf0/0xbf0 [ 293.427252] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 293.427266] ? expand_files.part.8+0x571/0x9c0 16:56:50 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000000000000100000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 293.427277] ? iterate_fd+0x4b0/0x4b0 [ 293.427290] ? lock_acquire+0x1e4/0x540 [ 293.427306] ? __alloc_fd+0x34e/0x710 [ 293.502180] binder: 20906:20907 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 293.503368] ? lock_downgrade+0x8f0/0x8f0 [ 293.503381] ? do_sys_open+0x3a2/0x720 [ 293.503400] ? kasan_check_read+0x11/0x20 [ 293.503412] ? do_raw_spin_unlock+0xa7/0x2f0 [ 293.503429] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 293.508471] binder: 20906:20907 unknown command 4743953 [ 293.513013] ? kasan_check_write+0x14/0x20 [ 293.513026] ? do_raw_spin_lock+0xc1/0x200 [ 293.513046] ? _raw_spin_unlock+0x22/0x30 [ 293.517561] binder: 20906:20907 ioctl c0306201 20000000 returned -22 [ 293.520781] ? __alloc_fd+0x34e/0x710 [ 293.520796] ? usercopy_warn+0x120/0x120 [ 293.520817] do_filp_open+0x255/0x380 [ 293.520833] ? may_open_dev+0x100/0x100 [ 293.520850] ? get_unused_fd_flags+0x122/0x1a0 [ 293.520860] ? __alloc_fd+0x710/0x710 [ 293.520874] do_sys_open+0x584/0x720 [ 293.520886] ? filp_open+0x80/0x80 [ 293.520901] ? do_sys_ftruncate+0x44e/0x560 16:56:50 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000000000006800000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 293.520913] __x64_sys_open+0x7e/0xc0 [ 293.520926] do_syscall_64+0x1b9/0x820 [ 293.520943] ? finish_task_switch+0x1d3/0x870 [ 293.609913] binder: 20909:20910 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 293.614182] ? syscall_return_slowpath+0x5e0/0x5e0 [ 293.614199] ? syscall_return_slowpath+0x31d/0x5e0 [ 293.614215] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 293.614229] ? prepare_exit_to_usermode+0x291/0x3b0 [ 293.614247] ? perf_trace_sys_enter+0xb10/0xb10 [ 293.618050] binder: 20909:20910 unknown command 4743953 [ 293.621913] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 293.621931] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 293.621946] RIP: 0033:0x40fd11 [ 293.627173] binder: 20909:20910 ioctl c0306201 20000000 returned -22 [ 293.634980] Code: 75 14 b8 02 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 b4 17 00 00 c3 48 83 ec 08 e8 8a fa ff ff 48 89 04 24 b8 02 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 d3 fa ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 293.635179] RSP: 002b:00007f088c102a80 EFLAGS: 00000293 ORIG_RAX: 0000000000000002 16:56:51 executing program 4: r0 = socket$inet_sctp(0x2, 0x5, 0x84) sendmmsg$inet_sctp(r0, &(0x7f0000004d40)=[{&(0x7f0000000080)=@in6={0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xaa}}, 0x1c, &(0x7f0000000240), 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="30000000000000008400000001000f50e6a40000000000000000000000000000000000000000000000000000", @ANYRES32=0x0, @ANYBLOB="3000000000000000840000000100000000000000008000000000000000000000000000000000000000000000", @ANYRES32=0x0], 0x60}], 0x1, 0x0) 16:56:51 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) socketpair$inet_sctp(0x2, 0x1, 0x84, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f00000000c0)={0x0, 0x1, 0xf0b3, 0x401, 0xfffffffffffffffa, 0x100000001, 0xffffffffffffffff, 0x1, {0x0, @in={{0x2, 0x4e23, @broadcast=0xffffffff}}, 0x0, 0x7, 0xe617, 0x37, 0x84}}, &(0x7f0000000180)=0xb0) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffff9c, 0x84, 0x6d, &(0x7f00000001c0)={0x0, 0x48, "cdc7e7f0af0f749abf9dcfc10fd1950885e500d94fe5196c27f138eeb74be67ac70a62a09169278d9e0a2476b62eb272896acc6659427ff48cd4c615ff2e6913597d21cd14f336b9"}, &(0x7f0000000240)=0x50) getsockopt$inet_sctp_SCTP_STATUS(r2, 0x84, 0xe, &(0x7f0000000280)={r3, 0x8, 0x3, 0x8, 0x1000, 0x20, 0x6, 0x5, {r4, @in={{0x2, 0x4e21}}, 0xd7e, 0x4, 0x3, 0x5d, 0x8001}}, &(0x7f0000000340)=0xb0) ioctl$TCFLSH(r1, 0x5437, 0x0) ioctl$TIOCGPTPEER(r0, 0x5441, 0x0) dup3(r1, r0, 0x0) [ 293.711366] RAX: ffffffffffffffda RBX: 0000000020000190 RCX: 000000000040fd11 [ 293.716262] binder: 20912:20913 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 293.718659] RDX: 00007f088c102afa RSI: 0000000000000002 RDI: 00007f088c102af0 [ 293.718668] RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000000a [ 293.718676] R10: 0000000000000075 R11: 0000000000000293 R12: 0000000000000014 [ 293.718685] R13: 0000000000000000 R14: 00000000004d3c90 R15: 0000000000000006 [ 293.756811] binder: 20912:20913 unknown command 4743953 16:56:51 executing program 2 (fault-call:2 fault-nth:7): mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) [ 293.765640] binder: 20912:20913 ioctl c0306201 20000000 returned -22 [ 293.783303] binder: 20912:20913 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 293.792055] binder: 20912:20913 unknown command 4743953 [ 293.797600] binder: 20912:20913 ioctl c0306201 20000000 returned -22 [ 293.912296] FAULT_INJECTION: forcing a failure. [ 293.912296] name failslab, interval 1, probability 0, space 0, times 0 [ 293.923609] CPU: 1 PID: 20928 Comm: syz-executor2 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 293.932025] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 293.941386] Call Trace: [ 293.943986] dump_stack+0x1c9/0x2b4 [ 293.947624] ? dump_stack_print_info.cold.2+0x52/0x52 [ 293.952817] should_fail.cold.4+0xa/0x11 [ 293.956868] ? up_read+0x110/0x110 [ 293.960403] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 293.965506] ? refcount_inc+0x29/0x70 [ 293.969320] ? lock_acquire+0x1e4/0x540 [ 293.973304] ? lo_ioctl+0x8e/0x1d70 [ 293.976933] ? lock_release+0xa30/0xa30 [ 293.980921] ? check_same_owner+0x340/0x340 [ 293.985256] ? rcu_note_context_switch+0x730/0x730 [ 293.990207] ? lock_acquire+0x1e4/0x540 [ 293.994178] ? fs_reclaim_acquire+0x20/0x20 [ 293.998485] ? lock_downgrade+0x8f0/0x8f0 [ 294.002617] ? check_same_owner+0x340/0x340 [ 294.006923] ? mutex_trylock+0x2b0/0x2b0 [ 294.010980] ? rcu_note_context_switch+0x730/0x730 [ 294.015905] __should_failslab+0x124/0x180 [ 294.020145] should_failslab+0x9/0x14 [ 294.024386] kmem_cache_alloc_trace+0x2cb/0x780 [ 294.029074] ? init_wait_entry+0x1c0/0x1c0 [ 294.033319] ? lock_release+0xa30/0xa30 [ 294.037655] ? trace_hardirqs_on+0x10/0x10 [ 294.041909] ? loop_get_status64+0x140/0x140 [ 294.046341] __kthread_create_on_node+0x127/0x4c0 [ 294.051196] ? __kthread_parkme+0x1b0/0x1b0 [ 294.055528] ? __fget+0x4d5/0x740 [ 294.059006] ? __lockdep_init_map+0x105/0x590 [ 294.063523] ? loop_get_status64+0x140/0x140 [ 294.067953] kthread_create_on_node+0xb1/0xe0 [ 294.072463] ? __kthread_create_on_node+0x4c0/0x4c0 [ 294.077499] lo_ioctl+0x7f6/0x1d70 [ 294.081052] ? lo_rw_aio_complete+0x450/0x450 [ 294.085553] blkdev_ioctl+0x9cd/0x2030 [ 294.090155] ? lock_acquire+0x1e4/0x540 [ 294.094132] ? blkpg_ioctl+0xc40/0xc40 [ 294.098036] ? lock_release+0xa30/0xa30 [ 294.102024] ? save_stack+0xa9/0xd0 [ 294.105656] ? save_stack+0x43/0xd0 [ 294.109288] ? __fget+0x4d5/0x740 [ 294.112742] ? ksys_dup3+0x690/0x690 [ 294.116450] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 294.121058] ? kasan_check_write+0x14/0x20 [ 294.125304] ? do_raw_spin_lock+0xc1/0x200 [ 294.129553] block_ioctl+0xee/0x130 [ 294.133186] ? blkdev_fallocate+0x400/0x400 [ 294.137518] do_vfs_ioctl+0x1de/0x1720 [ 294.141415] ? ioctl_preallocate+0x300/0x300 [ 294.145831] ? __fget_light+0x2f7/0x440 [ 294.149814] ? fget_raw+0x20/0x20 [ 294.153271] ? trace_hardirqs_on+0xd/0x10 [ 294.157413] ? kmem_cache_free+0x22e/0x2d0 [ 294.161641] ? putname+0xf7/0x130 [ 294.165097] ? do_sys_open+0x3cb/0x720 [ 294.168970] ? security_file_ioctl+0x94/0xc0 [ 294.173372] ksys_ioctl+0xa9/0xd0 [ 294.176811] __x64_sys_ioctl+0x73/0xb0 [ 294.180683] do_syscall_64+0x1b9/0x820 [ 294.184565] ? finish_task_switch+0x1d3/0x870 [ 294.189067] ? syscall_return_slowpath+0x5e0/0x5e0 [ 294.193997] ? syscall_return_slowpath+0x31d/0x5e0 [ 294.198927] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 294.203944] ? prepare_exit_to_usermode+0x291/0x3b0 [ 294.208945] ? perf_trace_sys_enter+0xb10/0xb10 [ 294.213600] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 294.218432] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 294.223602] RIP: 0033:0x455927 [ 294.226780] Code: 48 83 c4 08 48 89 d8 5b 5d c3 66 0f 1f 84 00 00 00 00 00 48 89 e8 48 f7 d8 48 39 c3 0f 92 c0 eb 92 66 90 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 7d bb fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 294.245946] RSP: 002b:00007f088c102a88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 294.253655] RAX: ffffffffffffffda RBX: 0000000020000190 RCX: 0000000000455927 16:56:51 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000140)="295ee1311f16f477671070") unshare(0xfefffffffffffffe) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x800, 0x0) ioctl$KVM_GET_IRQCHIP(r1, 0xc208ae62, &(0x7f0000000040)) syz_open_dev$sg(&(0x7f0000000180)='/dev/sg#\x00', 0x10000, 0x2) 16:56:51 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:51 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000000000002000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:51 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000240)={0xa, 0x4e20, 0xfffffffffffffffe, @mcast2={0xff, 0x2, [], 0x1}, 0x5}, 0x1c) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f00000000c0)={0x7, 0x559, 0x40000005}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vcs\x00', 0x4000, 0x0) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r0, 0x84, 0x21, &(0x7f0000000080)=0x9, 0x3d4) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, 0x59ce8c5b}, 0x1c) openat$cgroup_subtree(r0, &(0x7f0000000140)='cgroup.subtree_control\x00', 0x2, 0x0) 16:56:51 executing program 0: get_mempolicy(&(0x7f000000c000), &(0x7f0000fd5000), 0x7ffd, &(0x7f0000000000/0x2000)=nil, 0x1aa) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='setgroups\x00') r1 = gettid() write$FUSE_LK(r0, &(0x7f0000000040)={0x28, 0x0, 0x3, {{0x1, 0x3b, 0x1, r1}}}, 0x28) 16:56:51 executing program 1: r0 = socket$inet(0x15, 0x5, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) r1 = socket$inet6(0xa, 0xa, 0x1) sendto$inet(r0, &(0x7f0000000180), 0x0, 0x0, &(0x7f0000000140)={0x2, 0x0, @multicast2=0xe0000002}, 0x10) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x58, &(0x7f0000000080)=[@in6={0xa, 0x4e24, 0x2, @remote={0xfe, 0x80, [], 0xbb}, 0x20}, @in={0x2, 0x4e22, @local={0xac, 0x14, 0x14, 0xaa}}, @in6={0xa, 0x4e21, 0xc2, @remote={0xfe, 0x80, [], 0xbb}, 0xfffffffffffff9af}, @in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f00000001c0)={r2, 0xfff}, &(0x7f0000000200)=0x8) socket$inet(0x2, 0x3, 0x63fe) setsockopt$RDS_CANCEL_SENT_TO(r0, 0x114, 0x1, &(0x7f0000000100)={0x2, 0x0, @broadcast=0xffffffff}, 0x10) 16:56:51 executing program 6: r0 = socket$inet6(0xa, 0x10000000003, 0x6) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r0, 0x3) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000200)='/dev/qat_adf_ctl\x00', 0x480, 0x0) accept4$alg(r2, 0x0, 0x0, 0x800) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0xde09}, &(0x7f0000000180)=0x8) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f00000001c0)={r4, 0x4}, 0x8) sendto$inet6(r3, &(0x7f0000000280), 0x19e498d7, 0x20000004, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) removexattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)=@known='system.posix_acl_default\x00') 16:56:51 executing program 2 (fault-call:2 fault-nth:8): mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:56:51 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x1d}, 0x2c) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x28c, &(0x7f0000000400)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x7}], &(0x7f00000000c0)="73a2d83331e371d86d84", 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x1, [], 0x0, 0xf}, 0x48) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000080)={r0, &(0x7f0000000000)="fd18366195e81a30daddc9ba90ce973295ffa41817ce77acb60e5cd91e35d64d2f4624f682d77fb108785f5ac90ea37c9e5fb45bdfa1406c0fab7a09b9318fc70ba7ba85515559a7e269bb1697980600888203f0f57a1dbeff5b3d700b595c0739402bd9617831fd92d92b6b9e78b1defe4f20dcfdce0c00c7a904139cf234", &(0x7f0000000140)=""/184}, 0x18) r2 = syz_open_dev$vcsn(&(0x7f0000000240)='/dev/vcs#\x00', 0x1, 0x8000) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0x7, &(0x7f0000000200)={0xda7, 0x6, 0x6d, 0x20}, 0x10) accept4$inet(r2, &(0x7f00000006c0)={0x0, 0x0, @dev}, &(0x7f0000000700)=0x10, 0x80000) accept4(r2, &(0x7f0000000280)=@rc, &(0x7f0000000300)=0x80, 0x80000) mmap$xdp(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000000, 0x2010, r2, 0x180000000) ioctl$TUNSETQUEUE(r2, 0x400454d9, &(0x7f0000000740)={'gretap0\x00', 0x400}) readv(r1, &(0x7f0000000640)=[{&(0x7f0000000200)}, {&(0x7f0000000340)=""/146, 0x92}, {&(0x7f00000004c0)=""/179, 0xb3}, {&(0x7f0000000580)=""/4, 0x4}, {&(0x7f00000005c0)=""/65, 0x41}], 0x5) [ 294.260941] RDX: 0000000000000014 RSI: 0000000000004c00 RDI: 0000000000000015 [ 294.268217] RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000000a [ 294.275582] R10: 0000000000000075 R11: 0000000000000246 R12: 0000000000000014 [ 294.282856] R13: 0000000000000000 R14: 00000000004d3c90 R15: 0000000000000007 16:56:51 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet_sctp(0x2, 0x3ffffffffff, 0x84) sendto$inet(r1, &(0x7f0000a34fff)='H', 0x1, 0x0, &(0x7f0000030ff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) sendto$inet(r1, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f0000033ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r1, 0x1) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)='M', 0x1}], 0x1, &(0x7f0000000080)}, 0x0) write$binfmt_elf64(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="4bf09d810000"], 0x1) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000810000)={0x0, 0x2}, 0x8) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000180), 0x8) 16:56:51 executing program 6: openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x0, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000100)='/dev/snd/pcmC#D#p\x00', 0x1, 0x103100) r1 = syz_open_dev$sndctrl(&(0x7f00000000c0)='/dev/snd/controlC#\x00', 0x8000000000000004, 0x0) ioctl$BLKGETSIZE64(r0, 0x80081272, &(0x7f0000000080)) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r1, 0xc1105517, &(0x7f0000000240)={{0x8, 0x5, 0x7, 0x3ff, 'syz1\x00', 0x3}, 0x3, 0x3, 0x7, 0x0, 0x3, 0x2, 'syz0\x00', &(0x7f0000000040)=[':lo\x00', 'lo/\x00', '/dev/snd/controlC#\x00'], 0x1b, [], [0x0, 0x2, 0x100000000, 0xff]}) ioctl$KVM_GET_NR_MMU_PAGES(r0, 0xae45, 0x10001f) 16:56:51 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c40000000020d740000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:51 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 294.345206] binder: 20942:20948 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 294.353895] binder: 20942:20948 unknown command 4743953 [ 294.359495] binder: 20942:20948 ioctl c0306201 20000000 returned -22 [ 294.370686] binder: 20942:20948 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 294.379390] binder: 20942:20948 unknown command 4743953 [ 294.384990] binder: 20942:20948 ioctl c0306201 20000000 returned -22 16:56:51 executing program 7: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x4924924924925a3, [{}, {0x0, 0x10001}]}) sendmsg$nl_generic(r0, &(0x7f00003cefe4)={&(0x7f0000000300)={0x10, 0x34000, 0x16fd000000000000}, 0xc, &(0x7f0000007ff0)={&(0x7f0000000180)={0x2b7, 0x2e, 0x6fd, 0x0, 0x0, {0x2003}, [@nested={0x25, 0x0, [@typed={0x8, 0x9, @ipv4}]}]}, 0xffce}, 0x1}, 0x0) 16:56:51 executing program 0: r0 = memfd_create(&(0x7f0000000000)=')vmnet0nodevlo\x00', 0x2000001) ioctl$KVM_SET_VAPIC_ADDR(r0, 0x4008ae93, &(0x7f00000000c0)=0xf000) fcntl$getownex(r0, 0x10, &(0x7f0000000100)={0x0, 0x0}) sched_setaffinity(r1, 0x8, &(0x7f0000000140)=0x3) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000080)) socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f0000000180)) 16:56:51 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000dc1000)="71e67a15cdf0311cfc093a52a7d86bd1", 0x10) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000240)="6f2b7e27d75e9889ccec13b7ffccd435", 0x10}], 0x1, &(0x7f0000000400)}, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x40000, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e21, @remote={0xac, 0x14, 0x14, 0xbb}}}, 0x3, 0x7}, &(0x7f0000000180)=0x90) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r2, 0x84, 0x5, &(0x7f0000000280)={r3, @in6={{0xa, 0x4e22, 0x9, @dev={0xfe, 0x80, [], 0x21}, 0x828}}}, 0x84) io_setup(0x7ff, &(0x7f0000000f40)=0x0) io_submit(r4, 0x1, &(0x7f0000001440)=[&(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000340), 0x87}]) 16:56:51 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000140)='/dev/vcsa#\x00', 0x4, 0x20000) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f00000001c0)=0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000200)={[], 0x7, 0x4, 0xd5b, 0x5, 0x7ff, r1}) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x1078}, &(0x7f0000000040)=0x20) r2 = socket$inet6(0xa, 0x100000003, 0x80000000000006) accept4$packet(r0, &(0x7f0000000400)={0x0, 0x0, 0x0}, &(0x7f0000000440)=0x14, 0x800) sendmsg$nl_route_sched(r0, &(0x7f0000000500)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)=@gettclass={0x24, 0x2a, 0x800, 0x70bd2b, 0x25dfdbfe, {0x0, r3, {0x18}, {0xf, 0xb}, {0xffff}}, ["", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x24000000) bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000000540)=0x80000001, 0x4) ioctl$FIDEDUPERANGE(r2, 0xc0189436, &(0x7f00000002c0)={0xc8, 0x4, 0x6, 0x0, 0x0, [{r2}, {r2, 0x0, 0x3}, {r2, 0x0, 0x1}, {r0, 0x0, 0x1}, {r0, 0x0, 0x3}, {r2, 0x0, 0x10001}]}) r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)="656d317dfb6d643573756d5e656d306367726f757000"}, 0xb) setsockopt$RDS_CONG_MONITOR(r4, 0x114, 0x6, &(0x7f0000000100), 0x2e6) ioctl$LOOP_SET_DIRECT_IO(r4, 0x4c08, 0x32) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r4, 0x84, 0x1e, &(0x7f00000003c0)=0x9, 0x4) sendto$inet6(r2, &(0x7f0000000000), 0x0, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback={0x0, 0x8}}, 0x1c) [ 294.534332] FAULT_INJECTION: forcing a failure. [ 294.534332] name failslab, interval 1, probability 0, space 0, times 0 [ 294.545713] CPU: 0 PID: 20965 Comm: syz-executor2 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 294.554126] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 294.563507] Call Trace: [ 294.566103] dump_stack+0x1c9/0x2b4 [ 294.569744] ? dump_stack_print_info.cold.2+0x52/0x52 [ 294.574936] ? update_curr+0x4e7/0xc00 [ 294.578819] should_fail.cold.4+0xa/0x11 [ 294.582881] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 294.587983] ? account_entity_enqueue+0x3ec/0x700 [ 294.592825] ? __enqueue_entity+0x10d/0x1f0 [ 294.597141] ? trace_hardirqs_on+0x10/0x10 [ 294.601377] ? enqueue_entity+0x34b/0x2130 [ 294.605609] ? dequeue_entity+0x70a/0x15e0 [ 294.609836] ? trace_hardirqs_on+0x10/0x10 [ 294.614053] ? reweight_task+0x130/0x130 [ 294.618119] ? lock_acquire+0x1e4/0x540 [ 294.622078] ? fs_reclaim_acquire+0x20/0x20 [ 294.626393] ? lock_downgrade+0x8f0/0x8f0 [ 294.630534] ? check_same_owner+0x340/0x340 [ 294.634840] ? task_fork_fair+0x680/0x680 [ 294.639058] ? rcu_note_context_switch+0x730/0x730 [ 294.643973] ? try_to_wake_up+0x10a/0x12b0 [ 294.648206] __should_failslab+0x124/0x180 [ 294.652460] should_failslab+0x9/0x14 [ 294.656244] kmem_cache_alloc+0x2af/0x760 [ 294.660376] ? do_raw_spin_unlock+0xa7/0x2f0 [ 294.664771] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 294.669773] __kernfs_new_node+0xef/0x5a0 [ 294.673903] ? kernfs_dop_revalidate+0x3c0/0x3c0 [ 294.678656] ? bd_set_size+0x2c1/0x370 [ 294.682542] ? lock_downgrade+0x8f0/0x8f0 [ 294.686676] ? enqueue_entity+0x2130/0x2130 [ 294.691090] ? lock_release+0xa30/0xa30 [ 294.695064] ? check_same_owner+0x340/0x340 [ 294.699371] ? lock_acquire+0x1e4/0x540 [ 294.703328] ? rcu_note_context_switch+0x730/0x730 [ 294.708244] ? lock_downgrade+0x8f0/0x8f0 [ 294.712377] kernfs_new_node+0x80/0xf0 [ 294.716264] kernfs_create_dir_ns+0x3d/0x140 [ 294.720656] internal_create_group+0x3c9/0x9e0 [ 294.725228] ? do_raw_spin_lock+0xc1/0x200 [ 294.729451] sysfs_create_group+0x1f/0x30 [ 294.733582] lo_ioctl+0x1307/0x1d70 [ 294.737194] ? lo_rw_aio_complete+0x450/0x450 [ 294.741671] blkdev_ioctl+0x9cd/0x2030 [ 294.745542] ? lock_acquire+0x1e4/0x540 [ 294.749522] ? blkpg_ioctl+0xc40/0xc40 [ 294.753405] ? lock_release+0xa30/0xa30 [ 294.757370] ? save_stack+0xa9/0xd0 [ 294.760996] ? save_stack+0x43/0xd0 [ 294.764625] ? __fget+0x4d5/0x740 [ 294.768063] ? ksys_dup3+0x690/0x690 [ 294.771762] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 294.776328] ? kasan_check_write+0x14/0x20 [ 294.780557] ? do_raw_spin_lock+0xc1/0x200 [ 294.784779] block_ioctl+0xee/0x130 [ 294.788396] ? blkdev_fallocate+0x400/0x400 [ 294.792706] do_vfs_ioctl+0x1de/0x1720 [ 294.796584] ? ioctl_preallocate+0x300/0x300 [ 294.800976] ? __fget_light+0x2f7/0x440 [ 294.804932] ? fget_raw+0x20/0x20 [ 294.808368] ? trace_hardirqs_on+0xd/0x10 [ 294.812504] ? kmem_cache_free+0x22e/0x2d0 [ 294.816731] ? putname+0xf7/0x130 [ 294.820192] ? do_sys_open+0x3cb/0x720 [ 294.824083] ? security_file_ioctl+0x94/0xc0 [ 294.828482] ksys_ioctl+0xa9/0xd0 [ 294.831928] __x64_sys_ioctl+0x73/0xb0 [ 294.835798] do_syscall_64+0x1b9/0x820 [ 294.839667] ? finish_task_switch+0x1d3/0x870 [ 294.844155] ? syscall_return_slowpath+0x5e0/0x5e0 [ 294.849071] ? syscall_return_slowpath+0x31d/0x5e0 [ 294.853987] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 294.858997] ? prepare_exit_to_usermode+0x291/0x3b0 [ 294.864007] ? perf_trace_sys_enter+0xb10/0xb10 [ 294.868680] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 294.873514] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 294.878688] RIP: 0033:0x455927 [ 294.881856] Code: 48 83 c4 08 48 89 d8 5b 5d c3 66 0f 1f 84 00 00 00 00 00 48 89 e8 48 f7 d8 48 39 c3 0f 92 c0 eb 92 66 90 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 7d bb fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 294.901613] RSP: 002b:00007f088c102a88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 294.909319] RAX: ffffffffffffffda RBX: 0000000020000190 RCX: 0000000000455927 [ 294.916573] RDX: 0000000000000014 RSI: 0000000000004c00 RDI: 0000000000000015 [ 294.923830] RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000000a 16:56:52 executing program 2 (fault-call:2 fault-nth:9): mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) [ 294.931082] R10: 0000000000000075 R11: 0000000000000246 R12: 0000000000000014 [ 294.938336] R13: 0000000000000000 R14: 00000000004d3c90 R15: 0000000000000008 [ 294.950615] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 294.969960] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue 16:56:52 executing program 6: r0 = socket$netlink(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000023ff0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3f00000100000000dc000120af20c1c0000000000004800100"], 0x1}, 0x1}, 0x0) r1 = memfd_create(&(0x7f0000000000)='bdevuser,\x00', 0x1) write$FUSE_IOCTL(r1, &(0x7f0000000100)={0x1a, 0x0, 0x2, {0x7, 0x4, 0x9, 0x7}}, 0x20) 16:56:52 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000480000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:52 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 295.056382] binder: 20981:20988 BC_REQUEST_DEATH_NOTIFICATION invalid ref 33554432 [ 295.064381] binder: 20981:20988 unknown command 4743953 [ 295.069903] binder: 20981:20988 ioctl c0306201 20000000 returned -22 [ 295.085299] binder: 20981:20988 BC_REQUEST_DEATH_NOTIFICATION invalid ref 33554432 [ 295.093209] binder: 20981:20988 unknown command 4743953 [ 295.098668] binder: 20981:20988 ioctl c0306201 20000000 returned -22 16:56:52 executing program 7: r0 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_int(r0, 0x0, 0xd1, &(0x7f0000000040)=0x6, 0x4) setsockopt$inet_tcp_buf(r0, 0x6, 0x2d, &(0x7f0000000080)="405de212185d715a5873f09db250b859258626218bee0d1951830149c45a3074655b06675d6531feb0e1246ebee07d0550869d0c697ab6b26105233ab678bb3cfd0522e2a6ee783f2e50765cbde4581a9affd2", 0x53) [ 295.147692] netlink: 663 bytes leftover after parsing attributes in process `syz-executor7'. [ 295.159667] netlink: 663 bytes leftover after parsing attributes in process `syz-executor7'. 16:56:52 executing program 0: r0 = socket$inet6(0xa, 0x802, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='projid_map\x00') write$FUSE_NOTIFY_INVAL_INODE(r1, &(0x7f0000000080)={0x28, 0x2, 0x0, {0x100000000, 0x4, 0x7}}, 0x28) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/sync_threshold\x00', 0x2, 0x0) sendfile(r2, r2, &(0x7f0000000000), 0x9) ioctl$FS_IOC_GETFSLABEL(r2, 0x81009431, &(0x7f0000000140)) 16:56:52 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x3c) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, 0x9}, 0x1c) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000200)='/dev/autofs\x00', 0x200000, 0x0) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000780)={0x0, 0x6, 0x10}, &(0x7f00000007c0)=0xc) getsockopt$inet_sctp_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000800)={r2, 0x2}, &(0x7f0000000840)=0x8) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='net/netstat\x00') setsockopt$inet_msfilter(r3, 0x0, 0x29, &(0x7f0000000240)=ANY=[@ANYBLOB="7f000001000000000000000001000000ac1414bb8f0d7f4cefd6121da30ed782be066e93653ca75381ae7a74d4df7239600b08c4dadd421f8da267cbd608dd05890af8b0242f4b2da10ac047725c94037a53474e6ff57427027b7c851abf393010ed56bdad39fc4f34a859cd4ac770d6fe2094c3ec5a4fd317e0992b184bea93da1af012347d859631c322759e7df237d765663c50f6ecd1903400262981fc9d618506528ac19f7c60b3a9eed8d4d2030181dae82fead575d8a78fd5c1d45947071eee7e79d13098ecd8fad3be15b8843a0959e34fa0bcc9c4934b9c73c183140cb1550b72b599ef2bd82a21b5"], 0x14) sendmsg(r0, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)="3a9a", 0x2}], 0x1, &(0x7f0000000280)}, 0x0) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000000c0)={0x0, 0x3ff}, &(0x7f0000000100)=0x161) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r1, 0x84, 0x7, &(0x7f0000000080)={0x5}, 0x4) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r3, 0x84, 0x7b, &(0x7f0000000140)={r4, 0x9}, &(0x7f00000001c0)=0x8) sendmsg$rds(r1, &(0x7f0000000740)={&(0x7f0000000380)={0x2, 0x4e21, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10, &(0x7f0000000440)=[{&(0x7f00000003c0)=""/91, 0x5b}], 0x1, &(0x7f0000000600)=[@cswp={0x58, 0x114, 0x7, {{0x2, 0x2}, &(0x7f0000000480)=0x7, &(0x7f00000004c0)=0x8000000000000, 0x6, 0x80000000, 0x7fff, 0x100000001, 0x60, 0x7fff}}, @mask_cswp={0x58, 0x114, 0x9, {{0x2}, &(0x7f0000000500)=0x6, &(0x7f0000000540)=0x1000, 0x0, 0xfffffffffffffffe, 0x40000, 0x3, 0x0, 0x6}}, @mask_fadd={0x58, 0x114, 0x8, {{0xffffffff, 0x3ff}, &(0x7f0000000580)=0x8, &(0x7f00000005c0)=0x2, 0x588, 0x4, 0x8, 0x4, 0x1, 0xd2}}, @rdma_dest={0x18, 0x114, 0x2, {0x40, 0x6}}], 0x120}, 0x0) getsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000880), 0x10) 16:56:52 executing program 4: syz_mount_image$ext4(&(0x7f00000000c0)='ext2\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000180)=[{&(0x7f0000000080)="000100000200000066000000c9030000ec00002f00000000000000000000000000200000002000000000000000006e0000000000000000df87ce", 0x3a, 0x400}], 0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="00667d01502831ad52470b2839a19591ae4ce475fdb8e18c5906f5be"]) 16:56:52 executing program 6: r0 = socket(0x40000000015, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f00000007c0)=0x2, 0x4) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00006dbffc), 0x4) bind$inet(r0, &(0x7f0000000840)={0x2, 0x4e20, @loopback=0x7f000001}, 0x10) ioctl$int_in(r0, 0x5421, &(0x7f0000000900)=0x6) r1 = openat(0xffffffffffffffff, &(0x7f0000000500)='./file0\x00', 0x40, 0x100) r2 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") sendto$inet(r0, &(0x7f0000000000)="ba671368d1010000004900000001000000018be49e9301442865319997d0efdb2f54b6a10c7327757482bfce945c2a91fb8dfafc1d3f56bc543ab87321e12cca08a744a2d128b00634bc882151d36809229a96bc3437ef159489384ade077ba295eac2882dbfd3781dd4d4e609c42628dbb709b3eb1fa030009045dd98b9e6d77b6cec9ceb685595d43995e0f04c32260943add79831e661c6a351dedc8b9d220fbf9fb6e44fb6a629ce9a82025124fec9f3ee751f7da0cd7e799be88ddbdac20b48e890ff81d7fa28c2d017d7932f2569038740461accd4582f576e4fdb6150a3399f8266bc19eb943648ad1ad81420ed6c382436e474390c8995e829e4f9df43eed85a60b9ee254e31eb62900857fa134e76cc64880334adbff069a2e5e647d2ed36a96b23834b6f6ca6b8113baf4cf30347fbb7ffc30aea99872cc0dba03b07d3347b2d257edbe2733c26b7337a79962d8ce85469e3bcbe0e4a48a6ae69d13f2d4b5155b390ef67aa714b82b6313ee277cb8986eca5db2e97cb1ae2243bba80274f614ece521baef443394b4c161cb9ae926e21892578b49cfd6efe1cb1572148c10d92218ed73ec116a18de80ac42d2726a4523a764fc6dc356c5fbbf9d2c947ae3bc9a3dc76099f3257c8d5952876151b0326d8cb1d5683ee4ad5ded9a34c00ac1b03f34627ec18a7c2e92c87b7896549cfab5eb55fa85a970994bd4b22b5f0d045e241256d06f485a47b4a55ed389bc1734541232cd41908b5cfa4b8fcfcafce500a0c7ae99767713a98e7927aa69f6ccd7daea62f19ceb82559f41899c9a9aee99113e7e64b5f8b9824be9fdbfa4dd4995673d882bb4daeb64413b334e114965d2ba3cea8051e692508701b9400cb12eae457f8b8549944091b729160939918d8fcae611a5ded665f770db637487a236da1a58ba7566668651a77171fc4fe506496d19059343dbe4f426625d3f2b705f54581372361770bf5a9098a9fafefaf546426b294239ac33e3186e4d58ad2fa995a6ad4dc074e7cca11aead109563b2076c7c6e9f57ec63df960804e2e7f9d8444de9550cca3df7834d864e9777291c2e1f6205de2e43dc995ab8bb1515a365efc2830fa3e7a1dd137f550d6035212bc1f51c3b4ceea430df49ffc9210084ef156ad7e0d219efd6c116693735b44521d389969a3a65617cd2fd6e14060601cee4cd054cf36fe048b57d1d9ee3cad2a73552449926b4a6b03fbe9c0ec68357e1fbe52ed77b67f5870c0aefb7ee8236747e0d67a26725fb515544cbbe8464da94cfd8c0b94bb4e51a263b1749bd0a7cf651931f806d1b928d1f9994f1ad4d50e6a5cd7a8e4e687f8564fdacc864013d095ba9d5709eced3c28eabda476d177a7836400a01e02beeb5a6636d4064fdda344967ad8682d14b87c71727cb66be27d1d39191f4223c545b62fb4860262ba8076a65dbc194cee1df846c584b7bbe9dce6e6895b2cbbb64b03b55548b845cc3de2f939ef918421af9a5e9157e837651245299c03992d0ddee06bd22a31522aca0f309b1feccebc0b1c0ed9d21c19bfd15cd313ff64394fd6a10904890c9f6d646b026f27253e8f584c3ffd20ad67e8b62ed7676706d40bc5c80e376980b81", 0x481, 0x0, &(0x7f000069affb)={0x2, 0x4e20, @loopback=0x7f000001}, 0x10) sendto$inet(r0, &(0x7f00004b3fff), 0x0, 0x0, &(0x7f00002b4000)={0x2, 0x4e20, @loopback=0x7f000001}, 0x10) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000bc0)={0x7, 0x0, [{0x1f000, 0xbe, &(0x7f0000000580)=""/190}, {0x1000, 0xf4, &(0x7f0000000640)=""/244}, {0xd000, 0xf0, &(0x7f0000000940)=""/240}, {0x10000, 0x9b, &(0x7f0000000a40)=""/155}, {0x106000, 0x5f, &(0x7f0000000740)=""/95}, {0x5002, 0x2e, &(0x7f0000000800)=""/46}, {0x110000, 0xa0, &(0x7f0000000b00)=""/160}]}) poll(&(0x7f00000004c0)=[{r0}], 0x1, 0x4) [ 295.346779] FAULT_INJECTION: forcing a failure. [ 295.346779] name failslab, interval 1, probability 0, space 0, times 0 [ 295.358184] CPU: 1 PID: 21014 Comm: syz-executor2 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 295.366587] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 295.373037] binder: 21012:21018 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 295.375935] Call Trace: [ 295.375961] dump_stack+0x1c9/0x2b4 [ 295.375979] ? dump_stack_print_info.cold.2+0x52/0x52 [ 295.376002] should_fail.cold.4+0xa/0x11 [ 295.376021] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 295.376045] ? run_rebalance_domains+0x4c0/0x4c0 [ 295.384649] binder: 21012:21018 unknown command 4743953 [ 295.387209] ? __enqueue_entity+0x10d/0x1f0 [ 295.387227] ? trace_hardirqs_on+0x10/0x10 [ 295.387246] ? enqueue_entity+0x34b/0x2130 [ 295.391520] binder: 21012:21018 ioctl c0306201 20000000 returned -22 [ 295.396039] ? rcu_sched_qs+0xe/0x150 [ 295.396054] ? rcu_note_context_switch+0x571/0x730 [ 295.396067] ? rcu_sched_qs+0x150/0x150 16:56:52 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000007400000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:52 executing program 7: r0 = socket(0xa, 0x1, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}}, 0x108) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000340)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}, {{0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xaa}}}}, 0x108) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000040)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}, {{0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xaa}}}}, 0x108) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) [ 295.396087] ? lock_acquire+0x1e4/0x540 [ 295.396098] ? fs_reclaim_acquire+0x20/0x20 [ 295.396109] ? lock_downgrade+0x8f0/0x8f0 [ 295.396127] ? check_same_owner+0x340/0x340 [ 295.396142] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 295.396155] ? rcu_note_context_switch+0x730/0x730 [ 295.396169] ? kasan_check_write+0x14/0x20 [ 295.396183] __should_failslab+0x124/0x180 [ 295.396199] should_failslab+0x9/0x14 [ 295.396211] kmem_cache_alloc+0x2af/0x760 [ 295.396227] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 295.396239] __kernfs_new_node+0xef/0x5a0 [ 295.396251] ? kernfs_dop_revalidate+0x3c0/0x3c0 [ 295.396262] ? bd_set_size+0x2c1/0x370 [ 295.396279] ? lock_downgrade+0x8f0/0x8f0 [ 295.511919] ? enqueue_entity+0x2130/0x2130 [ 295.516256] ? lock_release+0xa30/0xa30 [ 295.520247] ? check_same_owner+0x340/0x340 [ 295.524582] ? lock_acquire+0x1e4/0x540 [ 295.528573] ? blk_queue_write_cache+0x1b8/0x43a [ 295.533341] ? lock_downgrade+0x8f0/0x8f0 [ 295.537513] kernfs_new_node+0x80/0xf0 [ 295.541409] kernfs_create_dir_ns+0x3d/0x140 16:56:52 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00001ec000)="0a0775b0d5e383e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmsg$alg(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)="105dd852061bf7c2c768893dd0ebed71a45e559e0a01bb72f32b0aa711d3ed95e6a19e38c0a41206742416fab90556e19bc35e8c60d3da3d3941953494354aa7afac476c09541fda07a512dbddc90514dc34c379605cfef4", 0x58}], 0x1, &(0x7f0000000100)}, 0x0) recvmsg(r2, &(0x7f0000b2dfc8)={&(0x7f00007ebffa)=@hci, 0x80, &(0x7f0000f75000)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1, &(0x7f0000ec7000)}, 0x0) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/backup_only\x00', 0x2, 0x0) r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000100)='ecb(tea-generic)\x00', r3}, 0x10) getsockopt$ARPT_SO_GET_INFO(r4, 0x0, 0x60, &(0x7f00000002c0)={'filter\x00'}, &(0x7f0000000180)=0x44) 16:56:52 executing program 0: gettid() r0 = memfd_create(&(0x7f0000000000)="eb7d2b656d312e776c616e301b21707070306574683000", 0x3) accept$alg(r0, 0x0, 0x0) prlimit64(0x0, 0x9, &(0x7f00000000c0), &(0x7f0000000100)) io_setup(0x1f, &(0x7f0000e4b000)) [ 295.545829] internal_create_group+0x3c9/0x9e0 [ 295.550419] ? do_raw_spin_lock+0xc1/0x200 [ 295.554668] sysfs_create_group+0x1f/0x30 [ 295.558838] lo_ioctl+0x1307/0x1d70 [ 295.562478] ? lo_rw_aio_complete+0x450/0x450 [ 295.566980] blkdev_ioctl+0x9cd/0x2030 [ 295.570876] ? lock_acquire+0x1e4/0x540 [ 295.574895] ? blkpg_ioctl+0xc40/0xc40 [ 295.578792] ? lock_release+0xa30/0xa30 [ 295.582776] ? save_stack+0xa9/0xd0 [ 295.586416] ? save_stack+0x43/0xd0 [ 295.590050] ? __fget+0x4d5/0x740 [ 295.593511] ? ksys_dup3+0x690/0x690 [ 295.597232] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 295.601825] ? kasan_check_write+0x14/0x20 [ 295.606069] ? do_raw_spin_lock+0xc1/0x200 [ 295.610316] block_ioctl+0xee/0x130 [ 295.613946] ? blkdev_fallocate+0x400/0x400 [ 295.618277] do_vfs_ioctl+0x1de/0x1720 [ 295.622181] ? ioctl_preallocate+0x300/0x300 [ 295.626602] ? __fget_light+0x2f7/0x440 [ 295.630586] ? fget_raw+0x20/0x20 [ 295.634055] ? trace_hardirqs_on+0xd/0x10 [ 295.638227] ? kmem_cache_free+0x22e/0x2d0 [ 295.642473] ? putname+0xf7/0x130 16:56:52 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x200000, 0x0) connect$nfc_llcp(r1, &(0x7f0000000040)={0x27, 0x0, 0x1, 0x6, 0x0, 0x80000000, "8b379d181ecdfc7d2e33ff8bfebd0c914abfd8f1ec8ffeaa77157978d094a6637227e5310b73a1eb0068cf2ed3a7fde5355a13f9e4960bbaa6cac2d49df784", 0xe}, 0x60) fstat(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setresgid(0x0, 0x0, r2) setfsgid(r2) 16:56:52 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = memfd_create(&(0x7f0000000040)='#! ', 0x1) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r2, 0x80045301, &(0x7f0000000080)) socketpair$inet_smc(0x2b, 0x1, 0x0, &(0x7f00000001c0)) setsockopt$IP_VS_SO_SET_STOPDAEMON(r1, 0x0, 0x60, &(0x7f0000000180)={0x0, 'nr0\x00'}, 0x18) write$binfmt_script(r1, &(0x7f0000000000)={'#! ', './file0', [], 0xa}, 0xb) [ 295.645935] ? do_sys_open+0x3cb/0x720 [ 295.649826] ? security_file_ioctl+0x94/0xc0 [ 295.654244] ksys_ioctl+0xa9/0xd0 [ 295.657704] __x64_sys_ioctl+0x73/0xb0 [ 295.661591] do_syscall_64+0x1b9/0x820 [ 295.665475] ? finish_task_switch+0x1d3/0x870 [ 295.669999] ? syscall_return_slowpath+0x5e0/0x5e0 [ 295.674940] ? syscall_return_slowpath+0x31d/0x5e0 [ 295.677923] binder: 21046:21052 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1946157056 [ 295.679875] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 295.679896] ? prepare_exit_to_usermode+0x291/0x3b0 [ 295.679911] ? perf_trace_sys_enter+0xb10/0xb10 [ 295.679926] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 295.679945] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 295.679956] RIP: 0033:0x455927 [ 295.679959] Code: 48 83 c4 08 48 89 d8 5b 5d c3 66 0f 1f 84 00 00 00 00 00 48 89 e8 48 f7 d8 48 39 [ 295.693836] binder: 21046:21052 unknown command 4743953 [ 295.697921] c3 0f 92 c0 eb 92 66 90 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 7d bb fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 295.698043] RSP: 002b:00007f088c102a88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 295.698056] RAX: ffffffffffffffda RBX: 0000000020000190 RCX: 0000000000455927 [ 295.698065] RDX: 0000000000000014 RSI: 0000000000004c00 RDI: 0000000000000015 [ 295.698072] RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000000a [ 295.698080] R10: 0000000000000075 R11: 0000000000000246 R12: 0000000000000014 [ 295.698086] R13: 0000000000000000 R14: 00000000004d3c90 R15: 0000000000000009 [ 295.702565] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing 16:56:53 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:53 executing program 2 (fault-call:2 fault-nth:10): mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:56:53 executing program 4: setrlimit(0x400000000000007, &(0x7f0000000140)) socket$xdp(0x2c, 0x3, 0x0) pselect6(0x40, &(0x7f0000000080)={0x400000, 0x4, 0x2, 0x8, 0x200, 0x10001, 0x9, 0x4}, &(0x7f00000000c0)={0x3, 0x5, 0xffffffffffffff56, 0x7, 0x7, 0x8, 0x7fff, 0x4}, &(0x7f0000000100)={0x0, 0x81, 0x8a552d2, 0x3d68, 0x1b4, 0x1ff, 0x9}, &(0x7f0000000180), &(0x7f0000000200)={&(0x7f00000001c0)={0x7}, 0x8}) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x20000, 0x0) ioctl$TIOCSWINSZ(r0, 0x5414, &(0x7f0000000040)={0x8, 0x2, 0x9, 0x1f}) [ 295.704257] binder: 21046:21052 ioctl c0306201 20000000 returned -22 [ 295.808958] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue [ 295.824606] binder: 21046:21052 Acquire 1 refcount change on invalid ref 0 ret -22 16:56:53 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000030000000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:53 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e23}, 0x1c) listen(r0, 0xffffffffffffff7f) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r1, &(0x7f0000e33fe0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) write$binfmt_misc(r1, &(0x7f0000000240)={'syz1'}, 0x34000) sendto$inet6(r1, &(0x7f0000000140)="8e", 0xfffffeb1, 0xfffffffffffffdfe, 0x0, 0x0) setsockopt$inet6_mtu(r1, 0x29, 0x17, &(0x7f00000014c0)=0x2, 0x4) r2 = semget(0x1, 0x4, 0x80) semctl$IPC_STAT(r2, 0x0, 0x2, &(0x7f0000001440)=""/114) r3 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0x6, 0x4080) getsockopt$inet6_mreq(r1, 0x29, 0x1f, &(0x7f0000000180)={@loopback, 0x0}, &(0x7f00000001c0)=0x14) mbind(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x4000, &(0x7f0000000000)=0x9, 0x21, 0x5) sendmsg$xdp(r3, &(0x7f0000001400)={&(0x7f0000000200)={0x2c, 0x6, r4, 0x38}, 0x10, &(0x7f00000013c0)=[{&(0x7f0000000280)="e9da69f7158e733251f2bbbe4e9b4f854953a3ef28c3f72cd30d9b1a4d5c9c90749a7bf5aa490691827dd6fb23ff91d6dd4350575bce9011d4175b4a38469325f8ccf7436b0ed8fc77ed1a343cbf48bf31e513766f79457c29f83b6051167b5a695b7ea2ceb644160fd748d79a3af627d114a0e8406f5e1502ff5d61b4c78fd9513a6333d0357bae1cb0cfda76ab2e83fb7f32400c106a6182bbf28c7ee254a6c5072b7586dbc309b85b58c1fad819cbfe668e43ecdbaea0926ded36fe3b980fde62d5a0c956dfa79c5525ee43d931818b983507473239271f6b047f22dce4fb36098227b99bce292bfa0066c335991611d16e5176b7442c79cd27805db5c157fd9fca89740ba6830250e402da28408a56b96550a96e4d2cabd959378d46f2b155302deb8de27bdc5b4e6adfdbe9db0a992ca1904a0b9e6d8cc0d5f32a8cd04e33839eb25a73a05a80d9bf2d3071c4479eb7f2ce6cb7e503add39a23199b7bfd58fc97203fe8dac8ad77df3fb96297880198f0c87af6256870e92d33753a5e2f3cb461138d45202b8f71928321cecd09436d40098d2683e58382c4b23e263cc656974edbdbf277f27476c6b2a590d5eb20ad0da00e7d5bab36469560bd696689ef5b2322c54f4fba593d8cbe4afd172f47d8357af611651b1fe9d8f759e0bb4fd985672a07e91d63afc547212ee6b2919fa0821e27689dedbc6b1078a1263042270a9bb0cef4cb6cf8fba91728aaf586b31e993ed3946c83595a1ec35f65dc515f477e31bcbca96cd336225d868cb038d7e06bd976b6e44d1aa4d75088d24ee61017f66b2956983ba250e61ebf68693acb2df9bb242e217aaad4df414efcc3ad2107af085ce0e937f56991e8be6820c451fcebc0e43615add648912d9c55f30b227d8d9b118187a7e547e5513306113b738c0cbce11d57f543ebbccacab5f3c6d63bb0ab176523fbd39db6007186e56dab6a0dbe54206ea1eaafd617c820ea3f479f50dc5752946a827e1e2f9bb490389d90436391246451bab79e4086d9d6696aaa0b05af71c082cbefc44ea38764b7cf0cc5733b714b9f1fa252c604828c7899ca1608faea715648142c0a51baf12ea8b54e888b7d945edae532a752c0bad3e989be6294b23c09d87f48629d90e767e9944ec564f5e3c9d7d8b6443a6a87e7415908247444e010471a0b9b8622e95fb77f696c226d831108c9d044d481bf66da95b76dc6cbb224cb8ed7b9698e86196686585876aa0c95104fa11e2fb11a76f57fe879a35f1370fc40286d1778608c38c40dd8a6b0ef1468ba3a0fdd035544be123f66308177d8cf0218ed3b8efc917ec9091c62fd68d0ce6ec1d09bec843e6a438b4ca72ee91c18caef8f7a5fa9ecd73867cbd27cba0454b0b1936af9e4cdedffa3d0a9b250f4c34c3bc00e54e31ad6aab4982c335743048fa10275df4ebb4e1ee7a166b364c016e555f757da6ead26a76b24865596a79dde75ea73b843e189cbd713d7db37ee9b66a47ca46af001ab1e03b474facd5bf2b176a14258e0c1ed51be56af8159938e1ff9e42bedfc2788c378308c11319d7b5792acc1b6651069532f3861edda7b0cb1e1f9eec908738473d48a02334e0c7fea52361f46e0e561e5b814152016e0cc32ad27aadfe9f15761585e2f87ad2d15d490b13f655e70a42f2f372e3feb91644ed9fa78463e2072b7cd639552fc22adae4367e9fe3b1d992dd166fd4c345e3a5f578039bcb1d53a55036f83bcdcbf64aaf88be56e6bcb6965d3794c5a249f4b3901e49a7b345859f9bc84ed00a793df7f170575021aba568756ccfe4f2e2be1bb9012895a4dfa255bdc3bc1d5544e6fecfd1d184219b64d7783c2771ac01826bb0d109f04f0e172cd2f69383c2cf2a63aa72a567bd35aacb724b326347c994ab7ff1a29a610b0cdb2c4fac7fb217936e1e6fe67b86595f29ecc731afe687ab2a762e467b3e50ec5b7dbbbb5f64bb5603e5834b9a99df1fc43d6693c3e3d278bc84cefc706aeca7ab0ab1c0af8e9eeb88377e89132c62b4b6085cca31097f547206f17d429c516ef0e9c51a5b250f35b3492ad7c38ad18b62925942f4877c8b18468adf57018a2a4f186471009e245aedb7e86315333a75422cea6cf962cd8ff8d170f0445fba48f773d7a293b6e8c5a8649dfe8f0bff36a9960ec0665d87696f86c52937194988360a4b8c96720fc99a28b2cff0d99b73db0a8836aaaf16c195f7c787dc12ef1efb542563e311f15c8d74f780a83d1dde0159dd81b8830ef3fe1fab67e3a96aa05615051e67e778129ecb975f978615eceb4532aad2bbb375f8bd93dd9d5668c3c5dc352c8b1a605592892d69caa956fda9dcbb396ede4e71c05bbfd9eaaab4910fff74a630a9a2fd8026a8f48a8c89b1b38065b9e648c780eb267a3d58e594eeec49012ded5ae134ddacd30cd39392e691f46fd3f7f2d5ca43c2d817784ab328b8bb328c87d54f6b203ba87f4d65679885d069b6827e9af785c0229661b448b08ac81fe2e7cc342ac903e577562b6a0d3bfae6cb914cdd2db3381c225261032ab38fdf53f02878525da5f5651cf8f2dc654c6a105fec65a5cf023c4e9b1e3d30c40202b3f466a561712eb61e6e98d9856c22f8fb063d16b4ecabce9f33edb2bd79c9a8bd8c21b106e56e670b999f4ec315b2d4ea115a9583cb9ff43cf477287baaaf01500017a2b235ca9f17ff28cb303c0203a6c89c9ccc0673831da8c8c073c090603f0c2e08b22c32f11797205570035b21e7ee0a4e5e7d81c93355858954ee033ce56bfddc259f4b0cf5b3a244bedbb37ab10465060bbafbe34e4b347fee645dafcf48b348e9bfd70e72b1476a77562f4f06605a5e0befef2828ea3a0d029337911945115a132f044945b2c4690eb8e79240fc6710b621ba713803a78a6ae6f11531e090828076ee1fdfad33ec75bd0cd2c3eb7ca390a8d8855c66971341f4d9cd6aae8447435da7754171c5837f6dbe7efc26c1f69e32f22efa6e28d1d0f943d58ca1fef2bf198a9a4dab33146c43789a1f1b139b209dba979e24d32774cd514f7b6c11142fbc7e6fe5069feaf38622e5bc0f16e948a9fd527b3aee47b6846175f6c8c9e92a40fdf42b5ab6a6d1ddae1218b20b21f6c1d7aae4c101d0ab85086999cf661cdd1a04d160c97b6274aa10be0f912f63c4e323289a5c1c661a9b10d005cb64ba9884d865bdf7922229cb1f971ead872509356fb0f92d65d87a76dac58fb01357de2288e3a2a563fbb092f8f177520ca24539a931922b57b35557ba057fabdd9bfe5304c754cb969e2c5f46d51d34b66ac6535ef5881a505ca520ff895a992ad7d3cc5147d2b1ce2fa9125e904fe9497bcd13704dd6f5ca861e478d9156c85aecbf9228697515d8261dcbe00f76d97f2ca5f725bcfcaebe5dc7ec22dc9a479375e8c6831fa48727af9cc137719f57c1c6e331e8ccfaf343c0bf0588e6da22a4785a67600bc1041463b3e97d5c8c23df7ed5c60f9d28191d7410ab866bae4a7312176538d334740fc4e66e69f27ae454e9e87d0e31d5d7e1e71d23ab70be1743e1999f724b27c3175ca21c9ec7a8a25820c10c17f60e76b815f2ba2b5e933ca649414c3687482972e5ebc5a8b2a389fe61c56ffbcc39383eb8d9b3cfde5d753e323180469ef54460169f08c27b19d4a1d946ea464312894b84f28a0f161dc08da01aad61d1b6df84d7b2c47005f9b4e726c7c2f47a320cbed0b2e0a367d561435c9ac15cc5f09b5ed93ef5d9ce8dbde9111e7a13507d2ca0330d1ee121e0176c0fa38406f55a209b241ad4cee6b806fb241eb15bef864baa69a4668ea21013af15249aa73a3ec086b33e7d84850dac1932ab5c965a79e9e5e56cf7cf0a0e7b169e9860605d386b3d79b789459576c1d5a3bfc1fcc70807ab849247add55e9c0884a656dcf34865c2e57d3009677fc5009c9b96e1ed86061acdd103928580628b8261cef04340c52d99e3a0dc3410ae6ead0b18f71b4849fa2e7af43f328209a6db7bca415c95b4aaa362fa61cf7f8cd8f31564b8e0eb11ba7aa1afd8d8367e9f3a5e1f5ff43ab4bb654012211db3a4f586d57a5e5aff1cb7ff4e9d89ffc60d0cc55950a6a72f95f87f63bbd22ac9e20388963402fee1485ea420f8fb597a6b59d7741341682c13badc8253e3fe56a6723252f2899f1fba7d30550a6e198fd2eecee060092e91446b437bf306ce8b599f6c28a4d87e200946950abc1edb4d6898d8d4c3c60b60420ff3b14cf735e38da7bc85be1d5cfbe6b90565da55dfed0a47be7a42e1a15e2fb73855d9b94d3d2062ebb69f13c7e68c3681eaf616e38a143d6b03fba2a2f19a79cea75e501ea95fe16158715c285c5e393e357a1c8a7e93c0761233fc2b9f581ee08cd4e6ba26e6f38f488a0c273477abb7d70e6b2fe6c36e729297afd0a3f26e5c974067717a9eaf503676055e7af2cabe2f7b60b45a69ee36d31c01a68471f293b4f7502d79b46ec235452cefdf6e5ed233238a3faff8243518ecd2f833516eedace364152e1c3490c1ba6653f177a8bd56816a01bed4569cdfc4d4307e94823ff4c51057de7709a681e4ea3b3b50252e342f6aec2fceb62a3d856ac9198ed2758ae48aac992679a752f824333810851d12926ee75d4f8d4b409cb3677d971ac3da24c11dd6d83e567fc62267ed08895baed47bd960dc3597865dc952886d4f64ff6f8b148f9356e8b79a461c9cd77fd6c666585e99cffe79c1b8ce948389d7f0c78b1f835c443770480f0af4333aecb1283aaa45463f6b99d6157d549d075d18e7d065dae4e75ffa09848525d6cec03f5029d5e7e3f621111f36b95623a89cbe6f0baf8162b916f95fca3749f08ea06d87f429d237109fea9c7691b2947a11b1dca4e309bc78fb49a9c1cdbe09fddc009d85cbaa93cd5692b011bea118acecf8cf87af2db6a46b2c173e2fc35d2693d0cd8eb4d664db4c5307388c19c133df88ea065a24de33575c6e40845c116832f37e863df507e30dedca94504056f2ed07610680b59dcf71e03dca3bd321fac76fde484e40e0c5972ec678f4c3bc585c055ea5a2f732f0486e3c5edbf95bcf025a211e4ac87d186c3bbc7da5b66eacdb2123cdac4bdc317c7437ef15ca8b4c8f3ddb2d5afc9d9402b1b339b06923fa73328ae177e775b92b2238f9dd53e0c389481f0eb3efef124253e5ac3776c0508d779da0487f47c56779927b6f05a46cd6d2287b961e15233f293d5bf5d6a21f6f3d427eae50b92a9fd864a89dd63a3031e8c037c4d9cd2aeb8dd1599271b0784a6350f4f73639331d8d08c5703993d36b0c64303bf99794eb3e4818e4a4454fba58c81dbc3e9ad39d71a834186b78200602ac7435fa2cf27860393148c7ad7055efe6e29b6c013c73cfa830f841c7ffa04398db084f99e46c41a5020aaa77a42acc24eea01cb7fa6c2903a0a42023d1868024c981d2c5e91a85f3a727e5883e449d3eabbad3fef6cfbf23d0b0ddc6e3b9edc382a4f98b698ccd10eb568351961069629c3b31c4dbfa8287d5a1ad61bd56120706bad8c3ab40a18ff25c65c1203888a79a134383460b09ee3bc8c45e302743ede60ee23f463f3932611ff29f8c5dae5d37fee2625ca38738484029118ed09767fcc3e48024c475ede1fd3add875919c93612a9c11d14f502667f793070b79a9d26eceb3c5a543cc3b21ba3d22081ca1803b1aea2ae9e4b087f52d522e5bd424cf1efe34f2abe39f839e6bce589e1d2b79f7df273183c1221f6ff52b57980e365a28d2f2957df33d156d200fea4e87fc", 0x1000}, {&(0x7f0000001280)="8bef40510738fc4d557d10b74f84ae9b504f7f45d73519fba7553f36a60867efe50061d3588c677f3394dbb21b3136ca0b2c6fce49a53742107c0a3fb2ae4544842c90d49ca874cce788e2905fea1a0ed2c076bfab10b7ca96df5cdb2b4b7ba0dedd90c198cf05bebb834d38a5996f252905bff71b77783e2376139614b018a3", 0x80}, {&(0x7f0000001300)="3bbba6718482b9b3f1eba38cbb8249c76750e56b0e8a1741384b16b78dfd439adab46fd7fcb45ddfe66cf68187d2601cc13710aa139dd4fc9cde8454ad5a634a093d3e6b822b7c000a8f2ba35ae21c6d1e1c7cb96fe4604f49212ffb0eb42a91deef322d2961010fd1762a21a7c793b1d6ea61d6bc468afcaffecd1e86cd8c66236e4d7f9518065e469b15ca007319053df33588c64792aa78b543d05f7185fd88575f5a779fb32a56a0606e4cc791b427e8", 0xb2}], 0x3, 0x0, 0x0, 0x80}, 0x4c800) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r3, 0x84, 0x6e, &(0x7f00000000c0)=[@in={0x2, 0x4e23, @rand_addr}, @in6={0xa, 0x4e24, 0x968, @local={0xfe, 0x80, [], 0xaa}, 0x2}, @in6={0xa, 0x4e24, 0x1, @remote={0xfe, 0x80, [], 0xbb}, 0xad9b}, @in={0x2, 0x4e23, @multicast1=0xe0000001}, @in={0x2, 0x4e21, @rand_addr=0x9}], 0x68) 16:56:53 executing program 6: r0 = socket$inet_tcp(0x2, 0x1, 0x0) io_setup(0x20, &(0x7f00000001c0)=0x0) ioctl$EVIOCSABS3F(0xffffffffffffffff, 0x401845ff, &(0x7f0000000040)={0x80, 0x0, 0x0, 0x9, 0x3}) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0xa5, &(0x7f0000000040)}, &(0x7f0000000300)=0xfffffffffffffd14) io_submit(r1, 0x12f, &(0x7f00000000c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000001000)}]) socketpair$inet6_icmp_raw(0xa, 0x3, 0x3a, &(0x7f0000000000)={0xffffffffffffffff}) accept$inet6(r2, &(0x7f0000000080)={0x0, 0x0, 0x0, @ipv4={[], [], @rand_addr}}, &(0x7f0000000180)=0x1c) 16:56:53 executing program 7: syz_mount_image$msdos(&(0x7f0000000080)='msdos\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x9, &(0x7f0000001940)=[{&(0x7f0000000340)="0bb3a61536003d512fb621e96dd0c5b9b333fb2ec62ecf1057d55a7eac1a0d09e688c1ba88d899e24dceb06ae00fa0f9ebfb5a3d0b62e3853309fc5750cae171cd2552a2dc36c106cf201462b59fa9078625053adea5d015e0cdb7ad1b11d01b49956b035a3de43048a2dc487025bb21b1add110bccab27ee1de69abee60126a58c6e5", 0x83, 0x8}, {&(0x7f0000000400)="dcfb7d472bd57d", 0x7, 0x6}, {&(0x7f0000000440)="59506a526b08846d09e5f527dc8804ba6a1d37783f244dfbfd445dfd1b1d0537c0d7c17a182fd036e2a33d1d363311bfe55140cea6fd5ad3de6377cf908facddd09e84287ee0802c6b13ef783ddacd78be97227439fda4a88b379bfb6fb753de44a8943458edd4edd62775b15b0f05f263f40c51d54432b5cc315aed2c0a90f5088cd8217b73ce5455744e06bf0f9e6f411f67a6ff435e357e58af628d620ad5d1e54682753911d97b467ca8874abaf160e82aff1f590bc39e8df56935760bb0a12f007c53b587e36accc01d3c1af090163b5dfb2e0c09e3e2aa93a08c90e7a0f4d38d7226", 0xe5, 0x6}, {&(0x7f0000000540)="974543558fac042113a90c6ad4402aa3a91f1b096c69a8b0043695bff14bca85b2c6d5a906e5aa02c7e7dfcb353de99e977cf5327d8a51be83e443fec8be31d63f696f73c6344725d26aa66aaea6b37a4fa48fda39798c347f190feae974ef0f313bfb8648dcdb460ab7c902059fc27e33d193103c7c2f540285044312967e0c509d5e4f724ad55458a4765b3b3f4cf5821ba3e78e44e307ab63f923c2dc4b17e2c1e2527c87a2284737011b6c98be9c56c05bd80ade79e7160ca90c5051b236a515ec569e7715db2797bb55dccbf1185e63126452db385e44e6a1254d47a9409c7e6c764801d0e52166c1854c9c1d00bb4b0348c0a16e11b779da2717ecc833545b1469808341a23ddc0619784b9f427ad451a63915df0d1e6bf9d74c450d50f64cfc52cb7338c9c466ec3569f9d2f08aeca57a791bc678b97502f09b50877f099bd73216aed3f49bcc5568b9e970dea84f2639264416268f7d58077c18fe7960e1cd849349806930fc613ac0679cba6479ebe0e098462eb2123b370cea95e95abcd54d7b59b4a79327d2ff4057f47b286da39510490c506c8874ad3ddf7d692bb62c63cde084b1ada8bdcd0126531ba8716ebf221a0ccba627b82e877f8736da318dd397a201ee2113b1529787ecaea55d69cb9b470b4a34146ba92c0441a3736d6904c747e78a34881857f17ea1966da70f627fd5daf261953515dbc1eb23bfcaea728ae0081411fbd710a5709c2bc1b665e93a66cac31777eedf95bec848c9c58f4306223fdf2d7876bd75d93b76856c58acf3fb73b51d79edd09f36b9ef2da5dc3591b578c1a6c67fe5d346e3280c99827726ea3b451aa4a3a71d00090724eba5b5e62a662acf9ce82c47a6bca8987beb39ed3cf9849fc5bc53868bec4e813a22f1c68a9b0e1592de7074f6882c6650ee53d8cc18388cd6259bbe712d33e598e169ca576fdeba13f22254f159cc0dba9065dc591503cabd93a741f1358557a3f7b79cfe6116826f29bdce49feba086d42ca50c6f604732556c3e816943c4b04addb15719b63eeab6fa6e878f9c3be1755f849aa4e92ed2dacda333d95835850fa8be922fd212963b0a1ad9a5d42e41ba3f55104c71f20bb07286258a64141ad0d04605041f15bd3cccaab87d627abdb29e21e3f8183c5cf9dc4041f1ad8f5f1e3a1aec4e1951bdeff3a6dbd36753b30ee9dd6ffc62f3b81ed96d29b7a3883200202fb678c792220be1bf3bc4284dc7592decac6388596c973357255f6b2f595cdb7ad2506bdea8cfa254c587b773a26b49b0c8c02548418837ac1fc7591c83d820502abc1b304e13fdf842f50d6830bd107aee17dff5c131a6e3b536abaaedb3e24ae5cc245002cf7530edeab99fe4283d84fe22c1428bda636a863325877debbbd24056d8a2c4625971bdd91bcaaef9abd2521c107ec6358ad8566e2247aeb7b22d8cd5cfc3babfaad0087593ef5c6101da6f5eea448e291372135d0377372ef3a9753f3e933d10d9eaf4e064c9faa78a94b6c9a7506c67cf9cfec2a4a9415e0f12905c9b50cde278f43a6b688800454637688b6422b50f4dbfb58e1f64025a3787ddf13d82a139292066ec73beee90a3d69c62ba4f0100054d9bb050b496cb898010aa666fd0c86e80eaecb7c1e4d42c1b321da2337d85d9a5b0648a81c175b4650854ea91b03fe56c0a424812b4ab5a9f03df0db58a8885ce08d3674c128c0b832150c4c9b45406115f7fc03359a142c61a8e1620bbc7f7edefb2c2cd320344a62eaf142a6072e1b2c319098a9653293893c3df96051e1e308481176548c58641495007c1ade86ad9edf33efdf0b51577ceed127b9cf523c9e360cb0e1ed7dac1b070c7114729f60811ff0d9a5b53c3f008d57670f8a95f6b4448b52514c868e1be6d08920766c6572c8b0e961ea0d299c7898b7e3b8b95bcdd82a0ed87a903d8574aae0a6dcf2a275589bc511e31af47d45ff3393313bf4eaadb008e8fced6b8daab78777bddbacdbb0e2b1e7734ed6d8828e6c359ad08b082987c16e01eff08594b6f6023612ca57917b83d80ab4324517b4892b0899d0f13bdca7a22e4db0117cb713fc16c47b19221113e954078b7f6a9aa2160e7ab2b60ca9f1980351c2516766ccef05e1cbd75a72675288bc41d6653f765b2981ef18a2c358d52c6b343e4aef42dba0316613581e94822694074692945d8f344dc1000899e1cb1e2f00b43f33d253b123611a4acf0bf365c5cd8f481c352fbba948c3b37867b7607360446e1783ae3421b0d346013541eb09abb0dcedbced7923f2cb54ec2ad4dc0de5f7f874d462de66bae326171fd5e89836337418f3c2381413d846900e37001eb148702e3205a0d0eb43f0f94fb260a638d72820bd4df3b6aa9806fa77c6c76478dca1389b4b5c291332beb107c6c26465793bd7e246f7120d233888bba87c83311258efdf9dbe9b9f3fb876cb90ad6bb6763d20a723fd6b9e371e2d5b7fa2ec089526d097af9cf789618288c83fdac404e32c8a9da44c9f3dd21f028f7faece0dc6250f5a795a7f42943c24eea38ad55c722f2647ea63fd11f34acde0bd43dfc61d53df2fa2cf9662b8fc0bce7be04a90a895a23f8ed22f015c4776a32c27af28b8808bc23c5dd7d679544c21cdeaf4fc9c826878d590182af9e5bd56c29a501e41b059089b7326c2d1fe44cc35263489d3c91f2da3b51b05f0efd7f80d5395b33e40e52c6662989532c91f36c473401e3f9fd83ebd9b96852fce434b9c38efc11ea7b24134ba58297348ef5c61d3f101f074591c5304b7f7ec5ccc8a825700ead9241c7dbe38998766befd999fc3700076118c8211d8b2854cefc15ec87e19f8602ec49765ffa9464e19cf14cece79c58b249206327f28ffb2e944f6c92ecb4a9999238dd4b716f7cf4ea3db9a33e113247baf3a63132b717d71e4c71cf03be7d92942235eafdf1634055db734c4ce5f31b7f6f53e1d824d6e62eea4d2cda29cf80e619145709e065ccfafc92ce868868df8f7e7ebbe4def783cac214d391e33478bc4431907f62b8218793f7d56a196b1d60ee83de83427cb6be00fea6526e8c9079b72dfc616364fc0fbca5dd22024fc5a7515e810aa5c48ab30d79737d4858d57238672de4b69cc30048436a6e49f9e0c649fba57ac247d6073c4396fb9e8f96448bbfababe9a1d037ca2731a8d345ff217deb5d24c72cdf7cc349abd74b871a5439123e2c3f576463f73bf6eb6f02181ec118b1baa414c489195dc33465566c4bfdd635c935abd64f10ab92e944485707c6984e6c5392f57094b571d65f36c145b4cf9feb26a2af33d757487a7b224fad16620c94d16356161dd5921cd6485024fa59235a6e4d0f72a2d7f97d285c983ac06dee5ae70265e5f2e78faf62eab9d5370416b00e12b9d2b50ac239591626ed3afa71619ea7550f936835c1dbeea9105b1b7d44bed23d73a5cef34f6cf7e6c4729450ec8737ec66327f10dfad9a5871db272bfe623b094ccfec18b347007f6d0f9178b08454f8a87c61e86c52650f714ff12e11a7e22c22ca8ea6df88db11992eb7116bfaf8af4fc89f508cecc74451f7e414d687e3bed2d91a8dadcb3584ae3012cb968f3c4b991dbacae30d498d3c220cce4451d8a3ca5f269ce3436cabfe013e21b537fb68aee7461b9196e68a2ee3aa21d6d2bf82cf1a90ec81edc04f8976c24ab84ff59eb5205f38d8008e0e9923666c9109c3005762fabd2e6588818098124ba3459cd15eef45c4ae16b1fec1080bdf5dc7dbec93af962590e1baa5ad8b6836cdc7e5210644740e80a6fbba591315f862d4df0d3072dfb51bc4f76e08643ce3a22ba50117b0c2991d0eedee0fe8c9ae31524432d908f105a9388d19c6e0870bfae5f605db61a38e0bf7cfccc39e9000db78b5dc8ca041dc01d76fc5ee052e74708e5e903d1160e1156c2954c8c71b1884c0f6f86be595b152dca27ea5a078eebaab1296bc4c5c97c60690b7bd156df78233423c83ec781904ecee0fd737c787808c27dfd00de6123b62d9b127bdbcda1b67183322c628eefed78608080a40dee8f3b23c5618b6683819082488aba4fe8a1fa46985f1174a97ea289cdfb1d52100b5ce5c19b5363f1284d1c47f66cddb814f2bdbe1fa722f08e67dc9b569467822f0bd5c8159116c84d7b2f05a6d1b436d607718f85d9cfe79a2f698c0cb1faac9d62af51b0604fc8b54152c5851879751ef2b17a3ffba3fc1799718be6dc7148533b83a25c088a06893e26250db07471a1dafc8bad633dce7121eacf7ce1ff19f82ddb56ff4d603b7e0707020f982633352cbd235fc14b04e1d42edc76d18079fbcad5d2adb06756efd252449cccc6740f5a46f66a8551fded685fdb74e8e2e8bd72beab8e5c4e46b79fc6f5fc855e92f72b84aaa6eb4b5ab068472efeecf18d5040657fbb216a5dbc61bd7ffec1f2766dca2850560a664337d9da6549b773b7db65b4d7740bc0a47e17754bedc702972d95998ab404219728f20dfc5ad8873037cb7cac3281603b5ef709cbd6f8b1d5ae2738c671245a35a45173c671cb7d383530f2c495796750ef7b18fbc3727b0a49cd6725815b3336203d5a5b46aad3aeceeb079f6e9c4585683686810ca4d24dc51205bd9bbe6299213399fedb901c50eff3ea61d3ee4b483d2cc77c01db682c67e800e284fb9e1d8af5e78e46ded248ed853d383088531cf3c0b42d6810b4969e3ff76662bd0afadfc16fc14d0c8c74d370b8fc10a265107aea3599c475f699731b3b88afac1d6bbdb3fda647e4cd6778e12e56c1b4fda11d45b5d3a0b0753e9cbfc724d917379828e34c17868dad9c279736ed161f87c7ac4255abbc292f97ebff2df39ff59c0f735e14e8c865400b5aab939a681527d8c5c30489d827793da1bbfda90ec1714db4bf788a6fe4e74111d1ec9a52d8a7dbc5269afe80c1b31e337bc951d50923e6f278481419168386672e8e0279e44d5b843d8450c72462e7a08baa2746918cd4ec45d1dc15732701599ada1a4fb286af14503840cf90c6f3586183703aa3d5e577a6b9d42efc88058f163ab143d4c3545fddba6da7bf53f03b9eff7d33d3856ab6654b9b09da5908d221e1546eecc3933805e67c71c17e2e4fd0fb65604e70d73265b9b17bc48feec74f713bd510e79c72c5b50d3e6d17029335048e170cb9de764c222ca5202a7108729274d5406e266b7a28e8e44d01bdf76d8ea172671d742f0c1dca949e11ed09aaaabc4fee3c53ae3a53116e26f83736df553985b470d8410cf10376cab5ca7e073ab9cb791f2eaf713e764c615a550c392243a5b81bdeb59f8ce4b5f4788e84e8533d5c96aea1fd68c436db1badb01c01b842079b7b754d913adf294f549ab21d37dda9a7cdebccf610a7d5c748d52891614c3ea9e72b018817aa0b4cc9fc234a2518e9a2f4c56190a27c46a907d1d2f73cbb0d760ae491b93801187a6d21dc423e6e197959eda03ce75740db271f1ad7df7d12d085e5c7d204c20d8e126d213931cf53ab96ad03f9e1bb8de3f1f6d7c832f636742d72915a53fbec11b60487d16e35166a29ad9e2b798b3d59b7c8b000d8f432e03a4ee8da3c75f571c2d52daf6a9e43d877975f64a6e1408a378508453359686c59fa06ace09bf53b8d7019653516ee82558e1ef7e092b3eb085189452c13d102114712fb89c503f9fd81ed432638632c80c8210a4b480de58b648eb2dbf333f9a622ff12508c9b1b26085caf9b21582f734138521b1207a38cf655b0c6469f1bf581ab4481808cbc0959a7152cb325e6", 0x1000, 0x1}, {&(0x7f0000001540)="6bbe6bfd78ec9bfb210c88e63ea9a4bc92c9306e0061f9b5a05ad18f211609ff257b610ead876a84ffa64d46327218fcca67dd80b9f5f12f30987f9a36ff12d353d4816acea4a96b7329910e54bdcd0fb716e8800c117975cafac88c4f4bc7fabb3f01f1a3874ea2089cd5df12e9c68365966289ea925447e0f5737353ce56ad37739f11a52914caedb3afa9fd181621a5cf78fed57a80", 0x97, 0xc403}, {&(0x7f0000001600)="0d3e21a61df34d23a7", 0x9, 0x43}, {&(0x7f0000001640)="5c10c41bba015340297cc23ae46e1205b6f5ef7be499a080a1afd53ed5dfe61fd3950e386f2be16f4c555c5324bfb394535de7b2e820d5c907b44e2a5591dcbc6d0bfd906a92bfbe49a5f3e9bbcde1e6121693c958d16c41c53a4dde803c8ce44df0e6cc2af891d0ad864f02df80d7407a4c70b9a401501ccf1e215cf5324e7a15142be465142bcd92193c4219edc4133d05121b4230d917c481224daa1d201cd0a4b5f3bd930d67eff29ff63914b9bee8bb7748cc86ebd5de5a45884ddf742860de33e1f5681b6289751bf940065f8cb57d60ca0f671866db3b45589064", 0xde, 0x8}, {&(0x7f0000001740)="f868768361b3a3ded4a30496c550c60770b67d97c39a2612b7a630bf11c5f214520ab84c55fff754cb60df6aa70d119d0fece18e8e1256feb0d9dfd5dae4a4591a2772171800147b2015691ea5dcda4292d8983b6953013cef19fb41056cc31cc9d7a32b5725ab2ebc097de40ef65129a33c95d0055ca17dafbfc7df67ff59ba02bbfdec0ae64598268e221748dba2c1bf5df238f2ad99a08f7b9bfe49d7fb0bdafc30c45d08713c6efdd6db706bc5f22b042f214e3d5ebec2a5aace6de41a3ece67175ec5151ca9e515dc8c1a499150eedfa0964e2d", 0xd6}, {&(0x7f0000001840)="2de81d71fe6ce0bc6400704f87725ad6360e669e65f40e69a8bbe734f60b6e3c0d6f7352f93f009801113a572ce338bcb4af65f4426c910792b57071ee8bbaed17d161407c3ab0452313e6ed0d72e632b0b44c41b65ba68d9da2c1734e88b0db852b67e9bed730f641f3919f66e4f0e25501e2e0adabe74d7ee6800db82307db21c115192a9cc5e4e21d7b565a4bfb28a107280fbc5cf8273962ab8ab76aec7f04f73265cfb36fe8d9f5d3110b2bf77cbe4dc89685ebc2c47ed4567b3e53a23c9f9cdf241a780daef5ac571412eda1cc3f8d4f01bd5f4310ef5c3089e42bafc63779ab32c6cd4bb943", 0xe9, 0x2d0000000000000}], 0x0, &(0x7f0000000240)=ANY=[@ANYPTR64, @ANYRES32, @ANYRESDEC]) r0 = dup(0xffffffffffffff9c) ioctl$EVIOCGSW(r0, 0x8040451b, &(0x7f0000000000)=""/1) openat$ashmem(0xffffffffffffff9c, &(0x7f0000001b40)='/dev/ashmem\x00', 0x0, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000001bc0)='/dev/snd/controlC#\x00', 0x9, 0x400) write$9p(r0, &(0x7f0000000280)="bd90473a7111e7302e3f315606209a8b3dd565f4edcea15ca932e383c711c893ec3b2d3bc7628cb738ff55bfddc22239d403ee86312f93d98fe6077021f70c850bd0a3c6465fcb979f6278b09566c5ba549fb05b442fe2", 0x57) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000300)={0x0, 0x7}, &(0x7f0000001a40)=0x8) open$dir(&(0x7f0000001b80)='./file1\x00', 0x10000, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000001a80)={r2, 0x3, 0x4, [0x2, 0x6, 0x9, 0x2]}, &(0x7f0000001ac0)=0x10) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r1, 0xc10c5541, &(0x7f0000000100)={0x101, 0x7c, 0x44b, 0x0, 0x0, [], [], [], 0x5, 0xee}) ioctl$IOC_PR_REGISTER(r0, 0x401870c8, &(0x7f0000001b00)={0x48, 0x4, 0x1}) 16:56:53 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) listen(r0, 0xfffffffffffffff9) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000013000)={0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000004ff0)={0x2, &(0x7f0000002fe8)=[{0x7}, {0x6}]}, 0x10) 16:56:53 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:53 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000cd0700000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:53 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff9c, 0x10dd}, 0x2c) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x5, &(0x7f0000000100)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0xffffffa5, 0x0, 0x2, 0xe8030000}, [@ldst={0x7, 0x18d1fb, 0x0, 0x1d1}], {0x95}}, &(0x7f0000003ff6)='syzkaller\x00', 0x1, 0x3e9, &(0x7f000000cf3d)=""/195}, 0x48) r1 = memfd_create(&(0x7f0000000000)='syzkaller\x00', 0x2) ioctl$UFFDIO_WAKE(r1, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000012000/0x2000)=nil, 0x2000}) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000140)={@in={{0x2, 0x4e23, @multicast1=0xe0000001}}, 0x4000000, 0x2, 0x47fd, "37b9617311eb8320e3ba37ad643fe54ec85b7e3a2dd9acd92fe3b99f6240fceb12bfe684b25839c0dc1f3893b8119770843f34d969bb9eed2719cb08f99a5ff0b26b40c389e36a701b1c2d853f3a2fb5"}, 0xd8) [ 296.112808] binder: 21080:21088 BC_REQUEST_DEATH_NOTIFICATION invalid ref 196608 [ 296.120979] binder: 21080:21088 unknown command 4743953 [ 296.126672] binder: 21080:21088 ioctl c0306201 20000000 returned -22 [ 296.137952] binder: 21080:21088 BC_REQUEST_DEATH_NOTIFICATION invalid ref 196608 [ 296.146631] binder: 21080:21088 unknown command 4743953 [ 296.152506] binder: 21080:21088 ioctl c0306201 20000000 returned -22 [ 296.200272] FAULT_INJECTION: forcing a failure. [ 296.200272] name failslab, interval 1, probability 0, space 0, times 0 [ 296.211575] CPU: 0 PID: 21097 Comm: syz-executor2 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 296.219978] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 296.229329] Call Trace: [ 296.231915] dump_stack+0x1c9/0x2b4 [ 296.235539] ? dump_stack_print_info.cold.2+0x52/0x52 [ 296.240726] ? lock_is_held_type+0x210/0x210 [ 296.245135] should_fail.cold.4+0xa/0x11 [ 296.249191] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 296.254282] ? __update_load_avg_blocked_se.isra.34+0x460/0x460 [ 296.260980] ? update_load_avg+0x2de/0x2590 [ 296.265297] ? update_load_avg+0x2de/0x2590 [ 296.269603] ? lock_release+0xa30/0xa30 [ 296.273566] ? __account_cfs_rq_runtime+0x770/0x770 [ 296.278574] ? attach_entity_load_avg+0x860/0x860 [ 296.283402] ? attach_entity_load_avg+0x860/0x860 [ 296.288238] ? idle_cpu+0x1d0/0x1d0 [ 296.291864] ? kasan_check_read+0x11/0x20 [ 296.297309] ? do_raw_spin_unlock+0xa7/0x2f0 [ 296.301709] ? rb_erase+0x3550/0x3550 [ 296.305511] ? select_idle_sibling+0xcc/0xd90 [ 296.309997] ? kasan_check_write+0x14/0x20 [ 296.314225] __should_failslab+0x124/0x180 [ 296.318458] should_failslab+0x9/0x14 [ 296.322247] kmem_cache_alloc+0x47/0x760 [ 296.326306] ? lock_acquire+0x1e4/0x540 [ 296.330268] ? is_bpf_text_address+0xae/0x170 [ 296.334748] ? lock_downgrade+0x8f0/0x8f0 [ 296.338901] radix_tree_node_alloc.constprop.19+0x1e6/0x310 [ 296.344602] idr_get_free+0x887/0x10d0 [ 296.348487] ? radix_tree_iter_tag_clear+0xd0/0xd0 [ 296.353403] ? __kernel_text_address+0xd/0x40 [ 296.357895] ? unwind_get_return_address+0x61/0xa0 [ 296.362817] ? __save_stack_trace+0x8d/0xf0 [ 296.367211] ? save_stack+0xa9/0xd0 [ 296.370821] ? save_stack+0x43/0xd0 [ 296.374444] ? kasan_kmalloc+0xc4/0xe0 [ 296.378311] ? kasan_slab_alloc+0x12/0x20 [ 296.382439] ? kmem_cache_alloc+0x12e/0x760 [ 296.386742] ? __kernfs_new_node+0xef/0x5a0 [ 296.391049] ? kernfs_new_node+0x80/0xf0 [ 296.395095] ? kernfs_create_dir_ns+0x3d/0x140 [ 296.399669] ? internal_create_group+0x3c9/0x9e0 [ 296.404415] ? sysfs_create_group+0x1f/0x30 [ 296.409262] ? lo_ioctl+0x1307/0x1d70 [ 296.413064] ? block_ioctl+0xee/0x130 [ 296.416852] ? do_vfs_ioctl+0x1de/0x1720 [ 296.420896] ? ksys_ioctl+0xa9/0xd0 [ 296.424526] ? __x64_sys_ioctl+0x73/0xb0 [ 296.428582] ? do_syscall_64+0x1b9/0x820 [ 296.432629] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 296.437997] ? trace_hardirqs_on+0x10/0x10 [ 296.442229] ? reweight_task+0x130/0x130 [ 296.446294] ? blkdev_ioctl+0x9cd/0x2030 [ 296.450339] idr_alloc_u32+0x1d4/0x3a0 [ 296.454227] ? __fprop_inc_percpu_max+0x2d0/0x2d0 [ 296.459062] ? lock_acquire+0x1e4/0x540 [ 296.463027] ? __kernfs_new_node+0x116/0x5a0 [ 296.467428] idr_alloc_cyclic+0x173/0x360 [ 296.471565] ? idr_alloc+0x1b0/0x1b0 [ 296.475262] ? kasan_check_write+0x14/0x20 [ 296.479485] ? do_raw_spin_lock+0xc1/0x200 [ 296.483705] __kernfs_new_node+0x1ab/0x5a0 [ 296.487928] ? kernfs_dop_revalidate+0x3c0/0x3c0 [ 296.492671] ? bd_set_size+0x2c1/0x370 [ 296.496543] ? lock_downgrade+0x8f0/0x8f0 [ 296.500681] ? enqueue_entity+0x2130/0x2130 [ 296.504991] ? lock_release+0xa30/0xa30 [ 296.508955] ? check_same_owner+0x340/0x340 [ 296.513259] ? lock_acquire+0x1e4/0x540 [ 296.517216] ? rcu_note_context_switch+0x730/0x730 [ 296.522129] ? lock_downgrade+0x8f0/0x8f0 [ 296.526262] kernfs_new_node+0x80/0xf0 [ 296.530135] kernfs_create_dir_ns+0x3d/0x140 [ 296.534539] internal_create_group+0x3c9/0x9e0 [ 296.539105] ? do_raw_spin_lock+0xc1/0x200 [ 296.543322] sysfs_create_group+0x1f/0x30 [ 296.547468] lo_ioctl+0x1307/0x1d70 [ 296.551079] ? lo_rw_aio_complete+0x450/0x450 [ 296.555567] blkdev_ioctl+0x9cd/0x2030 [ 296.559440] ? lock_acquire+0x1e4/0x540 [ 296.563398] ? blkpg_ioctl+0xc40/0xc40 [ 296.567275] ? lock_release+0xa30/0xa30 [ 296.571244] ? save_stack+0xa9/0xd0 [ 296.574863] ? save_stack+0x43/0xd0 [ 296.578473] ? __fget+0x4d5/0x740 [ 296.581920] ? ksys_dup3+0x690/0x690 [ 296.585635] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 296.590208] ? kasan_check_write+0x14/0x20 [ 296.594428] ? do_raw_spin_lock+0xc1/0x200 [ 296.598648] block_ioctl+0xee/0x130 [ 296.602258] ? blkdev_fallocate+0x400/0x400 [ 296.606565] do_vfs_ioctl+0x1de/0x1720 [ 296.610437] ? ioctl_preallocate+0x300/0x300 [ 296.614838] ? __fget_light+0x2f7/0x440 [ 296.618805] ? fget_raw+0x20/0x20 [ 296.622244] ? trace_hardirqs_on+0xd/0x10 [ 296.626376] ? kmem_cache_free+0x22e/0x2d0 [ 296.630595] ? putname+0xf7/0x130 [ 296.634040] ? do_sys_open+0x3cb/0x720 [ 296.639061] ? security_file_ioctl+0x94/0xc0 [ 296.643465] ksys_ioctl+0xa9/0xd0 [ 296.646903] __x64_sys_ioctl+0x73/0xb0 [ 296.650774] do_syscall_64+0x1b9/0x820 [ 296.655262] ? finish_task_switch+0x1d3/0x870 [ 296.659747] ? syscall_return_slowpath+0x5e0/0x5e0 [ 296.664659] ? syscall_return_slowpath+0x31d/0x5e0 [ 296.669584] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 296.674586] ? prepare_exit_to_usermode+0x291/0x3b0 [ 296.679587] ? perf_trace_sys_enter+0xb10/0xb10 [ 296.684246] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 296.689078] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 296.694249] RIP: 0033:0x455927 [ 296.697416] Code: 48 83 c4 08 48 89 d8 5b 5d c3 66 0f 1f 84 00 00 00 00 00 48 89 e8 48 f7 d8 48 39 c3 0f 92 c0 eb 92 66 90 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 7d bb fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 296.716692] RSP: 002b:00007f088c102a88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 296.724413] RAX: ffffffffffffffda RBX: 0000000020000190 RCX: 0000000000455927 [ 296.731671] RDX: 0000000000000014 RSI: 0000000000004c00 RDI: 0000000000000015 [ 296.738928] RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000000a 16:56:54 executing program 2 (fault-call:2 fault-nth:11): mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:56:54 executing program 6: socket$alg(0x26, 0x5, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0) syz_open_dev$dmmidi(&(0x7f0000000100)='/dev/dmmidi#\x00', 0x1000, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x7, 0x400a02) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod(&(0x7f0000000100)='./file0\x00', 0x1040, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x207e, 0x0) r2 = dup2(r0, r1) perf_event_open(&(0x7f00000002c0)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x101d}, 0x2c) r3 = memfd_create(&(0x7f0000033ff3)='\x00', 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x1, 0x0, 0x0, 0x9, 0x10000003, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$sndseq(&(0x7f0000027ff3)='/dev/snd/seq\x00', 0x0, 0x20005) r5 = dup2(r4, r3) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r5, 0xc08c5332, &(0x7f0000037000)={0x0, 0x0, 0x0, "9ede7a8c5ae95e48000000000000007f4f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa0500000074dbcfa6dc4d"}) syz_open_dev$adsp(&(0x7f00000012c0)='/dev/adsp#\x00', 0x0, 0x501080) write$sndseq(r3, &(0x7f000000a000)=[{0x0, 0x3, 0x0, 0x0, @tick=0xfffffffffffffffd, {}, {}, @ext={0x0, &(0x7f0000038ffe)}}], 0x30) r6 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000240)={0x73, 0x79, 0x7a}, 0x0, 0x0, r6) r7 = socket$inet6(0xa, 0x1000400000005, 0x200000) ioctl$SG_GET_SG_TABLESIZE(r2, 0x227f, &(0x7f0000000340)) ioctl(r7, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r8 = socket(0x10, 0x803, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r8, 0x8914, &(0x7f0000000000)={'team0\x00'}) ioctl$sock_inet_SIOCSIFFLAGS(r8, 0x8923, &(0x7f0000000040)={'bond_slave_1\x00', 0xc201}) ioctl(r5, 0x3, &(0x7f00000006c0)="91c94476dd37ed594eeaeb6a7ad288cb17547931d7d1e20af5f983d2c2dd1cebb4e67e43f8f9bf1a4fe49d127f9e0e8a740e75424902bf4b7eba6afa6a1a94ccda04beed7a1f1ac45abe1ee57f0dc46fc8c5ab164f314053401226e6fa0016f04a02739186105d594210e770a595dd63953ed095f5528c55159af6266023cf74b2e8cda62be6d62b8a7d4ef5bb85f4e64cb767a49c5e1bf4bc3f01a43796b19836073fe9feb971a708b71134918817f00ea810b7bf7a666d0f7dc96f188073df518060d48c8f360214300e646ea9189f05162790181ce498e2de0be4c6c15907bb209c5894c493469286ba1bc516c7ea001f9d0d23d955531b66d7a35d527c90f9ebab72041e09c642f52c88b5661524d99b2fb16227ee4a57415b8072d92e3bc48e50642a32d76b68b64d54e3bce41165143ac8c53dd18395efa1ef36e956") sendmsg$nl_route(r3, &(0x7f0000000580)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000540)={&(0x7f0000000b80)=ANY=[@ANYBLOB="80000053210000022c0700000000000000148004010000000700000011faffff13000100fe8000000000000000000000000000bb14000200fe80000000000200000000000800001a14000100000000000000000000000000000000001400020000000200000000220000001f00eb2dc8707578cb5576c1c979c094a057489fbd930a54b06a4370f0c9010000000100000024db5db7cf2d4ff55f6536995594e452d727ce1c5f8a5b6d62000000001ec25a12b07e0f62cfa3656c836e5c3a6d2aae6e41e91d31752da8b2839024777702ae779b7a698258e300aa37b0c7e077879a47dbff117755e17fe735169a2c6204da44c405f740fcb37ace0b9fe17615f93eca7f2f719bfc87eb7301711dd854c60f0a772a70939f5ef16176d6476a1251c4cf42be1cffb92cfdf6f44165e4b4c4b4344b6a6177ef32d03f247199247f6286b1de3b92789ef51a000000000000000000000000000000afda344f831fc5152db7a6b1fe211a1de53770525d054377c47995fdfb9d743f7dcbd310f363a112954748a0b474d8c6bcdb6cb7369589a73ab0849991c1f4417c485efc29e42fcacf34b8e8a5566b8e7b59fb63e94925ff8d33cfbb0ea48d6647086e715a55de85174a43fcad2563618376d9630041d32695c6385880838ca2ab028171fbb6ffb01bb2463ac94f01b5e43b298c9881bcf74821984d1553"], 0x1}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r4, 0x4040534e, &(0x7f0000000080)={0x4a48b125e13656b}) openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400000, 0x0) [ 296.746182] R10: 0000000000000075 R11: 0000000000000246 R12: 0000000000000014 [ 296.753436] R13: 0000000000000000 R14: 00000000004d3c90 R15: 000000000000000a [ 296.762127] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 296.779126] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue 16:56:54 executing program 0: r0 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0x5, 0x2000) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f00000001c0)='cpu&3\n?\x00') r1 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x40082406, &(0x7f0000000000)='cpu&3\n?\x00\x00') getsockopt$inet_opts(r1, 0x0, 0xd, &(0x7f0000000040)=""/120, &(0x7f00000000c0)=0x78) 16:56:54 executing program 1: r0 = socket$inet6(0xa, 0x3, 0xffffffffffffff80) setsockopt$inet6_int(r0, 0x29, 0xcf, &(0x7f0000000180), 0x4) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) r3 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r3, 0x40405514, &(0x7f0000000140)={0x4, 0x0, 0x7fffffff, 0x3f, '\x00', 0x7269}) r4 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r4, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f00000003c0)=@broute={'broute\x00', 0x20, 0x3, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000440], 0x0, &(0x7f0000000000), &(0x7f0000000440)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000022af4f901ff2cdb1f1c3d5d74442b4c900000000000000170000000000000000200000000000000000"]}, 0x101) ioctl$TIOCLINUX6(r3, 0x541c, &(0x7f0000000080)={0x6}) ioctl(r2, 0x8912, &(0x7f00000000c0)="025cc83d6d345f8f762070") getsockopt$EBT_SO_GET_INIT_INFO(r3, 0x0, 0x82, &(0x7f00000001c0)={'broute\x00'}, &(0x7f0000000240)=0x78) bind$inet6(r2, &(0x7f0000000100)={0xa, 0x4000000004e20, 0x8, @local={0xfe, 0x80, [], 0xaa}, 0xa7}, 0x1c) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0xf}, 0x3}, 0x1c) [ 296.953361] FAT-fs (loop7): invalid media value (0x9a) [ 296.958721] FAT-fs (loop7): Can't find a valid FAT filesystem 16:56:54 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:54 executing program 7: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c0000001900b5e6fc2e0000000000001d01000000000000000000009bc74f587764060000000000000024738f10b823a62859d1557782fb36b73b66ecea7b57353373cb1b31a655efcd9458cecb9f665549a4e4dda5269972b2a21ef246d7e279888e747b9424ff02c20eb6ff221b493a48be67ed4b96763969af653bedac5e6226d4cd20866e5512d96187edb151722dac497e1f7031d49d41e77b6ab9daf80a14c449cf28e1e4a213"], 0x1}, 0x1}, 0x0) [ 296.995864] FAT-fs (loop7): invalid media value (0x9a) [ 297.001317] FAT-fs (loop7): Can't find a valid FAT filesystem 16:56:54 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x40001, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$inet6(0xa, 0x6, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r3 = syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x4, 0x2000) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000000200)={0x0, 0x1, 0x5}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r3, 0x84, 0x7c, &(0x7f0000000280)={r4, 0x7fffffff, 0x8}, &(0x7f00000002c0)=0x8) ustat(0xfffffffffffffff8, &(0x7f0000000000)) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x202) r6 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0) unlinkat(r6, &(0x7f0000000080)='./file0\x00', 0x0) ioctl$PIO_UNISCRNMAP(0xffffffffffffffff, 0x4b6a, &(0x7f0000000140)="2b78a0aa2abe1bb4bb333551023460d69bac8bb47d00e78f26ad10bd5a29215d6a11b76192fad173b043efe8895240749a1e9f5b901a2c82759a83c86ab7b9e73e5eadde8844f2b73660ac1ccbf0557b8f2f6bce22d4a47a748237d8f11908fe6b379ec9a9ce31747a64f2be47d2c126d155") ioctl$KVM_GET_VCPU_EVENTS(r5, 0x4400ae8f, &(0x7f00000000c0)) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) [ 297.100854] binder: 21115:21129 BC_REQUEST_DEATH_NOTIFICATION invalid ref 130875392 [ 297.108956] binder: 21115:21129 unknown command 4743953 [ 297.114444] binder: 21115:21129 ioctl c0306201 20000000 returned -22 [ 297.131399] binder: 21115:21129 BC_REQUEST_DEATH_NOTIFICATION invalid ref 130875392 [ 297.139421] binder: 21115:21129 unknown command 4743953 16:56:54 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000480000000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 297.145014] binder: 21115:21129 ioctl c0306201 20000000 returned -22 [ 297.194945] FAULT_INJECTION: forcing a failure. [ 297.194945] name failslab, interval 1, probability 0, space 0, times 0 [ 297.206428] CPU: 0 PID: 21135 Comm: syz-executor2 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 297.214843] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 297.224200] Call Trace: [ 297.226799] dump_stack+0x1c9/0x2b4 [ 297.230436] ? dump_stack_print_info.cold.2+0x52/0x52 [ 297.235646] should_fail.cold.4+0xa/0x11 [ 297.239706] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 297.244811] ? kasan_check_write+0x14/0x20 [ 297.249059] ? __mutex_lock+0x6c4/0x1680 [ 297.253131] ? kernfs_activate+0x8e/0x2c0 [ 297.257289] ? mutex_trylock+0x2b0/0x2b0 [ 297.261362] ? kasan_check_write+0x14/0x20 [ 297.265599] ? __mutex_lock+0x6c4/0x1680 [ 297.269662] ? kernfs_add_one+0x4f/0x4d0 [ 297.273730] ? lock_acquire+0x1e4/0x540 [ 297.277707] ? fs_reclaim_acquire+0x20/0x20 [ 297.282030] ? lock_downgrade+0x8f0/0x8f0 [ 297.286200] ? check_same_owner+0x340/0x340 [ 297.290701] ? kernfs_add_one+0x2d4/0x4d0 [ 297.294853] ? rcu_note_context_switch+0x730/0x730 [ 297.299786] __should_failslab+0x124/0x180 [ 297.304031] should_failslab+0x9/0x14 [ 297.307832] kmem_cache_alloc+0x2af/0x760 [ 297.311989] ? wait_for_completion+0x8d0/0x8d0 [ 297.316583] ? kasan_check_read+0x11/0x20 [ 297.320733] ? do_raw_spin_unlock+0xa7/0x2f0 [ 297.325141] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 297.330158] __kernfs_new_node+0xef/0x5a0 [ 297.334306] ? kernfs_dop_revalidate+0x3c0/0x3c0 [ 297.339071] ? kasan_check_write+0x14/0x20 [ 297.343307] ? __kernfs_new_node+0x426/0x5a0 [ 297.347732] ? mutex_unlock+0xd/0x10 [ 297.351452] ? kernfs_activate+0x21a/0x2c0 [ 297.355696] kernfs_new_node+0x80/0xf0 [ 297.359588] __kernfs_create_file+0x4d/0x330 [ 297.364007] sysfs_add_file_mode_ns+0x21a/0x560 [ 297.368685] internal_create_group+0x26d/0x9e0 [ 297.373271] sysfs_create_group+0x1f/0x30 [ 297.377407] lo_ioctl+0x1307/0x1d70 [ 297.381028] ? lo_rw_aio_complete+0x450/0x450 [ 297.385509] blkdev_ioctl+0x9cd/0x2030 [ 297.389385] ? lock_acquire+0x1e4/0x540 [ 297.393353] ? blkpg_ioctl+0xc40/0xc40 [ 297.397227] ? lock_release+0xa30/0xa30 [ 297.401200] ? save_stack+0xa9/0xd0 [ 297.404815] ? save_stack+0x43/0xd0 [ 297.408429] ? __fget+0x4d5/0x740 [ 297.411867] ? ksys_dup3+0x690/0x690 [ 297.415565] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 297.420148] ? kasan_check_write+0x14/0x20 [ 297.424366] ? do_raw_spin_lock+0xc1/0x200 [ 297.428589] block_ioctl+0xee/0x130 [ 297.432212] ? blkdev_fallocate+0x400/0x400 [ 297.436519] do_vfs_ioctl+0x1de/0x1720 [ 297.440395] ? ioctl_preallocate+0x300/0x300 [ 297.444787] ? __fget_light+0x2f7/0x440 [ 297.448745] ? fget_raw+0x20/0x20 [ 297.452184] ? trace_hardirqs_on+0xd/0x10 [ 297.456316] ? kmem_cache_free+0x22e/0x2d0 [ 297.460542] ? putname+0xf7/0x130 [ 297.463982] ? do_sys_open+0x3cb/0x720 [ 297.467859] ? security_file_ioctl+0x94/0xc0 [ 297.472251] ksys_ioctl+0xa9/0xd0 [ 297.475700] __x64_sys_ioctl+0x73/0xb0 [ 297.479573] do_syscall_64+0x1b9/0x820 [ 297.483444] ? finish_task_switch+0x1d3/0x870 [ 297.487926] ? syscall_return_slowpath+0x5e0/0x5e0 [ 297.492852] ? syscall_return_slowpath+0x31d/0x5e0 [ 297.497766] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 297.502767] ? prepare_exit_to_usermode+0x291/0x3b0 [ 297.507782] ? perf_trace_sys_enter+0xb10/0xb10 [ 297.512436] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 297.517266] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 297.522528] RIP: 0033:0x455927 [ 297.525699] Code: 48 83 c4 08 48 89 d8 5b 5d c3 66 0f 1f 84 00 00 00 00 00 48 89 e8 48 f7 d8 48 39 c3 0f 92 c0 eb 92 66 90 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 7d bb fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 297.544899] RSP: 002b:00007f088c102a88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 297.552593] RAX: ffffffffffffffda RBX: 0000000020000190 RCX: 0000000000455927 [ 297.559845] RDX: 0000000000000014 RSI: 0000000000004c00 RDI: 0000000000000015 [ 297.567274] RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000000a [ 297.574527] R10: 0000000000000075 R11: 0000000000000246 R12: 0000000000000014 [ 297.581778] R13: 0000000000000000 R14: 00000000004d3c90 R15: 000000000000000b 16:56:54 executing program 6: socket$alg(0x26, 0x5, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0) syz_open_dev$dmmidi(&(0x7f0000000100)='/dev/dmmidi#\x00', 0x1000, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x7, 0x400a02) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod(&(0x7f0000000100)='./file0\x00', 0x1040, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x207e, 0x0) r2 = dup2(r0, r1) perf_event_open(&(0x7f00000002c0)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x101d}, 0x2c) r3 = memfd_create(&(0x7f0000033ff3)='\x00', 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x1, 0x0, 0x0, 0x9, 0x10000003, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$sndseq(&(0x7f0000027ff3)='/dev/snd/seq\x00', 0x0, 0x20005) r5 = dup2(r4, r3) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r5, 0xc08c5332, &(0x7f0000037000)={0x0, 0x0, 0x0, "9ede7a8c5ae95e48000000000000007f4f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa0500000074dbcfa6dc4d"}) syz_open_dev$adsp(&(0x7f00000012c0)='/dev/adsp#\x00', 0x0, 0x501080) write$sndseq(r3, &(0x7f000000a000)=[{0x0, 0x3, 0x0, 0x0, @tick=0xfffffffffffffffd, {}, {}, @ext={0x0, &(0x7f0000038ffe)}}], 0x30) r6 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000240)={0x73, 0x79, 0x7a}, 0x0, 0x0, r6) r7 = socket$inet6(0xa, 0x1000400000005, 0x200000) ioctl$SG_GET_SG_TABLESIZE(r2, 0x227f, &(0x7f0000000340)) ioctl(r7, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r8 = socket(0x10, 0x803, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r8, 0x8914, &(0x7f0000000000)={'team0\x00'}) ioctl$sock_inet_SIOCSIFFLAGS(r8, 0x8923, &(0x7f0000000040)={'bond_slave_1\x00', 0xc201}) ioctl(r5, 0x3, &(0x7f00000006c0)="91c94476dd37ed594eeaeb6a7ad288cb17547931d7d1e20af5f983d2c2dd1cebb4e67e43f8f9bf1a4fe49d127f9e0e8a740e75424902bf4b7eba6afa6a1a94ccda04beed7a1f1ac45abe1ee57f0dc46fc8c5ab164f314053401226e6fa0016f04a02739186105d594210e770a595dd63953ed095f5528c55159af6266023cf74b2e8cda62be6d62b8a7d4ef5bb85f4e64cb767a49c5e1bf4bc3f01a43796b19836073fe9feb971a708b71134918817f00ea810b7bf7a666d0f7dc96f188073df518060d48c8f360214300e646ea9189f05162790181ce498e2de0be4c6c15907bb209c5894c493469286ba1bc516c7ea001f9d0d23d955531b66d7a35d527c90f9ebab72041e09c642f52c88b5661524d99b2fb16227ee4a57415b8072d92e3bc48e50642a32d76b68b64d54e3bce41165143ac8c53dd18395efa1ef36e956") sendmsg$nl_route(r3, &(0x7f0000000580)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000540)={&(0x7f0000000b80)=ANY=[@ANYBLOB="80000053210000022c0700000000000000148004010000000700000011faffff13000100fe8000000000000000000000000000bb14000200fe80000000000200000000000800001a14000100000000000000000000000000000000001400020000000200000000220000001f00eb2dc8707578cb5576c1c979c094a057489fbd930a54b06a4370f0c9010000000100000024db5db7cf2d4ff55f6536995594e452d727ce1c5f8a5b6d62000000001ec25a12b07e0f62cfa3656c836e5c3a6d2aae6e41e91d31752da8b2839024777702ae779b7a698258e300aa37b0c7e077879a47dbff117755e17fe735169a2c6204da44c405f740fcb37ace0b9fe17615f93eca7f2f719bfc87eb7301711dd854c60f0a772a70939f5ef16176d6476a1251c4cf42be1cffb92cfdf6f44165e4b4c4b4344b6a6177ef32d03f247199247f6286b1de3b92789ef51a000000000000000000000000000000afda344f831fc5152db7a6b1fe211a1de53770525d054377c47995fdfb9d743f7dcbd310f363a112954748a0b474d8c6bcdb6cb7369589a73ab0849991c1f4417c485efc29e42fcacf34b8e8a5566b8e7b59fb63e94925ff8d33cfbb0ea48d6647086e715a55de85174a43fcad2563618376d9630041d32695c6385880838ca2ab028171fbb6ffb01bb2463ac94f01b5e43b298c9881bcf74821984d1553"], 0x1}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r4, 0x4040534e, &(0x7f0000000080)={0x4a48b125e13656b}) openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400000, 0x0) 16:56:54 executing program 2 (fault-call:2 fault-nth:12): mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) [ 297.591908] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 297.607976] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue 16:56:54 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(r0, &(0x7f0000000340)={&(0x7f0000000080)=@ll, 0x80, &(0x7f0000000200)=[{&(0x7f0000000100)=""/34, 0x22}, {&(0x7f00000001c0)=""/39, 0x27}], 0x2, &(0x7f0000000240)=""/210, 0xd2, 0x7}, 0x102) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authencesn(sha224-avx,xts-camellia-aesni-avx2)\x00'}, 0x58) bind$alg(r0, &(0x7f0000000000)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_sha256\x00'}, 0x58) getsockopt$IP_VS_SO_GET_TIMEOUT(r0, 0x0, 0x486, &(0x7f0000000380), &(0x7f00000003c0)=0xc) 16:56:54 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) clock_adjtime(0x7, &(0x7f0000000140)={0xb19800, 0x800, 0x81, 0x100000000, 0x9, 0xc29, 0x8, 0x8, 0x40, 0x9d8, 0x8000, 0x8, 0xa45, 0x7, 0xf524, 0x5, 0x100, 0x9, 0x7, 0xffffffffffffffff, 0x4, 0x9, 0x1, 0x8, 0xe6, 0x7f}) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000000)) syz_mount_image$iso9660(&(0x7f00000000c0)='iso9660\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, &(0x7f0000000240), 0x0, &(0x7f00000003c0)={[{@block={'block', 0x3d, 0x800}, 0x2c}]}) 16:56:54 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x0, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:55 executing program 7: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='clear_refs\x00') ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000000)) r2 = getpgid(0xffffffffffffffff) r3 = syz_open_procfs(r2, &(0x7f00000000c0)='loginuid\x00') sendfile(r1, r3, &(0x7f0000000080), 0x1) 16:56:55 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000400)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x2, 0x0, 0x0, 0x8}, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x2200, 0x0) write$P9_RMKDIR(r3, &(0x7f0000000080)={0x14, 0x49, 0x2, {0x83, 0x3, 0x6}}, 0x14) ioctl$KVM_SET_IRQCHIP(r1, 0x4030ae7b, &(0x7f0000000280)) 16:56:55 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000000000006c00000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:55 executing program 1: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa}) socketpair$inet_udplite(0x2, 0x2, 0x88, &(0x7f0000000200)) r1 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) write$cgroup_subtree(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="2f63708e202d636d6f7279202f696f20000000000000000000000000"], 0x1c) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000019fe0)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) r2 = memfd_create(&(0x7f0000000040)='/dev/sg#\x00', 0x0) pwritev(r0, &(0x7f0000000000)=[{&(0x7f0000012000)="ca", 0x1}], 0x1, 0x0) ioctl$EVIOCSMASK(r2, 0x40104593, &(0x7f0000000080)={0x3, 0xf4, &(0x7f0000000100)="ceaee0ec8133b45535892cd1d7871d263f2f2eb779a8d390dbd6641c1fecec03d6861709c8fe402ab7ac648ee555986f789e808ee98a94faefeb58338fc5e6c9a1750bd0d081bc9ce008a0302fc3a78abf88b469ab278a9932a13e5051267174865457f63eb68e8b855dfea000d81a4482195d536cf0e74221cd4324f52460671f08187cf1770d26bc8a71d4ead347d3a9897da833a93489af4acc6e70a3ace91bb4d68360a22fe326ab7cf70a68cd591a51ed1b05daefd56ba439021710e1fe3acb4867975527734e0ad6a4666db79cd53ce509caae38873f4306e0628bc15df92bd0a317f1f318cae3ecbde6105801e60526e4"}) lseek(r2, 0xffffffffffffffff, 0x3) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000300)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r2, &(0x7f0000000480)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000440)={&(0x7f0000000340)={0xd8, r3, 0x400, 0x70bd2a, 0x25dfdbfb, {0x9}, [@IPVS_CMD_ATTR_DAEMON={0x1c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast=0xffffffff}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xffffffffffffffff}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8}, @IPVS_CMD_ATTR_DEST={0x44, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@dev={0xac, 0x14, 0x14, 0xd}}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@local={0xfe, 0x80, [], 0xaa}}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x3}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DEST={0x20, 0x2, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DEST={0x18, 0x2, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e20}]}]}, 0xd8}, 0x1, 0x0, 0x0, 0x1}, 0x4040000) close(r0) [ 297.823913] binder: 21158:21160 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4718592 [ 297.831627] binder: 21158:21160 unknown command 4743953 [ 297.837126] binder: 21158:21160 ioctl c0306201 20000000 returned -22 [ 297.851701] binder: 21158:21160 Acquire 1 refcount change on invalid ref 0 ret -22 [ 297.927415] FAULT_INJECTION: forcing a failure. [ 297.927415] name failslab, interval 1, probability 0, space 0, times 0 [ 297.938737] CPU: 1 PID: 21176 Comm: syz-executor2 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 297.947145] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 297.955857] ISOFS: Unable to identify CD-ROM format. [ 297.956497] Call Trace: [ 297.956521] dump_stack+0x1c9/0x2b4 [ 297.956543] ? dump_stack_print_info.cold.2+0x52/0x52 [ 297.973010] ? rcu_note_context_switch+0x730/0x730 [ 297.977961] should_fail.cold.4+0xa/0x11 [ 297.982040] ? kasan_check_write+0x14/0x20 [ 297.986281] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 297.991383] ? kernfs_activate+0x8e/0x2c0 [ 297.995540] ? ___ratelimit.cold.2+0x6b/0x6b [ 297.999943] ? mutex_trylock+0x2b0/0x2b0 [ 298.003997] ? kasan_check_write+0x14/0x20 [ 298.008228] ? __radix_tree_replace+0x188/0x2f0 [ 298.013111] ? kernfs_add_one+0x4f/0x4d0 [ 298.017163] ? kernfs_activate+0x21a/0x2c0 [ 298.021390] ? lock_downgrade+0x8f0/0x8f0 [ 298.025530] ? lock_acquire+0x1e4/0x540 [ 298.029493] ? fs_reclaim_acquire+0x20/0x20 [ 298.033810] ? lock_downgrade+0x8f0/0x8f0 [ 298.037952] ? check_same_owner+0x340/0x340 [ 298.042261] ? kasan_check_write+0x14/0x20 [ 298.046488] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 298.051408] ? rcu_note_context_switch+0x730/0x730 [ 298.056329] __should_failslab+0x124/0x180 [ 298.060557] should_failslab+0x9/0x14 [ 298.064345] kmem_cache_alloc+0x2af/0x760 [ 298.068482] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 298.073396] ? kasan_check_write+0x14/0x20 [ 298.077620] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 298.082627] __kernfs_new_node+0xef/0x5a0 [ 298.086765] ? kernfs_dop_revalidate+0x3c0/0x3c0 [ 298.092124] ? mutex_unlock+0xd/0x10 [ 298.095830] ? kernfs_activate+0x21a/0x2c0 [ 298.100055] ? kernfs_walk_and_get_ns+0x340/0x340 [ 298.104887] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 298.110409] ? kernfs_link_sibling+0x1d2/0x3b0 [ 298.114982] kernfs_new_node+0x80/0xf0 [ 298.118874] __kernfs_create_file+0x4d/0x330 [ 298.123272] sysfs_add_file_mode_ns+0x21a/0x560 [ 298.127945] internal_create_group+0x26d/0x9e0 [ 298.132608] sysfs_create_group+0x1f/0x30 [ 298.136756] lo_ioctl+0x1307/0x1d70 [ 298.140374] ? lo_rw_aio_complete+0x450/0x450 [ 298.144858] blkdev_ioctl+0x9cd/0x2030 [ 298.148736] ? lock_acquire+0x1e4/0x540 [ 298.152713] ? blkpg_ioctl+0xc40/0xc40 [ 298.156699] ? lock_release+0xa30/0xa30 [ 298.160687] ? save_stack+0xa9/0xd0 [ 298.164302] ? save_stack+0x43/0xd0 [ 298.167922] ? __fget+0x4d5/0x740 [ 298.171366] ? ksys_dup3+0x690/0x690 [ 298.175079] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 298.179663] ? kasan_check_write+0x14/0x20 [ 298.183884] ? do_raw_spin_lock+0xc1/0x200 [ 298.188111] block_ioctl+0xee/0x130 [ 298.191726] ? blkdev_fallocate+0x400/0x400 [ 298.196037] do_vfs_ioctl+0x1de/0x1720 [ 298.199916] ? ioctl_preallocate+0x300/0x300 [ 298.204312] ? __fget_light+0x2f7/0x440 [ 298.208271] ? fget_raw+0x20/0x20 [ 298.211713] ? trace_hardirqs_on+0xd/0x10 [ 298.215850] ? kmem_cache_free+0x22e/0x2d0 [ 298.220073] ? putname+0xf7/0x130 [ 298.223518] ? do_sys_open+0x3cb/0x720 [ 298.227396] ? security_file_ioctl+0x94/0xc0 [ 298.231793] ksys_ioctl+0xa9/0xd0 [ 298.235238] __x64_sys_ioctl+0x73/0xb0 [ 298.239115] do_syscall_64+0x1b9/0x820 [ 298.242989] ? finish_task_switch+0x1d3/0x870 [ 298.247476] ? syscall_return_slowpath+0x5e0/0x5e0 [ 298.252394] ? syscall_return_slowpath+0x31d/0x5e0 [ 298.257320] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 298.262327] ? prepare_exit_to_usermode+0x291/0x3b0 [ 298.267334] ? perf_trace_sys_enter+0xb10/0xb10 [ 298.272004] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 298.276846] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 298.282023] RIP: 0033:0x455927 [ 298.285195] Code: 48 83 c4 08 48 89 d8 5b 5d c3 66 0f 1f 84 00 00 00 00 00 48 89 e8 48 f7 d8 48 39 c3 0f 92 c0 eb 92 66 90 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 7d bb fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 298.304662] RSP: 002b:00007f088c102a88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 298.312362] RAX: ffffffffffffffda RBX: 0000000020000190 RCX: 0000000000455927 [ 298.319617] RDX: 0000000000000014 RSI: 0000000000004c00 RDI: 0000000000000015 [ 298.326872] RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000000a [ 298.334146] R10: 0000000000000075 R11: 0000000000000246 R12: 0000000000000014 [ 298.341403] R13: 0000000000000000 R14: 00000000004d3c90 R15: 000000000000000c [ 298.353334] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing 16:56:55 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x0, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 298.377536] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue [ 298.406627] ISOFS: Unable to identify CD-ROM format. 16:56:55 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="025cc83d6d345f8f762070") seccomp(0x0, 0x0, &(0x7f0000016000)={0x0, &(0x7f0000000080)}) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) getsockopt$inet6_mreq(r0, 0x29, 0x1d, &(0x7f0000000080)={@loopback}, &(0x7f00000000c0)=0x14) epoll_create(0x2) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f0000000140)={0x7, 0x800}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) 16:56:55 executing program 2 (fault-call:2 fault-nth:13): mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:56:55 executing program 7: syz_mount_image$hfs(&(0x7f0000000000)='hfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000540), 0x0, &(0x7f00000005c0)={[{@dir_umask={'dir_umask', 0x3d}, 0x2c}]}) 16:56:55 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = fcntl$dupfd(r0, 0x406, r0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000040)={0x0, 0x7fffffff, 0x2, [0x1, 0x6]}, &(0x7f0000000080)=0xc) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f00000000c0)={r2, 0x401}, 0x8) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) ioctl$KVM_SET_IRQCHIP(r3, 0x8208ae63, &(0x7f00000003c0)={0x2, 0x0, @ioapic={0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1, 0x0, [], 0x7ff}]}}) 16:56:55 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000003fe8)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000013e95), 0x4) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x77, &(0x7f0000000200), 0x8) close(r2) close(r1) [ 298.562371] binder: 21195:21198 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 298.571109] binder: 21195:21198 unknown command 4743953 [ 298.576680] binder: 21195:21198 ioctl c0306201 20000000 returned -22 [ 298.593714] binder: 21195:21198 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 298.602424] binder: 21195:21198 unknown command 4743953 16:56:55 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c4000000000000000020dd400000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 298.608423] binder: 21195:21198 ioctl c0306201 20000000 returned -22 16:56:55 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x0, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:55 executing program 0: mkdir(&(0x7f0000000180)='./control\x00', 0x0) syz_mount_image$hfsplus(&(0x7f0000000000)='hfsplus\x00', &(0x7f0000000080)='./control/file1\x00', 0x0, 0x0, &(0x7f0000000300), 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB='nls=utf8,session=0x0000000000000001,uid=', @ANYBLOB, @ANYBLOB="2c756d61736b3d4e303030303030303030303030303030303030303334352c6e6f626172726965722c00c08d194d17c83b065080dcaf81fb8caa63c7c19b150d3eb2d4551fde91f1e446e1b06d537970429a4b8af763a9bb077de84a9a1258e30a92d9e85eb2904a5c34ead3df2fd8d28252b238a2889dc4b2909a0fa5a307aa038b835b1f1e8c489479b8327d69baefd8ba12535b22e5d03b8e2e"]) r0 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x0) stat(&(0x7f00000000c0)='./control/file1\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0, 0x0}, &(0x7f0000000200)=0xc) ioctl$KVM_KVMCLOCK_CTRL(r0, 0xaead) write$FUSE_DIRENTPLUS(r0, &(0x7f0000000240)={0xb0, 0x0, 0x5, [{{0x3, 0x0, 0x8, 0x1, 0x8, 0x8, {0x4, 0x5, 0x3, 0x0, 0x9, 0xffffffffffff0001, 0x7, 0x88, 0x3, 0x4, 0x81, r1, r2, 0x1}}, {0x3, 0x2, 0x5, 0xfffffffffffffffc, "f35d2c252d"}}]}, 0xb0) [ 298.717665] hfs: can't find a HFS filesystem on dev loop7 [ 298.724895] FAULT_INJECTION: forcing a failure. [ 298.724895] name failslab, interval 1, probability 0, space 0, times 0 [ 298.736372] CPU: 0 PID: 21215 Comm: syz-executor2 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 298.744783] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 298.754128] Call Trace: [ 298.756708] dump_stack+0x1c9/0x2b4 [ 298.760327] ? dump_stack_print_info.cold.2+0x52/0x52 [ 298.765513] ? rcu_note_context_switch+0x730/0x730 [ 298.770438] should_fail.cold.4+0xa/0x11 [ 298.774496] ? kasan_check_write+0x14/0x20 [ 298.778715] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 298.783807] ? kernfs_activate+0x8e/0x2c0 [ 298.787962] ? ___ratelimit.cold.2+0x6b/0x6b [ 298.792366] ? mutex_trylock+0x2b0/0x2b0 [ 298.796414] ? kasan_check_write+0x14/0x20 [ 298.800644] ? __radix_tree_replace+0x188/0x2f0 [ 298.805305] ? kernfs_add_one+0x4f/0x4d0 [ 298.809355] ? kernfs_activate+0x21a/0x2c0 [ 298.813577] ? lock_downgrade+0x8f0/0x8f0 [ 298.817720] ? lock_acquire+0x1e4/0x540 [ 298.822732] ? fs_reclaim_acquire+0x20/0x20 [ 298.827042] ? lock_downgrade+0x8f0/0x8f0 [ 298.831205] ? check_same_owner+0x340/0x340 [ 298.835522] ? kasan_check_write+0x14/0x20 [ 298.839749] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 298.844675] ? rcu_note_context_switch+0x730/0x730 [ 298.849588] __should_failslab+0x124/0x180 [ 298.853817] should_failslab+0x9/0x14 [ 298.857620] kmem_cache_alloc+0x2af/0x760 [ 298.861759] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 298.866683] ? kasan_check_write+0x14/0x20 [ 298.870908] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 298.875906] __kernfs_new_node+0xef/0x5a0 [ 298.880041] ? kernfs_dop_revalidate+0x3c0/0x3c0 [ 298.884779] ? mutex_unlock+0xd/0x10 [ 298.888484] ? kernfs_activate+0x21a/0x2c0 [ 298.892708] ? kernfs_walk_and_get_ns+0x340/0x340 [ 298.897544] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 298.903148] ? kernfs_link_sibling+0x1d2/0x3b0 [ 298.907722] kernfs_new_node+0x80/0xf0 [ 298.911597] __kernfs_create_file+0x4d/0x330 [ 298.915989] sysfs_add_file_mode_ns+0x21a/0x560 [ 298.920646] internal_create_group+0x26d/0x9e0 [ 298.925224] sysfs_create_group+0x1f/0x30 [ 298.929387] lo_ioctl+0x1307/0x1d70 [ 298.933005] ? lo_rw_aio_complete+0x450/0x450 [ 298.937490] blkdev_ioctl+0x9cd/0x2030 [ 298.941363] ? lock_acquire+0x1e4/0x540 [ 298.945328] ? blkpg_ioctl+0xc40/0xc40 [ 298.949197] ? lock_release+0xa30/0xa30 [ 298.953157] ? save_stack+0xa9/0xd0 [ 298.956774] ? save_stack+0x43/0xd0 [ 298.960391] ? __fget+0x4d5/0x740 [ 298.963827] ? ksys_dup3+0x690/0x690 [ 298.967524] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 298.972097] ? kasan_check_write+0x14/0x20 [ 298.976327] ? do_raw_spin_lock+0xc1/0x200 [ 298.980557] block_ioctl+0xee/0x130 [ 298.984167] ? blkdev_fallocate+0x400/0x400 [ 298.988478] do_vfs_ioctl+0x1de/0x1720 [ 298.992350] ? ioctl_preallocate+0x300/0x300 [ 298.996738] ? __fget_light+0x2f7/0x440 [ 299.000703] ? fget_raw+0x20/0x20 [ 299.004151] ? trace_hardirqs_on+0xd/0x10 [ 299.008305] ? kmem_cache_free+0x22e/0x2d0 [ 299.012531] ? putname+0xf7/0x130 [ 299.015967] ? do_sys_open+0x3cb/0x720 [ 299.019846] ? security_file_ioctl+0x94/0xc0 [ 299.024237] ksys_ioctl+0xa9/0xd0 [ 299.027673] __x64_sys_ioctl+0x73/0xb0 [ 299.031543] do_syscall_64+0x1b9/0x820 [ 299.035419] ? finish_task_switch+0x1d3/0x870 [ 299.039920] ? syscall_return_slowpath+0x5e0/0x5e0 [ 299.044838] ? syscall_return_slowpath+0x31d/0x5e0 [ 299.049751] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 299.054755] ? prepare_exit_to_usermode+0x291/0x3b0 [ 299.059766] ? perf_trace_sys_enter+0xb10/0xb10 [ 299.064436] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 299.069265] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 299.074448] RIP: 0033:0x455927 [ 299.077615] Code: 48 83 c4 08 48 89 d8 5b 5d c3 66 0f 1f 84 00 00 00 00 00 48 89 e8 48 f7 d8 48 39 c3 0f 92 c0 eb 92 66 90 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 7d bb fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 299.096762] RSP: 002b:00007f088c102a88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 299.104458] RAX: ffffffffffffffda RBX: 0000000020000190 RCX: 0000000000455927 [ 299.111713] RDX: 0000000000000014 RSI: 0000000000004c00 RDI: 0000000000000015 [ 299.118971] RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000000a [ 299.126233] R10: 0000000000000075 R11: 0000000000000246 R12: 0000000000000014 [ 299.133495] R13: 0000000000000000 R14: 00000000004d3c90 R15: 000000000000000d [ 299.149422] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing 16:56:56 executing program 2 (fault-call:2 fault-nth:14): mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:56:56 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x2e0000, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f0000000040)={{0x8, 0x4, 0x80000001, 0x734d, 'syz1\x00', 0x3d}, 0x1, [0x8, 0x9, 0x200, 0x54a, 0x10, 0xffffffffffffff89, 0x1ff, 0x9, 0x3f, 0x6, 0x100000000, 0x7f, 0x8, 0x400, 0x400, 0x10000, 0x5946, 0x55da, 0x80000001, 0x0, 0x1f, 0x5, 0x4, 0x700000000, 0x21, 0x9, 0x62, 0x4, 0x9, 0x0, 0xfcb6, 0xffffffffffffff8f, 0x7, 0x100000000, 0x43b, 0x4, 0x5, 0x1, 0xebd5, 0x20, 0x100, 0x2, 0x1, 0x0, 0x7, 0x8001, 0xc565, 0x3, 0xa6a, 0x29123227, 0xffff, 0x0, 0x4, 0x2957, 0x0, 0x4, 0xc2a, 0x0, 0x280000, 0x800, 0x9, 0xffffffffffffffff, 0x4, 0x50b, 0x1, 0x8, 0x2, 0x3, 0x3, 0x3ff, 0x93c, 0x0, 0xfffffffffffffff7, 0x3, 0x4, 0x2, 0x1f, 0x8, 0x3, 0x100, 0x0, 0x9, 0xdac1, 0x6, 0x5e28, 0x0, 0x7fff, 0x0, 0x3, 0xc999, 0x3, 0xffff, 0x3, 0x3, 0x7, 0x2, 0x5, 0x2, 0x400, 0x7fff, 0x8c9, 0x4c, 0x0, 0x3, 0x7, 0x9, 0x1, 0x10001, 0x4, 0x3f, 0xde, 0x0, 0x80000000, 0x5, 0x8000, 0x0, 0xfffffffffffffff9, 0xd4, 0x5, 0x7fffffff, 0x0, 0xfffffffffffffffb, 0x0, 0x4, 0x3, 0xffff, 0x9, 0x3], {0x0, 0x1c9c380}}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000540)='/dev/zero\x00', 0x40000, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r0) write$P9_RREADLINK(r1, &(0x7f0000000580)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f00000005c0)={0x3, r0}) getsockopt$IP_VS_SO_GET_VERSION(r1, 0x0, 0x480, &(0x7f0000000600), &(0x7f0000000640)=0x40) ioctl$IOC_PR_CLEAR(r0, 0x401070cd, &(0x7f0000000680)={0x4}) setsockopt$inet6_tcp_int(r0, 0x6, 0x5, &(0x7f00000006c0)=0xe89, 0x4) ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f0000000700)=0x1) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000800)={'team0\x00', 0x0}) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, &(0x7f0000000840)={@local={0xfe, 0x80, [], 0xaa}, r2}, 0x14) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000880)={0x1, 0x4, 0x8001, 0x800, 0x40}, 0x14) ioctl$sock_netdev_private(r0, 0x89f1, &(0x7f00000008c0)="12191d2cf884b574be0912d44df8fcea5e223371d80ba10bb8e8023eb695790759c9589583cc20d0e1fbc14a56f99d5de7989498a5d5883cb51c9ceba3f3e3f2ded01f355f652f72753cfbd6ac2b6b219afe0e8fc2e6035a1c63853bcc0da3f783701d3c4ad37a6aea6b14718c69848d3a663b83c5a643abf7cec2fc0c8da55c99cc72dbeec7106877d67b5846475659196dd63632ecccb7f5e25f8be269dd599c70595ae9af81c271505d5b6dabe64cdf110f7f396782f87e07411cf31ea85dd7d04224cec7eca3fd2983298ef722711b71e08435fb14595780888405ea97b659cae2d108c598b6d0a1fd0f03594083bd8e") getsockopt$IP_VS_SO_GET_SERVICES(r0, 0x0, 0x482, &(0x7f00000009c0)=""/195, &(0x7f0000000ac0)=0xc3) sendfile(r3, r1, &(0x7f0000000b00), 0x81) ioctl$BLKTRACESTART(r0, 0x1274, 0x0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000b40)='/dev/hwrng\x00', 0x0, 0x0) write$P9_RCLUNK(r0, &(0x7f0000000b80)={0x7, 0x79, 0x1}, 0x7) preadv(r4, &(0x7f0000000cc0)=[{&(0x7f0000000bc0)=""/232, 0xe8}], 0x1, 0x0) timer_create(0x7, &(0x7f0000000dc0)={0x0, 0x27, 0x2, @thr={&(0x7f0000000d00)="117386b622b03dccaa69001c89633892276709fed2dd4d62cd59bad8405503fc6b834c369c4611a9633f0a44b122270d4667e632c15b97ca5ab3fae0688a", &(0x7f0000000d40)="e81d8d8ba95e19aa27e2cd8098f29bc446499ae3fef3d43a1e8718cbd91630733a34e30556433a9a8470ab98ae4cc15c69b68e8ea9d695f2291b0764448de8cbda227ccc61bdf295fb1001cfab532bbbefa8c09ac9fceeb125275c1a973b005605ca153329df53983e7f8a3d8cf09da9"}}, &(0x7f0000000e00)=0x0) timer_gettime(r5, &(0x7f0000000e40)) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r4, 0x84, 0x20, &(0x7f0000000e80), &(0x7f0000000ec0)=0x4) ioctl$BLKRESETZONE(r4, 0x40101283, &(0x7f0000000f00)={0x7, 0xff}) write$FUSE_NOTIFY_INVAL_INODE(r0, &(0x7f0000000f40)={0x28, 0x2, 0x0, {0x6, 0x2, 0x800}}, 0x28) clock_gettime(0x0, &(0x7f0000000f80)={0x0, 0x0}) timer_settime(r5, 0x1, &(0x7f0000000fc0)={{r6, r7+30000000}}, &(0x7f0000001000)) ioctl$KVM_SET_CPUID(r4, 0x4008ae8a, &(0x7f0000001040)={0x5, 0x0, [{0x7, 0x9, 0x80, 0x7d, 0xdba3}, {0x80000019, 0xe3, 0x80, 0xfff}, {0xa, 0x87be, 0x8, 0x1, 0x5}, {0x2, 0x1, 0x511, 0x3, 0x1}, {0x4, 0x8, 0x1, 0x4, 0x10001}]}) socketpair(0x19, 0x80006, 0x7, &(0x7f00000010c0)) [ 299.165440] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue [ 299.169050] hfs: can't find a HFS filesystem on dev loop7 16:56:56 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f0000000200)='veth1_to_team\x00') r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x2fb) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r2 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0xfffffffffffffffc, 0x200000) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000180)=ANY=[@ANYRES32=0x0, @ANYBLOB="00a9e100489ddc5ddf00000000866bb2be02960eb2551b68a8c80188b53bb75c3e0a35a4c322e0e8d40262a0a1da7f0000000000000045f85d0daff47e0b00000000a285316c45bb402c20d6124bbe4bb92f0000000000000000000000040000000000000000"], &(0x7f00000000c0)=0x2) r4 = add_key(&(0x7f0000000280)='.dead\x00', &(0x7f0000000400)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000000440)="aee946339c4f9ff15d8ac42b380395c2eb681151ae1f9b56e8cbd590cf4b838d3f48f799b1ac9c1771951fd293217c353b516997f2ce2722635a5edb89af7576526e297fbde15fa7a99967bdf72d52eff2ad35ff62119b69ad759f36933c80c499d9790ed7c0d6f4232038470b2e0b6d3bcf1cf4a9ab57b24c76313b34d1fbcde2d40dbf4c74ed2c2705532dcebd32c11b34531c0dd47eee49f7881cac05d50cd0a307a238b16bdae4da48e5d5d163774df3c35c30e013dcd282ea2746ab47effd7bbc7939a8dae8", 0xc8, 0xfffffffffffffffb) keyctl$clear(0x7, r4) mmap$xdp(&(0x7f0000f55000/0x3000)=nil, 0x3000, 0x0, 0x812, r2, 0x80000000) setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f0000001180)={r3, @in6={{0xa, 0x4e23, 0x8, @loopback={0x0, 0x1}, 0x75aa}}}, 0x84) r5 = socket$inet6(0xa, 0x1, 0x0) ioctl(r5, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$PERF_EVENT_IOC_ID(r2, 0x80082407, &(0x7f0000000680)) setsockopt$inet6_tcp_TCP_MD5SIG(r5, 0x6, 0xe, &(0x7f00000002c0)={@in6={{0xa, 0x4e24, 0x4, @ipv4={[], [0xff, 0xff], @multicast1=0xe0000001}, 0xdc90}}, 0x9079, 0x3f5, 0x5, "bcbe172b11ed9ca2dac5331a973948c1a2ff57559af168f9d2b17014181d688373279126d476f2ca9e8d642a145015431bc5cb3bd2fcb2e9caaf4c957c091e9031625e0e80fb89248fd43fb940176391"}, 0xd8) mknodat(r2, &(0x7f0000000240)='./file0\x00', 0xc100, 0x6) ioctl$sock_inet_SIOCSIFPFLAGS(r2, 0x8934, &(0x7f0000000140)={'team_slave_0\x00', 0x9}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x2, 0x20000000032, 0xffffffffffffffff, 0x0) getrandom(&(0x7f00000003c0)=""/2, 0xfffffffffffffe10, 0x3) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DEST(r2, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x34, r6, 0x10, 0x70bd2a, 0x25dfdbfb, {0x7}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xf3}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10000}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x10000}]}, 0x34}, 0x1, 0x0, 0x0, 0x80c0}, 0x8000) 16:56:56 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000060000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 299.295634] binder: 21225:21234 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 299.304335] binder: 21225:21234 unknown command 4743953 [ 299.309867] binder: 21225:21234 ioctl c0306201 20000000 returned -22 [ 299.322723] binder: 21225:21234 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 299.331471] binder: 21225:21234 unknown command 4743953 [ 299.336922] binder: 21225:21234 ioctl c0306201 20000000 returned -22 [ 299.427592] hfsplus: unable to parse mount options [ 299.451251] hfsplus: unable to parse mount options [ 299.493169] binder: 21263:21268 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 299.502152] binder: 21263:21268 unknown command 4743953 [ 299.507691] FAULT_INJECTION: forcing a failure. [ 299.507691] name failslab, interval 1, probability 0, space 0, times 0 [ 299.518930] CPU: 0 PID: 21257 Comm: syz-executor2 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 299.527339] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 299.532135] binder: 21263:21268 ioctl c0306201 20000000 returned -22 16:56:56 executing program 4: mkdir(&(0x7f0000000000)='./file1\x00', 0x100000000000) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rfkill\x00', 0x2080, 0x0) fsync(r0) r1 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x5, 0x10000) futimesat(r1, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)={{0x77359400}}) rename(&(0x7f0000000080)='./file1\x00', &(0x7f0000000180)='./file0\x00') 16:56:56 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x0, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:56 executing program 1: r0 = getuid() syz_mount_image$msdos(&(0x7f0000000140)='msdos\x00', &(0x7f0000000180)='./file0\x00', 0x6, 0x4, &(0x7f00000004c0)=[{&(0x7f0000000240)="0a17485a3a3b59ef6aeb6e55443029c7ad239feffce503d4ba1056b598fdccfb7184eb270d0b8e9c62da6b8dc286", 0x2e}, {&(0x7f0000000280)="2ee62f13cdf6f680edd3f6c6a8da931f8378e3e40cfb58e19810be342744fc5a211b08a1b76dd5993d00261d69c61810d2f275ec683497a381b8d22e16bc863767537fe886d359449f1233114049406c20d5e35d939b8ce1e0e04ce77403668af705988477cbd0ca155fe57259971deddcd3be12223b65fe4239b1dce037278f57b55d891d4b5cb7e6224bea22cccee78597668e03541044d45356673e80e1d95a7939296daf85fa6308081be2148995398ba00ffa9ee3dc3f5305d991613a77fb233cbb496cd0012d0094189bcdac4600833bdb2687342900c46b9708e604c9c8d261a0e5e514c338b606c8e08c7ba704495e96d513284af50e1d97b5bd02", 0xff, 0xff}, {&(0x7f0000000380)="6bff886b797bfe087cad1cda4841bf7522387353bd3de3e981dc5271041f1326c63c76d5830f26c02ea6eb331d2aa7de14260b9b739c328569f6947128fa779497bfc3c490c332dd1b9e86f2f7c2", 0x4e, 0x6}, {&(0x7f0000000400)="2d237748fe22fb1bb757c045caddc5c019d64c4710bc03e0af38b132ba5a27bff54c58f689ada68cb5dc1c531eb5e7ec35cff03772116d5ee4809391b513b70e912e2369569346e4ef7281f5e74c0aa532c18210003f1d956d2edd10eaff6dd77dc8e8d3d0c9a24fc3cad2ff4f0d8241a03cda7055f2854db4dee2cbdb813e0c3072481e61a739445551e5ecdce7bab62b1c778af07447697b", 0x99}], 0x2004000, &(0x7f0000000680)=ANY=[@ANYBLOB='dots,nodots,uid=', @ANYRESHEX=r0, @ANYBLOB="2c6e6f63dc6173652c060000002c420b0cc40361fb89d3c3a4ab109790869aaa3d1305596fddb6bdfe82ce99ce2f2846320b01cd99c0eeb83ed8e89d424107b697cc7605e028b2b0a1dddb9bf9e85dd2a7682bc5a4971d4428bb6469c97c2293f4e974bfd0d7881603f156279ec59055e5b8d9d730c747c94fda6e8f8a2c76a4778bff62d5c798f21936280d0805d8a10c39ffa82549e4e03115e5d5b0a488b4724d88bf5e21d8646ac70b500f6b003b9ab2fecc282ffc402fa8f90dc848b6612ac02f3d22f5acfe50e569ae70d72ab8b1911e702bee460f31dc161bc00100000081ce85fcdeb552b50a8a0ba6876ebb3adbf1789784057c0235fabf3a8996185640730000000000"]) setrlimit(0x8000000000006, &(0x7f00000a3ff0)) r1 = dup(0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000000000), &(0x7f0000000040)=0x4) ioctl$VT_GETSTATE(r1, 0x5603, &(0x7f0000000080)={0x101, 0x5, 0x2}) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r1, 0x40485404, &(0x7f00000000c0)={{0x0, 0x3, 0x100000000, 0x2, 0x6}, 0x8, 0xfffffffffffff000}) r2 = socket(0x40000000015, 0x5, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000200)=0x5) setreuid(r3, 0x0) setresuid(0x0, 0x0, 0x0) fcntl$dupfd(r2, 0x406, r2) 16:56:56 executing program 7: r0 = socket$inet6(0xa, 0x80000000005, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet_smc(0x2b, 0x1, 0x0) fsetxattr(r0, &(0x7f0000000000)=@known='system.posix_acl_default\x00', &(0x7f0000000040)='self:*\x00', 0x7, 0x0) getsockname$inet(r1, &(0x7f0000000080), &(0x7f0000000140)=0x10) [ 299.536693] Call Trace: [ 299.536717] dump_stack+0x1c9/0x2b4 [ 299.536733] ? dump_stack_print_info.cold.2+0x52/0x52 [ 299.536749] ? rcu_note_context_switch+0x730/0x730 [ 299.536776] should_fail.cold.4+0xa/0x11 [ 299.563623] ? kasan_check_write+0x14/0x20 [ 299.567873] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 299.572985] ? kernfs_activate+0x8e/0x2c0 [ 299.577152] ? ___ratelimit.cold.2+0x6b/0x6b [ 299.581563] ? mutex_trylock+0x2b0/0x2b0 [ 299.585611] ? kasan_check_write+0x14/0x20 16:56:56 executing program 0: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001440)='/dev/ppp\x00', 0x4000, 0x0) connect$bt_rfcomm(r0, &(0x7f0000001480)={0x1f, {0x5, 0x7, 0x6, 0x800, 0xd, 0x401}, 0x6a}, 0xa) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000001}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000000), 0x1) r2 = add_key(&(0x7f0000000280)='id_resolver\x00', &(0x7f00000002c0)={0x73, 0x79, 0x7a}, &(0x7f0000000380)="80", 0x1, 0xffffffffffffffff) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x80000, 0x0) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, &(0x7f00000003c0)={0x0, 0x1000, "d3ef6b1986175680367be41135c547cdabb6ece71b53d575a394b11745049e60eae722fd7b167799f8f611534b5b90a169cb7208ce4c699c752089ce26fe1edf1816678048ce8ece621470dbd21946cc60a7da92c877a0b61979457345fbbcb7a921dd0efd9a9c245b9cafbf520d051c26698dc0edab420178407867ab3a4ef782ae840e98bd7b8a5b3db86ddd240f0ad5bd0ffbfe79073aa04f3120921a21504f19e80a6b6d37e730bcf672bdcdce4defe5978cffd872ee2e0879f3fd320d4f7f71a28ea3b83b6dc0227e12e2cf375ac9a13aafe4cfaa950d2c19002f7a50c91c7180eab25533c4476ba67e55196402037f00b9c204ff18c349c3f5063f315ba3f5b596857450f280b75e1597f0f3f7dd958df76e3ac51bd441a1911d1c9d2a1aa901b092f7471cf0882f41fa34297bf4ba35480f2b8ce825764c0b44eae51fec3c8827261ead22307cb702f1ae7b7e4af32a095f8bb17103abfc38f5c19eada7fac71e8dbab723a9aeece66c21bf695168e919f38f68eb96229389fde71095058de8830022be26f5404c18429b30c0a18401b8dc60d2b5e846b12b3c0019c0016ea31990eb1eb5a5ae683e1910da383702806455ec1f63893de025573d0b4efd76fc75862252a739d4c8fac3813a2ee852ebc38414f96624e4da37c756658600e1dc64aa14d02c81c7f59af46f02a42ad567d62fa80328785fc82a78bc4de978f4ecd506dfcea7da24e76037add8f2fbaf8bf7378ec08fd4b778fe369b8774025e1e54e4f6050d4cae6f03c8a7535ad9d6a41186aeb5ab5bda9086dc709fbf2d7bf22451dadb137614aa3d838b396d7f9b8bc830b934f350c2a69684566e4e6eb60db020b60ce8ece8bd32fd3d8e496494e2e27262305ab75ac532eb0b81a951746565306b2960e2a876dee48d897a607896b7d069bf33477e0f7317607b49d609054a866a2f35ca5822834483cc7968db006c9031a1382eea21ae39d5c7845a15107dfef2117a0038fc33335d5931b88a36ea21c923cae7b13c73341178bcdc6c618381ff9e54a4dc51b85cd7603a4310dcdadeb24f717bb2e887b516bf51bd12dfd343679034e46fd285f7460a3ccf0f81ebae78cefdaf5317e59344fd57639d3d2fb073fb80b153c95bce6ef550163c0e02248e8c133966ae9e7d19706fcb5ac15766ba72fd160159e69f4073a33e2e35b52851f39e5d3909b07db4e6dd623432103c80acb4aaafd73d87784d4be4fcae7beae6d1e0298e7ada4f9a68a9f3654574d9ba7f20e3e79cc0661487766487bd7591bc534ed72eb3bac9caad75b6e99fbdd57d8befaffe81002292dfc63d011264d538dc32e1c7911745e23074742ffa8d2648544be61bd18ecff93e19ec432e040c66dea89d93c2fa1b43f35fbfa00e370cdff0180b34ca7e0f65d11a40de253de454b5879b55078eb9759762a8e7296dc6fd67f41fe4f00197904ef7533d7735c063ca1971c4942ac3039507b2cb85080e001f07d2784eda66cd73e5a94e61c243a9d920658c8b90b133f4f532f3a1b817f5bb0ddb2f01a30e7fbd9b453330f00069e2eb5cde2cd1a3ec2aeb972b043c94f7f8cdc34499405e55a6e28cee2c699efc0f816c23ae0ed80eed4fa902519272f0f31e8e98914281a2f4417f9876cb238f65dafa736d783006d4b4f156ab0e4f6cd0ca62816c374502372c1041b1cf760a70dcb25595055690e14e7c4ab1331be220c91b9ef98e55d32c940956126cef56a30ca5ac4dbc9a51a2908e52a95e6f36c7c0501372a688a4bd54d75558dea0cc1237971ba7e1df8aafa7234628aba8138980e0bdd94c1186ef003da954ba9f673596df41922ad75f14a90c63bb7527d2decb526ef8c7871c354d92e9b5a6d131cb07b80eeb82ebdf894f520bd2e2c1e2fd7dfcb744e767126e38060fce806b676637c0c3b7b6b9cdd07bad25077357909dc65b2f642418ad29f9fb1916b2b562f4a820db292c845bac0a80ca1ddcdd9a7dc1d5357f7c7dce5f038cb7057520ff042d843d370e5cf212c09b41efdd85968c7bdc535a0db9a4a913e3270bd460420b2e036b32eaec2cdf99604352ee5023bf1b8b8a931c7ea3dbc54b2bc69c19ecc24a5796794829bd7d20fa4ecbeb266e7786f3426cb4d121c706174bc83a1bc3849eef03cd3b70351a743d77132e5b2cbcc236181bca74bf50eca936abfee484466b4771d51e2f42fa632f38367a02f3b31cb1b0d06223157801ed3a67c8db067a7b5e1469130b7a7cf5eda020c285c24ad63b828cfae8bdf9ca2e7849b637776999d30445fe5cff7417202f7d947dd25b861cb1c54f4608c424b9245ac8d622a90f8bf0592828adb4dbc4812124b3d569c6206eb590faf8415659e28c6085b6bae24d60c631af72c491f72e701d6adc0ddf5c85e1458e1a8d57f4cb31ef476881e95a0825fdf9e490413ee764a0cb5810cf729dab903f930f6c888cadf1eb60a52b3e3a996c2a6bf285c89cbd398d0c0a51e2e8d9faeb1efffcb87119ee7b8b4971fa61bb9dbba5d6b95dc25a18a6ec8de71f5c3b133ea8612ab5ef478a38cc096e18cb1e725a550dcd375a69c6e0054e610941002bf25cd703ba41a425d1a60058c8ff6d6bb4c5a607549699d7fea2c6ca8ed0bbf1b7c8cf534b467fc18e98fae2f1e3646b8498651d115623f1cac0f74956ac5056844b00b2c074e91cfcb2683bc8afdb9cae5ab1d188749a829ab4edfc7e83b8e0445dfa46c57a28f3567edc22d40bf1a16f834794622cc44e438334b79992472e441eaacaa1c5aedb84d113cda2133b9a135f953b7cfb3e897fe52edd18bf2d3dab23dd8b5a549a1902c00031aa9cca30ecec9d8f37a5698a8b68217a60beb6163a896f7f3cce12de38913a8e8f1af735edfdde9a3da74f9f84070726c5546e754265b8bae16997ba5bb21a9052514627401e42c16e08de97adf8e795f9abe79d16361b58f8fdf782b2a34fa5f7838a2ae86f7cd252852dcb94482cf39b35b43e8d7cccbd521cd0b59a8340b6ce5b0c2c26d13c0dcb5e74daed4b5b30fb0daed82bd5850e53bc550876102b3fbb2bca7f997faf2febf7eeec0fafce1aeb9911feb2275c9e0cef3c7588152f4c11e796c35bc153e8e7e63cadb5a15518a56106da5e694e760cabe3fbc5ad1c07bbdf90a32db836caf91e5a2baee0582f7f686282a3d8834e60d6c315ab29f4bacd71e755eb5ffea20d7b794def6c86219f602dc4292d42f771c306ee40464b6fda26ef6689ff1b66adadeb7dba467096147060854f7a54d2656f97960706f1622feb526859d2a6f6a1460963126b818d2dfee286ba4f8bca4e1bf9c9f8522326cf9217120809bbe3f5b536848fbdf5328dd07e7548e86c35436c74a957deba265556d36fe464362a80ac3576a1276a6013096f4ad488fcf2fc12e8aca7f6b973fb1980082d38a3bc68bd83350dc5723580bb56bddc708369718f1cc0920f0897195904c6c3582eb035a5c63b184fe0be1ccdd84e8c2a149e2e66a7cb46af8347fc09cd8b73c3865fcc309dadbcbdf672b30c3614ef2d6bf73fe33a57dd161b20de5a0411dc54a90bc2fa595ec99926723e85522cb2e6a6c41c356ed0cbcc8f5b2d91029c4870c1a4233611497274fee5022155338433c9bd2c5b88704ece1413aa500a73e4e4b5d0cea4f8167b36e309215c29fd8b375e014b3c600c23139c2b29f72fce7258dec26fb7a584321acd84e485a9529c7788f8b107946f15c94c844d85066b722682aadd930bf8b15e04807bc4cc15d49c1e189317679128bcb8bcb25a31af69164a6afadaaa95a48e8bb21ee3b6963f48919bb9604036d95d6a6ab80ae53f2c5942d5ef9f5bb109bf03a4cdce979243901680cd055b60be5906ae1a29f9ff20c937e0fca2419416a1e07e55aae1f860f8d2da1c223814bde8fdb29e7e8ccf939e5d56ee2dcf4a07ac3107b9f058b63839f3b5fbff70e174f9e5375ad549aeed06ce8eaa59e3247221e435bd336c610596e7ce500632d7f68f7cb9c493c582ecbbfec3db86863750a6fd937b0dd2ae4c683315a792b9a43f70f1b17b08b1145d8ad96b7cc5894f79aa353c8b57bc58fbb550508575a6e6cb7d8aa7abd3eb3251b8dd35a69d844eb5866060f4ad0a55e5c7f9e719742913fea2c0336bce2d25e77b93bf5e9c7a79fca949e5bb94e0ecfef4e09886f3a3a2e8c8b45a4536f5bf9ffb2c8751f0e4cff3ce8ff83b37802e27988e86416348b28fc3e659fba03d7cf67aba962d027cfc8828ba19b88974ce881dbc34f2e54fe88bd014dc98d5b30f3104b43b979f5746d9301e7e6df53b683f1607cfe60bee625a10444b60beb71c0e66e9285bc23a893154b702053224d5d902a4fdf4512529d4f568e13e8bbedf248cf6b3feedb4ef95ed0230c6fba8b4b058b23da716de644e6bc7dced7f1eaf03f674f61000f1823d65e32f37ce3564fa044ef6a0eb95551b080562ce8df304c9bd5a748697be195aca638cc9000770661b750a902f0dd31cca9a0ab1ff21ef3a9b97c78c128aa54ae2abe29094cbb85c467cdefcbea89e8d99d573ddeb625345ddb650502b78d5bcb54c99e0ee88923627f3de8ee560fa993f53dc7d41a2f354a9426b194d5bf9119344611dc7b5121814924dae9494a5b840e56c73ea38dde5d288b60f9c7af476178333bf4f6bf358c39f6e9bd8d531a3439ad788533467c182ecf66f42bcf7215eb41119f850faac24e7b72eb623f8e23703d12bfe32449f11e2a1a036e63ccbb474bd8c20831fd7f76612d6360172d7929fa0ae52ca3c520eafa16b7660e5117f7281cd453656e8f6ab6ff580e2657c239d3d05807c226ac992f950840f0877003dc3953aeef89bb08baa7bb96eb5a8d78428208e83f32b64df519117665d791a5d151783ad6d586eb03f5945b6ca153c9327eb41a9284336b1f8a3850e2148c2d660ca9a445e08952d3cc5f6114453465df86dcb21da4a145d9a7b13341681f9a0478a889787ba4e915ce043615a9cd2c7af2f4aed9d8dabd4f1e9290e904f0226a00054d636d1c66a0eaab33e63bd2b72c869b50e0aee844af15f80a7c800323cd50e09815c004f082d59b8f54bba07b7afb15674467566bb15baaab3ab209c50bb5b9fcdba615b46d486ef1e720ce0900d924030b5238c32feb12e7cdba2f5100d95eaba0a535ade95ac59d8bbf555cad33f856145bdd11f0731300913b93425a270295655240fc6874b75ade3fedfe27c4e541a1384926489982fa804a2aa074a23c842334bdea286676f7bb4c941f74b953632b064cc64c13f4ac8f430f86bcbf520a6a42c922d52e439db292a4d25a4eebd9f0d1c6209b4d3840f6c0eb6d326f8743c87f6c01eedc988e651e01b045147ab78d12252161d6e6be8ab3c47b55844fb0349e3098ad0b092c79c2a2475048c62a71b148816ba392389fb190ac452b7f2474532e262d8d7bf7b4108530fb917b0fcd60642bb227ab5b206dffe69d57667698d5b07b46aaa4e4f6cec0509c4a5937db28ce912557101e4958990134f5cfd338878c3facdd6875f1f1e3dcd9960ca527b8c3f514dd86850f919a966e3cb907f0e6aa5884dbe5428ec4abc0551a1a26df56707b066bd31b27998729d6e9dd274f10aeba53ac09aa17f97424ab69ced049542fa7f0efdc8558d333cc2c590cc8c1aa70f3c5a4122b04417cd35714b7143106dbf8b7dd6f441522a6811bbdfddb63bbea70d856d4239b74392def3b47b6868ecd611b0052fe6606c3e311bd5f519d03fd3916f632535fee7d06fa099ed24468095022e"}, &(0x7f0000000340)=0x1008) setsockopt$inet_sctp_SCTP_DELAYED_SACK(r3, 0x84, 0x10, &(0x7f0000001400)=@assoc_value={r4, 0x3f}, 0x8) add_key(&(0x7f0000000200)='id_legacy\x00', &(0x7f0000000240)={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000000300)="8475f16cd54c1cc9a8c1619d9d41a798c0a00b9542a0094b3fe136c19f210497810a8188c6ec88cb4731da2d61368936bdaebcfa", 0x34, r2) openat$cgroup_type(r3, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) keyctl$chown(0x4, r2, r1, 0x0) [ 299.589843] ? __radix_tree_replace+0x188/0x2f0 [ 299.594495] ? kernfs_add_one+0x4f/0x4d0 [ 299.598552] ? kernfs_activate+0x21a/0x2c0 [ 299.602774] ? lock_downgrade+0x8f0/0x8f0 [ 299.606920] ? lock_acquire+0x1e4/0x540 [ 299.610880] ? fs_reclaim_acquire+0x20/0x20 [ 299.615197] ? lock_downgrade+0x8f0/0x8f0 [ 299.619349] ? check_same_owner+0x340/0x340 [ 299.623665] ? kasan_check_write+0x14/0x20 [ 299.627892] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 299.632808] ? rcu_note_context_switch+0x730/0x730 [ 299.637813] __should_failslab+0x124/0x180 [ 299.642043] should_failslab+0x9/0x14 [ 299.645835] kmem_cache_alloc+0x2af/0x760 [ 299.649973] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 299.654890] ? kasan_check_write+0x14/0x20 [ 299.659109] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 299.664110] __kernfs_new_node+0xef/0x5a0 [ 299.668242] ? kernfs_dop_revalidate+0x3c0/0x3c0 [ 299.672987] ? mutex_unlock+0xd/0x10 [ 299.676685] ? kernfs_activate+0x21a/0x2c0 [ 299.680902] ? kernfs_walk_and_get_ns+0x340/0x340 [ 299.685733] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 299.691263] ? kernfs_link_sibling+0x1d2/0x3b0 [ 299.695829] kernfs_new_node+0x80/0xf0 [ 299.699700] __kernfs_create_file+0x4d/0x330 [ 299.704094] sysfs_add_file_mode_ns+0x21a/0x560 [ 299.708749] internal_create_group+0x26d/0x9e0 [ 299.713317] sysfs_create_group+0x1f/0x30 [ 299.717454] lo_ioctl+0x1307/0x1d70 [ 299.721073] ? lo_rw_aio_complete+0x450/0x450 [ 299.725552] blkdev_ioctl+0x9cd/0x2030 [ 299.729459] ? lock_acquire+0x1e4/0x540 [ 299.733419] ? blkpg_ioctl+0xc40/0xc40 [ 299.737292] ? lock_release+0xa30/0xa30 [ 299.741257] ? save_stack+0xa9/0xd0 [ 299.744877] ? save_stack+0x43/0xd0 [ 299.748496] ? __fget+0x4d5/0x740 [ 299.751937] ? ksys_dup3+0x690/0x690 [ 299.755638] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 299.760219] ? kasan_check_write+0x14/0x20 [ 299.764459] ? do_raw_spin_lock+0xc1/0x200 [ 299.768676] block_ioctl+0xee/0x130 [ 299.772286] ? blkdev_fallocate+0x400/0x400 [ 299.776595] do_vfs_ioctl+0x1de/0x1720 [ 299.780477] ? ioctl_preallocate+0x300/0x300 [ 299.784879] ? __fget_light+0x2f7/0x440 [ 299.788848] ? fget_raw+0x20/0x20 [ 299.792291] ? trace_hardirqs_on+0xd/0x10 [ 299.796430] ? kmem_cache_free+0x22e/0x2d0 [ 299.800657] ? putname+0xf7/0x130 [ 299.804103] ? do_sys_open+0x3cb/0x720 [ 299.808000] ? security_file_ioctl+0x94/0xc0 [ 299.812409] ksys_ioctl+0xa9/0xd0 [ 299.815849] __x64_sys_ioctl+0x73/0xb0 [ 299.819728] do_syscall_64+0x1b9/0x820 [ 299.823610] ? syscall_return_slowpath+0x5e0/0x5e0 [ 299.828521] ? syscall_return_slowpath+0x31d/0x5e0 [ 299.833454] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 299.838473] ? prepare_exit_to_usermode+0x291/0x3b0 [ 299.843484] ? perf_trace_sys_enter+0xb10/0xb10 [ 299.848571] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 299.853404] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 299.858574] RIP: 0033:0x455927 [ 299.861742] Code: 48 83 c4 08 48 89 d8 5b 5d c3 66 0f 1f 84 00 00 00 00 00 48 89 e8 48 f7 d8 48 39 c3 0f 92 c0 eb 92 66 90 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 7d bb fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 299.880873] RSP: 002b:00007f088c102a88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 16:56:56 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000006800000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 299.888579] RAX: ffffffffffffffda RBX: 0000000020000190 RCX: 0000000000455927 [ 299.895847] RDX: 0000000000000014 RSI: 0000000000004c00 RDI: 0000000000000015 [ 299.903102] RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000000a [ 299.910356] R10: 0000000000000075 R11: 0000000000000246 R12: 0000000000000014 [ 299.917622] R13: 0000000000000000 R14: 00000000004d3c90 R15: 000000000000000e [ 299.930070] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing 16:56:57 executing program 2 (fault-call:2 fault-nth:15): mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) [ 299.945800] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue 16:56:57 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x0, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:57 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x5, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc\x00', 0x0, 0x0) clone(0x0, &(0x7f0000b53000), &(0x7f0000000080), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8008700b, &(0x7f00000002c0)) 16:56:57 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) gettid() ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000040)) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)=0x0) sched_setaffinity(r2, 0xfffffd06, &(0x7f00000000c0)) ioctl$KVM_ENABLE_CAP(r1, 0x4008ae48, &(0x7f0000000200)) 16:56:57 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x4, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha3-224-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000140)="15ae93dae8e8dc67ea91aac7ed6f7bdbce9655c348f49b4f175a2aca927f7dfe72b4d4e320a480b4388f23e17ab186aae8c1f7fa1c4515c5d481698d26ee54a643984279b21d90d0c08996c8ad6437f7ae239719695115029a9f39b0a595628563fe40bfc47ec9b2a3f8600056381ed73d2a6d9675fb82a87f3aa653285fd7cf63d41ed902a8a19de217d48d3b186a06d5", 0x91) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x200000, 0x0) ioctl$EVIOCGBITSND(r2, 0x80404532, &(0x7f00000002c0)=""/133) 16:56:57 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000040000000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:57 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) mlock(&(0x7f0000fff000/0x1000)=nil, 0x1000) ioctl(r0, 0x1000000000008912, &(0x7f0000000040)="02a97ac1d41d0b338f70") futex(&(0x7f000000cffc)=0x4, 0x100, 0x4, &(0x7f0000edfff0)={0x77359400}, &(0x7f0000048000), 0x0) futex(&(0x7f0000000080), 0x4, 0x1, &(0x7f0000000000), &(0x7f0000000100), 0xfff) [ 300.121526] binder: 21275:21283 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1744830464 [ 300.129712] binder: 21275:21283 unknown command 4743953 [ 300.141569] binder: 21275:21283 ioctl c0306201 20000000 returned -22 16:56:57 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x0, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:57 executing program 0: r0 = creat(&(0x7f0000000040)='./file0\x00', 0x0) write$sndseq(r0, &(0x7f0000011fd2), 0xfff6) fallocate(r0, 0x8, 0x0, 0x8000) dup2(0xffffffffffffffff, 0xffffffffffffffff) mknodat(r0, &(0x7f0000000000)='./file0\x00', 0x8000, 0x68) [ 300.236863] FAULT_INJECTION: forcing a failure. [ 300.236863] name failslab, interval 1, probability 0, space 0, times 0 [ 300.248193] CPU: 1 PID: 21301 Comm: syz-executor2 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 300.256605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 300.265967] Call Trace: [ 300.268559] dump_stack+0x1c9/0x2b4 [ 300.272187] ? dump_stack_print_info.cold.2+0x52/0x52 [ 300.277375] ? rcu_note_context_switch+0x730/0x730 [ 300.282319] should_fail.cold.4+0xa/0x11 [ 300.286386] ? kasan_check_write+0x14/0x20 [ 300.290637] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 300.295796] ? kernfs_activate+0x8e/0x2c0 [ 300.299959] ? ___ratelimit.cold.2+0x6b/0x6b [ 300.304404] ? mutex_trylock+0x2b0/0x2b0 [ 300.308487] ? kasan_check_write+0x14/0x20 [ 300.312747] ? __radix_tree_replace+0x188/0x2f0 [ 300.317430] ? kernfs_add_one+0x4f/0x4d0 [ 300.321497] ? kernfs_activate+0x21a/0x2c0 [ 300.325745] ? lock_downgrade+0x8f0/0x8f0 [ 300.329925] ? lock_acquire+0x1e4/0x540 [ 300.333917] ? fs_reclaim_acquire+0x20/0x20 [ 300.338277] ? lock_downgrade+0x8f0/0x8f0 [ 300.342445] ? check_same_owner+0x340/0x340 [ 300.346783] ? kasan_check_write+0x14/0x20 [ 300.351031] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 300.355977] ? rcu_note_context_switch+0x730/0x730 [ 300.360923] __should_failslab+0x124/0x180 [ 300.365178] should_failslab+0x9/0x14 [ 300.366894] binder: 21307:21314 BC_REQUEST_DEATH_NOTIFICATION invalid ref 262144 [ 300.369074] kmem_cache_alloc+0x2af/0x760 [ 300.369093] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 300.369110] ? kasan_check_write+0x14/0x20 [ 300.369129] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 300.369142] __kernfs_new_node+0xef/0x5a0 [ 300.369158] ? kernfs_dop_revalidate+0x3c0/0x3c0 [ 300.403920] ? mutex_unlock+0xd/0x10 [ 300.407644] ? kernfs_activate+0x21a/0x2c0 [ 300.410723] binder: 21307:21314 unknown command 4743953 [ 300.411888] ? kernfs_walk_and_get_ns+0x340/0x340 [ 300.411907] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 300.411920] ? kernfs_link_sibling+0x1d2/0x3b0 [ 300.411935] kernfs_new_node+0x80/0xf0 [ 300.411949] __kernfs_create_file+0x4d/0x330 [ 300.411966] sysfs_add_file_mode_ns+0x21a/0x560 [ 300.445224] internal_create_group+0x26d/0x9e0 [ 300.448164] binder: 21307:21314 ioctl c0306201 20000000 returned -22 [ 300.449843] sysfs_create_group+0x1f/0x30 [ 300.449859] lo_ioctl+0x1307/0x1d70 [ 300.449876] ? lo_rw_aio_complete+0x450/0x450 [ 300.449891] blkdev_ioctl+0x9cd/0x2030 [ 300.449905] ? lock_acquire+0x1e4/0x540 [ 300.449918] ? blkpg_ioctl+0xc40/0xc40 [ 300.449931] ? lock_release+0xa30/0xa30 [ 300.449953] ? save_stack+0xa9/0xd0 [ 300.488005] ? save_stack+0x43/0xd0 [ 300.491644] ? __fget+0x4d5/0x740 [ 300.495112] ? ksys_dup3+0x690/0x690 [ 300.498836] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 300.503434] ? kasan_check_write+0x14/0x20 [ 300.507684] ? do_raw_spin_lock+0xc1/0x200 [ 300.511965] block_ioctl+0xee/0x130 [ 300.515604] ? blkdev_fallocate+0x400/0x400 [ 300.519937] do_vfs_ioctl+0x1de/0x1720 [ 300.523843] ? ioctl_preallocate+0x300/0x300 [ 300.528289] ? __fget_light+0x2f7/0x440 [ 300.532274] ? fget_raw+0x20/0x20 [ 300.535748] ? trace_hardirqs_on+0xd/0x10 [ 300.539907] ? kmem_cache_free+0x22e/0x2d0 [ 300.544157] ? putname+0xf7/0x130 [ 300.547618] ? do_sys_open+0x3cb/0x720 [ 300.551516] ? security_file_ioctl+0x94/0xc0 [ 300.555935] ksys_ioctl+0xa9/0xd0 [ 300.559393] __x64_sys_ioctl+0x73/0xb0 [ 300.563283] do_syscall_64+0x1b9/0x820 [ 300.567162] ? syscall_return_slowpath+0x5e0/0x5e0 [ 300.572095] ? syscall_return_slowpath+0x31d/0x5e0 [ 300.577033] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 300.582060] ? prepare_exit_to_usermode+0x291/0x3b0 [ 300.587083] ? perf_trace_sys_enter+0xb10/0xb10 [ 300.591756] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 300.594376] FAT-fs (loop7): bogus number of reserved sectors [ 300.596607] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 300.596619] RIP: 0033:0x455927 [ 300.596622] Code: 48 83 c4 08 48 89 d8 [ 300.602452] FAT-fs (loop7): Can't find a valid FAT filesystem [ 300.607603] 5b 5d c3 66 0f 1f 84 00 00 00 00 00 48 89 e8 48 f7 d8 48 39 c3 0f 92 c0 eb 92 66 90 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 7d bb fb ff c3 66 2e 0f 1f 84 00 00 00 00 16:56:57 executing program 0: r0 = socket$nl_generic(0xa, 0x5, 0x84) r1 = socket$inet6(0xa, 0x3, 0x4) write$binfmt_misc(r0, &(0x7f0000000300)={'syz1', "56f857ef21902b67d5834ae2fe0f024af2114aecc7176e8a4b356a783d70a69aa2c767203446d6f384d740320ce45f0ff9f13bcd2231a5b41546dc624bdd01bcf7afb4468f5c781f81e3b0a16489c75207a67d9da494d1ba2b1966f7539b64c0409251d9ade8e76831e8de5d84a574fd3edddd12baf69760c1b77793169dfaa65a60c452797d4567d25eb6183efbe345ba805a083ab50d074e874c968efff29424"}, 0xa5) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r2 = syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0x3, 0x185c00) fstat(r0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000000200)=0xc) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x9000}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x200}, 0x2c}, {@max_read={'max_read', 0x3d}, 0x2c}]}}) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000140)={"62726964676530000000008000", &(0x7f0000000100)=@ethtool_cmd={0x7, 0x0, 0x709000}}) 16:56:57 executing program 7: syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0xe000, 0xaaaaaaaaaaaacba, &(0x7f0000000040)=[{&(0x7f0000000400)="eb3c90ffa60001e0cf4e3cba03066a0b9adb14b079860352a86c1240f59c3b8be6bfddca761c8828e5c7d8b2e9ac2371097e61233ed44a5f911a553d94a3796a89adf87f9efac1c94ee692c4982ebe48171acddc767e1ead5e577667c51a4e99c9f1c91a72e40a9d8b8d51f72b2b7576444e1935a7ab87146d4c0a2a4f2774f5fa4dc80364048732035ec3c106cbc9e4c45f75912a2d965f3ab4dd36dd6d2bb707d5442417dd04171fc523553201a29a701a6ca1fcee39b4b39cdf334f4574cb6e22b5b766d766576a48491eecd1c48b245e4f9b5ecb6dd9108ecd918f8bfbda398612a7637f1f5e64949b194de9cc3fa4fe9a49c35dc89719e05c115dd7e821135fe57dabcf4789e72ae458d725d5216c492027300ac45421d6b4da2881d361094df0b7ece198ac12e00e22828c7a35e0045a4ddb157d22cbce2aa87b334d1ba1d74780842e4374fcbec40f7da3fd80555579f0a3641205fe48130f784d9c39ec0d6628ce0dd0740e2e12f657062c173cb72ee6d9527b44e08404cd01007ed11ac2f21c3e4779042b36bc1c9a0a293cc700e8adb75f285c010e", 0x19a}], 0x0, &(0x7f0000000240)=ANY=[]) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhost-vsock\x00', 0x2, 0x0) fallocate(0xffffffffffffffff, 0x2, 0x0, 0x8004) write$P9_RREADDIR(0xffffffffffffffff, &(0x7f0000000200)=ANY=[@ANYBLOB="55000000290100e2590000420000000001000000000000004dfd000000000000000d002e2f66696c65302f66696c653009030000004dd6626ea5710400000000000000ffff000000000000af0d002e2f66696c65302f66696c65301f12c6f3096cade1b893cb3b23933ab7fc27a0e3e18c0ca90c227c50d327bf4500eaee7fe152e486791581ea8d7fcd3713b78fa969db2d89020dbd5042ab7087c605a183bed693acf2fa6b9c943e936e82"], 0x55) 16:56:57 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000680000000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:57 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000000)={0x0, 0x9, 0x81, 0x0, 0x3ff}, &(0x7f0000000040)=0x14) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000080)={r2, @in={{0x2, 0x4e23}}, 0x6}, 0x90) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000140)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000004c0)={0x58, 0x0, &(0x7f0000000180)=[@acquire_done={0x40106309, r3, 0x4}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000300)}}], 0x0, 0x0, &(0x7f0000000480)}) 16:56:57 executing program 6: write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000200)={0xffffffffffffffff}, 0x13f, 0x1009}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffff9c, &(0x7f0000000280)={0x5, 0x10, 0xfa00, {&(0x7f0000000000), r0, 0x2}}, 0x18) [ 300.637378] RSP: 002b:00007f088c102a88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 300.645084] RAX: ffffffffffffffda RBX: 0000000020000190 RCX: 0000000000455927 [ 300.652356] RDX: 0000000000000014 RSI: 0000000000004c00 RDI: 0000000000000015 [ 300.659262] binder: 21333:21336 BC_REQUEST_DEATH_NOTIFICATION invalid ref 6815744 [ 300.659625] RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000000a [ 300.667776] binder: 21333:21336 unknown command 4743953 [ 300.674491] R10: 0000000000000075 R11: 0000000000000246 R12: 0000000000000014 [ 300.674498] R13: 0000000000000000 R14: 00000000004d3c90 R15: 000000000000000f [ 300.696199] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 300.719592] binder: 21334:21341 BC_ACQUIRE_DONE u0000000000000000 node 1596 cookie mismatch 0000000000000004 != 0000000000000000 16:56:58 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x0, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:58 executing program 6: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000003fe8)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet6_sctp(0xa, 0x80000000006, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f0000013e95), 0x4) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000240)=0x20) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x2000, 0x0) accept$packet(r3, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f00000000c0)=0x14) ioctl$sock_inet6_SIOCDIFADDR(r1, 0x8936, &(0x7f0000000100)={@mcast2={0xff, 0x2, [], 0x1}, 0x9, r4}) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r3, 0x84, 0x7b, &(0x7f0000000140)={r2, 0x8b}, &(0x7f0000000180)=0x8) ioctl$sock_bt_bnep_BNEPGETSUPPFEAT(r3, 0x800442d4, &(0x7f0000000040)=0x3) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x2, 0x60013, r1, 0x0) close(r0) [ 300.748894] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue [ 300.756766] FAT-fs (loop7): bogus number of reserved sectors [ 300.762762] FAT-fs (loop7): Can't find a valid FAT filesystem 16:56:58 executing program 2 (fault-call:2 fault-nth:16): mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:56:58 executing program 1: r0 = syz_open_dev$adsp(&(0x7f0000000140)='/dev/adsp#\x00', 0xfffffffffffffffe, 0x1414c0) gettid() ioctl$sock_SIOCDELDLCI(r0, 0x8981, &(0x7f0000000240)={'gretap0\x00', 0x5}) sendmsg$key(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="3f056f3b3a933e7874d0e17ad61cefa27ca35eef16ce6670e1acdaaea5da94710f9c0de5638eb07ea5e709dc7483"], 0x5}, 0x1}, 0x0) r1 = syz_open_dev$sndpcmc(&(0x7f0000000280)='/dev/snd/pcmC#D#c\x00', 0x8, 0x2000) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000200)) r2 = socket$inet(0x2, 0x3, 0x2) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$inet_int(r2, 0x1f00000000000000, 0xd2, &(0x7f0000000000), 0x3c) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f0000000040)={&(0x7f0000ffd000/0x2000)=nil, 0x2000}, &(0x7f0000000100)=0x10) ioctl$TIOCGWINSZ(r1, 0x5413, &(0x7f00000001c0)) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r0, 0x111, 0x3, 0x0, 0x4) mmap(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0xe, 0x10010, 0xffffffffffffffff, 0x23) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f00000002c0)={0x0, 0x1ff, 0x10}, &(0x7f0000000300)=0xc) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000340)={r3, 0x6, 0x30, 0xfffffffffffffffc, 0x100}, &(0x7f0000000380)=0x18) [ 300.792923] binder: 21334:21341 got transaction to context manager from process owning it [ 300.801371] binder: 21334:21341 transaction failed 29201/-22, size 0-0 line 2843 [ 300.809425] binder: 21333:21336 ioctl c0306201 20000000 returned -22 [ 300.825553] binder: BINDER_SET_CONTEXT_MGR already set [ 300.832076] binder: 21334:21341 ioctl 40046207 0 returned -16 [ 300.833972] binder: BINDER_SET_CONTEXT_MGR already set 16:56:58 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c40000000000000000007cd00000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:58 executing program 7: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00003cefe4)={&(0x7f0000000300)={0x10, 0x36200}, 0xc, &(0x7f0000000000)={&(0x7f0000000180)={0x20, 0x2e, 0x6fd, 0x0, 0x0, {0x2004}, [@nested={0xc, 0x0, [@typed={0x8, 0x9, @ipv4}]}]}, 0x20}, 0x1}, 0x0) fcntl$F_SET_FILE_RW_HINT(r0, 0x40e, &(0x7f0000000040)=0x7) 16:56:58 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2272, &(0x7f0000000400)=0xffffffffffffffff) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x180, 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f0000000080)={[{0x2, 0x1, 0x5, 0x1b0, 0x600, 0x9e84, 0x1f, 0x10001, 0x8, 0x7, 0x2, 0x7ff, 0xdc}, {0x2, 0xfffffffffffffff8, 0xbc, 0x3, 0x0, 0x1, 0x7fff, 0x4, 0x5, 0x7, 0x2, 0x3f, 0x1}, {0xfffffffffffffffb, 0xffffffffffff0000, 0x1, 0x8000, 0x4, 0x100000001, 0x7, 0x7, 0x998, 0xe69c, 0x80000001, 0x8000, 0x99}], 0x74a5}) [ 300.844151] binder: 21333:21336 ioctl 40046207 0 returned -16 [ 300.849235] binder: undelivered TRANSACTION_ERROR: 29201 16:56:58 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x0, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 301.006727] binder: 21377:21382 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 301.015463] binder: 21377:21382 unknown command 4743953 [ 301.024496] binder: 21377:21382 ioctl c0306201 20000000 returned -22 [ 301.031554] FAULT_INJECTION: forcing a failure. [ 301.031554] name failslab, interval 1, probability 0, space 0, times 0 [ 301.042808] CPU: 1 PID: 21383 Comm: syz-executor2 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 301.051216] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 301.060575] Call Trace: [ 301.063187] dump_stack+0x1c9/0x2b4 [ 301.066829] ? dump_stack_print_info.cold.2+0x52/0x52 [ 301.072032] ? rcu_note_context_switch+0x730/0x730 [ 301.076979] should_fail.cold.4+0xa/0x11 [ 301.081055] ? kasan_check_write+0x14/0x20 [ 301.085298] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 301.090401] ? kernfs_activate+0x8e/0x2c0 [ 301.094550] ? ___ratelimit.cold.2+0x6b/0x6b [ 301.098955] ? mutex_trylock+0x2b0/0x2b0 [ 301.103020] ? kasan_check_write+0x14/0x20 [ 301.107274] ? __radix_tree_replace+0x188/0x2f0 [ 301.111948] ? kernfs_add_one+0x4f/0x4d0 [ 301.116027] ? kernfs_activate+0x21a/0x2c0 [ 301.120276] ? lock_downgrade+0x8f0/0x8f0 [ 301.124446] ? lock_acquire+0x1e4/0x540 [ 301.128437] ? fs_reclaim_acquire+0x20/0x20 [ 301.132776] ? lock_downgrade+0x8f0/0x8f0 [ 301.136944] ? check_same_owner+0x340/0x340 [ 301.141282] ? kasan_check_write+0x14/0x20 [ 301.145559] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 301.150502] ? rcu_note_context_switch+0x730/0x730 [ 301.155448] __should_failslab+0x124/0x180 [ 301.159707] should_failslab+0x9/0x14 [ 301.163524] kmem_cache_alloc+0x2af/0x760 [ 301.167690] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 301.172643] ? kasan_check_write+0x14/0x20 [ 301.176897] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 301.181933] __kernfs_new_node+0xef/0x5a0 [ 301.186099] ? kernfs_dop_revalidate+0x3c0/0x3c0 [ 301.190879] ? mutex_unlock+0xd/0x10 [ 301.194624] ? kernfs_activate+0x21a/0x2c0 [ 301.198850] ? kernfs_walk_and_get_ns+0x340/0x340 [ 301.203683] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 301.209214] ? kernfs_link_sibling+0x1d2/0x3b0 [ 301.213789] kernfs_new_node+0x80/0xf0 [ 301.217663] __kernfs_create_file+0x4d/0x330 [ 301.222063] sysfs_add_file_mode_ns+0x21a/0x560 [ 301.226724] internal_create_group+0x26d/0x9e0 [ 301.231298] sysfs_create_group+0x1f/0x30 [ 301.235432] lo_ioctl+0x1307/0x1d70 [ 301.239058] ? lo_rw_aio_complete+0x450/0x450 [ 301.243545] blkdev_ioctl+0x9cd/0x2030 [ 301.247419] ? lock_acquire+0x1e4/0x540 [ 301.251376] ? blkpg_ioctl+0xc40/0xc40 [ 301.255258] ? lock_release+0xa30/0xa30 [ 301.259227] ? save_stack+0xa9/0xd0 [ 301.262859] ? save_stack+0x43/0xd0 [ 301.266478] ? __fget+0x4d5/0x740 [ 301.269927] ? ksys_dup3+0x690/0x690 [ 301.273621] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 301.278194] ? kasan_check_write+0x14/0x20 [ 301.282419] ? do_raw_spin_lock+0xc1/0x200 [ 301.286638] block_ioctl+0xee/0x130 [ 301.290258] ? blkdev_fallocate+0x400/0x400 [ 301.294578] do_vfs_ioctl+0x1de/0x1720 [ 301.298469] ? ioctl_preallocate+0x300/0x300 [ 301.302862] ? __fget_light+0x2f7/0x440 [ 301.306833] ? fget_raw+0x20/0x20 [ 301.310271] ? trace_hardirqs_on+0xd/0x10 [ 301.314417] ? kmem_cache_free+0x22e/0x2d0 [ 301.318637] ? putname+0xf7/0x130 [ 301.322077] ? do_sys_open+0x3cb/0x720 [ 301.325950] ? security_file_ioctl+0x94/0xc0 [ 301.330344] ksys_ioctl+0xa9/0xd0 [ 301.333783] __x64_sys_ioctl+0x73/0xb0 [ 301.337668] do_syscall_64+0x1b9/0x820 [ 301.341547] ? syscall_return_slowpath+0x5e0/0x5e0 [ 301.346464] ? syscall_return_slowpath+0x31d/0x5e0 [ 301.351380] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 301.356381] ? prepare_exit_to_usermode+0x291/0x3b0 [ 301.361388] ? perf_trace_sys_enter+0xb10/0xb10 [ 301.366055] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 301.370901] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 301.376084] RIP: 0033:0x455927 [ 301.379266] Code: 48 83 c4 08 48 89 d8 5b 5d c3 66 0f 1f 84 00 00 00 00 00 48 89 e8 48 f7 d8 48 39 c3 0f 92 c0 eb 92 66 90 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 7d bb fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 301.398408] RSP: 002b:00007f088c102a88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 301.406127] RAX: ffffffffffffffda RBX: 0000000020000190 RCX: 0000000000455927 [ 301.413392] RDX: 0000000000000014 RSI: 0000000000004c00 RDI: 0000000000000015 [ 301.420664] RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000000a [ 301.427937] R10: 0000000000000075 R11: 0000000000000246 R12: 0000000000000014 [ 301.435202] R13: 0000000000000000 R14: 00000000004d3c90 R15: 0000000000000010 [ 301.443789] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 301.457251] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue 16:56:59 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x1, 0x0) openat$cgroup_int(r1, &(0x7f0000000040)='cpuset.memory_spread_slab\x00', 0x2, 0x0) prctl$intptr(0x25, 0xa07000) 16:56:59 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="025cc83d6d345f8f762070") r1 = socket$key(0xf, 0x3, 0x2) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000340)=[@in={0x2, 0x4e21, @loopback=0x7f000001}], 0x10) sendmsg$key(r1, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000f36000)={&(0x7f0000333f88)=ANY=[@ANYBLOB="020300090c000000ffffffffffffffff02001300020000000000000000000000030006000000000002004e20e0000001000000000000002402000100f8ffffff0000000200000000030005000000000002004e20e00000a0ea863accd2ce5ea2"], 0x60}, 0x1}, 0x0) umount2(&(0x7f0000000300)='./file0\x00', 0x4) vmsplice(r1, &(0x7f00000002c0)=[{&(0x7f0000000040)="8bd5cf95dd565ee6820ceebc0a5030a5d015af139775dbd23dfbdc229aa08fc5971c4bc5e0eb39f824afff6d76c1ae52f8ba754a9e3cb4772397808e97e339bdee3347741227507a55af4de2778b0744ccf8f59ff310b16a37345a60a9eda184821e0957f0420dfa1c62f04027d4437ab330db71e12f8c", 0x77}, {&(0x7f00000000c0)="f3d63eb3be4471e219e65b3306c29ba10fbe5fc77efe00e789cc02e5b015cd6b964282d00d2894128f9d6c6ba661951f92871989724558b625bdba2c90a590518e8443db4610b7df5060c3b7c54ce88766e8177fffd05d9fd351b90c8f4e3a41fd621fefc376ce6e740fcbd01d063ddaafa42a447f7f034935a9bf7e91d817ce575239fd8bfcf84ec61acd26fd04fdad1b6784", 0x93}, {&(0x7f0000000180)="6030b5aae77b6f845300a4783f4452e76e1f93a60e2a835bfdb1753aaee7806f1156c4a162bf3263c96422d39855cce184494b81e064811c1691d27ff4753c40c675acfedf62f9b474bfb2d2261fe0c38f793bdc0e5395eb42ba7fa1ee810fc8a055b7934b45b6b41839d9c4c28437d21bffcee3b132eee700c795df12f6fedbae7c1be2ec8fe0da4b7f84e275b41fc3aa4282adb621d7e33014924299f573d0f6b5dc753e643106c69aa130ee8d284b3dd1ddbc7771ee4bc0ae1d6a43b5557c6d1af9ad1c1f7de4f5015208a850cb3deaac043e577e", 0xd6}, {&(0x7f0000000280)="98", 0x1}], 0x4, 0x8) 16:56:59 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") socket$pppoe(0x18, 0x1, 0x0) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f00000000c0)={0x18, 0x0, {0x1, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 'ip6_vti0\x00'}}, 0x1e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$PPPOEIOCSFWD(r1, 0x80047453, &(0x7f0000000040)={0x18, 0x4, {0x0, @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, 'ip_vti0\x00'}}) syz_emit_ethernet(0x88, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], {@generic={0x6004, "1480125eff87e9926b5a8f372c487da0808dd18dfb30997c68277ec82bf065a72088b1a07e62603952212c62ce595ddf9a500573680b132baffa72e347014fa999f8daac57c612786ec86ddcd10fcac166abba23b90356f89d802d9d5b39c3717fbda1097b59cb77748cd6605234d8f07790a510cdbec2281aad"}}}, &(0x7f0000000000)={0x1, 0x2, [0xa76, 0x3a4, 0x8c4, 0x2fe]}) socket$inet6(0xa, 0x800, 0x1) 16:56:59 executing program 7: syz_read_part_table(0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)='ER\b', 0x3}]) r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000001400)={0x0, 0xe, "fb159b0776acb91a04fc84d32988"}, &(0x7f0000001440)=0x16) getsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000001480)={r1, 0x40}, &(0x7f00000014c0)=0x8) syz_read_part_table(0x1, 0x7, &(0x7f0000001340)=[{&(0x7f0000000000)="e5a36498849527f63a84550bd7a83a6c35c60341", 0x14, 0x5915}, {&(0x7f0000000040), 0x0, 0x29}, {&(0x7f0000000080)="63422f842cb9cdaeccb1a7a66c40ad9bbfd9265cfb4b57ca73f7e65e922cbad508b561f80f66cf3ffc99d22335ee5a07ff925e7adfc90592379dfae3b2577d2deba64f61d7c40e2713c572bad83392fa7227713898b387095b039b575bdb4deb90c81e89ac374b13d04b6a93964b152b2f4bede3c9be", 0x76, 0xa8}, {&(0x7f0000000100)="134c40164ed5326de640b6d7476d7a4bd26043db283d6023fe8ecb4f6463df5a20db865e94d208ac3b3b486981b32fc502fc502819261b80c52f23eab37d3dfe869674338d806638867d54cd03e7342f6fd0c54ce2336f9791f70daa63c1b803ebd2e1dc952c4e2b8d1c176ac8c2da4205b04c2ecb7ea96de9dbbf5931581c35422da195dfe85c2ace5c5ea23c920c74c16741d164e53c9291340636f919f359117127e33775f85916c4a38486b3f022b8b5af423b74a073e5ee9d612e6e3c82b4e2ea9aae78aa804bf762572eab9a052786a573ab684ba304b326ad0f3617a1cbabdbcf38cf0f81d59b6840804727a36435167520f6ae", 0xf7, 0x9b9}, {&(0x7f0000000240)="9f3602e32515659c1f3ae691ea4ff337a3252d1fac45e354ef73bbecb74bc7c727e7dd66a7f667089e32dce6f03cab60df4f1ffa5b5296182ade39c8bfd62c1f69670e562661392bf912cb5dd6c0e466cd9367e841bc925c8f8ca96c0abb161b08c14b0a2d66383c989275dfc525b3d541324ce508cbe86bc698465432c9aa88f964d8a930da5fcdf44700eca005b43d32316c08c56fc451692f143bab1bda684413fcad3d9771ac6d3839042df639fc5528a7dea138d67d1146d98828ea4b74b7dfabeac6917f771b205ad22831afc88ad9a76654dc59cd293997153053278d7c8bc8d5f8d8221952d064ce547b76c43d8b84012b341a664b49924e9f1374e1786cea776e305d7ec155512f13a888f8629ec8615d05df6a2f57d7e0759ca771658ecc7c81840af27c03392ea6907f59c2990f4f9e40aaee11f935783e4c17f84c70173e830789e22bfa29a35b5521414b98b3fb39ef2069c49a452f6e75b8f7b20da9b5bd7329799d4664f0d98407e87b4c9d74478d8a36cb63e1da43a480d4b0c791e0b7107824a70e02c707618ead84498cf2cf4b5b25fc1731b46ade033ad4a664fa892ba84acebdfd1822e04a49380a60dfe1ac2e03a37be39cc6e5f924ce36053c0af064639a29b0a14b032c5025040e77696fff6853db7a8c2b4466f2f52b6e864fb107272988dbd4a73cc8e9f4be5c2dba346ab34d58065ee748d58836646fbc77248d312beecd19028f352c9728ae26ec0ea4436c5fb77f9e502a3dda4d3977d907852b6291af068c10a2cff70b0278e4cd270ea6a2b14864be314b059e68471eaec1808a7a39b6bf65ef7c2d62e63834328ae29a88ea9c3ef9b0c1784e7bd8119e8c40a3aa2c307f62ad5b1ddf2d56fba1c819ec58331c3ba14c2ed059b2456baf962868a749d216ee056023cfc2ec324e28a202e0d7c19e3381f715939fb35309775438c87408754e44d1ce3b8ea5b61b8838d7772a07d338fb530b84148d4619e8c695185ba8c179ba3a571b1c0d07f35c2bfce17de36af68c26b5feae3e51c93cf3af54c71b91df819923623433f6140271563dc387f081a40dfdf16b9ac42ce0d8ec865d345421442ab1dd4310f54da19f780477f6034e04ed0c421275b86b85bf63c732dfb14d18b51682b48e5432d4ae64faa6df59b49d1e5ac0e0fa5007e67ade0a7005c4db836ed6899f947b39150cc91dc9d9c9344768e818da546991b04b38ecb8fe44c6f1136040afd8def109bb977b8ba1cd27d312eae95bafda0593441d2586d9acbbfb0fc7dfa95185159ea8219e20881f2ee751d03b0d45f4bc31539c2c833317c074cc90c88fd9a374733bef7df8e37e2d46f6de78f14c19e095257e3b68038cda20779fa9f95c1ad050b42a77f39f4d414e6b01e8fbd31e7f17033afea88544f9a4116f42f07d8aacee390be10831f9951a563f875cbd5f9e5ed02f5356e6673acbdd175dd14d47f32f8354cf2323194d451361b6194d0159b13cc829a6c3f9309f29f11bb97be4b7d3d99bde545e2317400ee08409033f5b5afe3740cf4e1b229d92dcb7ed9b2ebbba34d3e569584d9963b9d3464517b8096b40fb9736cc68ff61de90973fc6620dd41dabef6c564e6f04cc6099b888df631c6c4d478117b16ff7cb1eec62407c021339e7ce6eeb98de0600ad3027c7ff469628225b54e0ed0eaa15b3b67442787e9ecbdc87c8c12cc881ec1a0ba1a07830b417e61bae77452c8863d60cceecede2fa827eb257a3a4d808f0d052ee640cb0f8b95c7449098e53a1723bc3d42d2247221ae412bf47b8c5f1b9a40ff544870200260180ea7d803d66e891ce2d13d9e7d63648595b291e638ed7612cea176730bac59cb078e49dd4879d2e7dc421415d85ad1d460c11b9855654279f590a4421aa832d62f9e53da5b0637015b8001741ccb03cfac8bfcfbf2f9a844852b2c80e94a7bb3019bd7992c4149616563a645aa9e344738d391a6cec6d21a20df731e8cd38e4ddcf1da466241b4f14270cbbb4128166f426dacb4f8e528bfee6b247627df24458d332c61b4ddd894cc5a30115535f45ec341e143577932e8e0bddd428cad7b894850d881edbe12dcae47f9281ec4b9272bc7b9f193f734d32bba9f1812717a7058c045f9fe7d0d079a3737aaa581a577cfc693875a472ad4909c8ea539bbe466745d6072d91818233e999b8fb3eefa4f96369aac6344560831a47f46e0c5571b05ce7033fda2d805a8904e8b7e4e43c8f4fc526eb4089852951e3a15961bfabc6cb500a5d96c696171de4b7335ab5643594f27b58fbf0ebcdd2179f7612fc0492e130fa9a9c47f7559599a5f792e876de53330bbfa525cbb06458941696710cea37876ab996de88da1ef1ae04c16816383bf235e47405a05818676715b249c2354242fd69e16a09799a146e029750d8adb021cc2ad42123cf647dac6c554ff67bb89d1d7513072b6d546deba94675c724ead37d8deb3c7be652c4e2aeed3a92138a6deb96e45d5faf7237ac05bb0ee516f024e3659f9401f741a3ba10d27b76ac5cea78e38b5829228c8146891f77460f29729f891aac8d23d461c96c13250b5371a995332a0b512f6f082aeef08b08c95401c00c30aa7f6ebf95b5e17140588699dd18c85d7b4d5957732ac37345d16b0e8316fb173bd68c5ba5e7b7595c354fb21430e1418dbf18e1abfe76ac5a5560bbff938871fe74e26dfcc960bc2e98eec3f008935cd3a28fd1a5b619c3b4b819fbf00dc00ebd7ee2e562135988eecb0f1e7998e648e51a585830a934c6ef448af412012c0466b25c2b622302a95280f16b29b3903e6b377a09c8d855509ac384b5d2090ae234a938648556b9e12a5296418e3aa2a83a51a3f20e78f430542eb9ee56bd79e8705b4562ba9a29f7ff66b949b73f304329e1c69a42b80e701867aaca711fef76b9e6340060aa1060d70bcb1cb2917a6b487671a366e2b5b8a597c7ce11c2d4a6773d0cd961895105989094ceb3a1a8dd002423e239400efbc8bc55efd153bd3b0bc5562141c7c582b9ad174216b1a77d996ebf2614a025a7fe5699b85ddb6527a210d960d51a0bcb1e0bb247bf3f6db6f259fde655b3ad45f9bde8b4eadb481ce1fcf47272ff17d96e7a836a064ea387a5d59cc79c956e0fec245f0299d194d633b3ed6ff7a7bb30ca8125bbefad9e74fbbc47f5d15ab6eb2031d32576e959b60a1b9cd29ede6fc75d84fa0b1f8c9fe96b0fc82a138a1822f7638d897673aea848926a0a5a232b3ef28a71fbebbf9fe3f2e9f65ad0bd3279cfad17db15e1135166f8454347af0d5e66931f47e7e632f6a2263ba2eb09f08527fcf59f9a3f7cb7e62ec9358515d0ef4bb92235baa7a7310527b04485664560ebaf81b8b119413cdef865c69c4a13897175193f67b5de15642d51d868cbe73cc8c9d789e19fcb540abc4220ef80b44ab351c8424d90067078d180e28ac40b96d3e85fb408cc6f18356118939c3625ee9d7f57c6cdb239c4693b54679d35725dabda8907800265de5d323041ae54efcb453cd674327b1222954c94986e6d5416862a3d254e771f9de8dd2944be3117e4840ef5c42d09452c5899ec4188b8a223807680eb18e09a5d674df42a3e6d1207ed078207215cbb94c2a0eb9bb38ee91a827c7f83fd18c305964e14587ed36784f9c118418fa6207e89e0020e1c9dffa721eb49f251f2c967a0db8bc1f9a5eb1bd8be3d84d93ce7b6098920d7ae7a45241e04a778f23390178d4b896adfaf5e44c7a4f838f7e15c6a1ea592a87fabba2bf11c3f8a5e562c98fc992db183782bbf4893e6891a5c0a13cb7c60a903a53859e27a20d90522377dad85abe16cdbc9a32767b61355b0a9703c594352d3aa32eeabf36e29198aee448ac05c962f63b82c0ac21c9fb9287fff4d1c5844e2d4fcee21def4345097a2b4326fac69b37a3973213872fc64bc2d11f6e6c47ff86c7610a26cc2dfa0762627294d0c5f41a091119e03e08739bc673f32031591c0ac7cff2b4d091bd8b633ef47af10e3426ebfb49ca8376e319b8cbfc2de44e5b234bf87b6cde68f2ae85c2a9925b3a1ed8b645c2c1cf6687ef1db347668069f4c11c7e37f6647b4f888e5304973937bfadab938ae900093379117820083a65a2811292df1de800d190b33c26363e9d9578d0921bf10642771914dcebe373c19bb74fe53bb3e3380c89613f14294b2e6bed395831304b0da80ac533ca45ec93147b13cb552a820682c97ed8868a220e09de633a463c432d6def8a05372db99c46117a080f5e24bfd3e847c8abb8f3c47c5961eaf3fe92142c556071b86b252362dbe110d5c81ec7ac8d3d563720f7960b61d5a148ff9328f92d93b90627eb5aa95b3fd3ceb270b60899f9bc4716345c3e5b078c13b02c13b97ebd8c93bdb487f51978546dfd9cd86e55039749deb220317c9194396ab9214987015b5c486673c598faee5d3ad070e48184e43826b93440c5f18b4ea016d6911b41ca7d0340e470ae4f43cb42d14fdabfb97aed114dc242d8f9622ef0a200fb43a89bca36672057756352a0c0803b6193af8edaa4af935bea68fd711f9c30cbdb04d1c7a636c606004f8b488bb7ca20e10c3e1882ec9a9e0a6f6035a4be0174a88020b2dfa4a9f8b571224c1a24f912d0a909deca08d1c3d8dd6e813db6b6659499848071c393fedfef0012a5fc22664fcd4b5a03293be12f76238751394422b724412bcb5624d0ae90b0507fe234c1a801ec550bf14e40d4de008fe07c6c489099ee8e1c9a82797e29e999f303612d339a00b38e745fbf98b0aa77e52d532431361305b616b1b6f8edabbb0598b328bbf983e02d1e5a8ddeaa04de8b33441cbb058804797fc53f1885e4302f41d461f45a36457e11851b6c99991e4ec9c459938bb598c15fa8f58ed174cf0d5994af8106423e257075f90dcb36147027081a7f56f6f55b0e9454686890f3d59aebb95a2e096900ede673a1a3ca744884eb4332593c3652e88f1ba09d3e8e2da58fa227d4b656f16d4a22c9478d13526c9c0227ad94fd428b949903ce19226465c34fd6d3adaddb902f71382810305da3a43d2b83979146a63db704eadb4e1957bc0da18faacb4dc95ff343e8d6eca3ad40145bad391a1e98475fcadcdd6ea4a04054905945a781e116dbeb691de83c072fb68db5427bd8b1e73ba0a9866286bcd9e061877d43fd4c22238caa269b5e3e91d0cc64ffbbcb77b7a5cda278c74f414bde06674cae38c5be204694a9a46c430b431f80ede3fa06069e83b0f786ab2738195d2ad5845af1912597230aef882ea32bb0dc629aa499460ef3fc1860f4e11b99af638f2dbe9f4f6a45f3b7410aac2c06fb24ab1cb9e56e84c2f56f1d55885fab0cad365d84152b681502cc3f202ea0d35ac3aeecbe11b4bf861bf85da38dce3fa1b678399ce5d78ef2014f28ce95319e54a8ab53d491a63fc0b360abe827c48549599c1a7dd134481665207ffc2adc549dc2328a6ff7c215746624f1119cb020cd557c0312e05c203d396e1b156b15e4ee24e9b76b15dfe6bafb8bc3d46e7d6f73d91f5595149316a1c420e79bdaef8114a2a3389a222cc0b44d0aa68d82f039e2b8b9fbad19c88c83ce326933bb99dc77f4e55948cb4f3c5a203e9cb7cd603edd20347c6849c59f4f2e28eca40e4b695f60208b9b0ca89a0332de10783b575f1534cc8fa90f2714b908caa394390dc69f3777f8ad83ce67e03a33d682df1e2051316a292e3f00cb2e5c03ade719d1f336b23607bd3d0aba3999c1d998b4de21d9ad01d46", 0x1000, 0x74ef}, {&(0x7f0000001240)="84d8698bbd338313a4fe792f514c3ba5e8bcc5e11ac41cb0547d38b37b920d36b06de758fef030cecd4e554e35e158bcd0439441923f7ba1a8b5d0189875dbd9ed7ce5242ce9eb7796ffe465bd280e8aaecb89bc2b5478a97181edb2bd967789b98f31b6a55fbc2dba8017d124a4f47e88100cf6de101fa2560a99b39ae43dda75be72bc2c893f4698369512ce71974002a35bdac774a5f973aa578086aa3d783fde42f9c1d2e5f756648d590bfa97dfeace0cca42dd7cd30353", 0xba, 0xffffffff}, {&(0x7f0000001300)="404e0880750b4e4c721c019e4e017043debd5b0ce5ba404fc89ee90198e123da14f25542f34dd847c25d2bec51f333f1e0c3681094e52a1ed44795", 0x3b, 0xb44c0000}]) 16:56:59 executing program 0: r0 = socket$inet6(0xa, 0x5, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000100)='msdos\x00', &(0x7f0000000180)='./file0/file0\x00', 0x0, 0x0, &(0x7f0000001840), 0x0, &(0x7f0000000240)={[{@fat=@nfs='nfs', 0x2c}, {@fat=@gid={'gid', 0x3d}, 0x2c}]}) syz_mount_image$msdos(&(0x7f00000000c0)='msdos\x00', &(0x7f0000000200)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000140)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) 16:56:59 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000000000004c00000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:56:59 executing program 2 (fault-call:2 fault-nth:17): mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:56:59 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x0, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:59 executing program 1: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0xa6000, 0x0) ioctl$KVM_CREATE_PIT2(r0, 0x4040ae77, &(0x7f0000000040)={0x5}) memfd_create(&(0x7f0000000100)='\x00\x00\x00', 0x40000004) [ 301.809596] binder: 21406:21412 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 301.818355] binder: 21406:21412 unknown command 4743953 [ 301.825579] binder: 21406:21412 ioctl c0306201 20000000 returned -22 [ 301.842448] FAULT_INJECTION: forcing a failure. [ 301.842448] name failslab, interval 1, probability 0, space 0, times 0 16:56:59 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000007cc0000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 301.853879] CPU: 0 PID: 21415 Comm: syz-executor2 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 301.862298] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 301.871657] Call Trace: [ 301.874257] dump_stack+0x1c9/0x2b4 [ 301.877899] ? dump_stack_print_info.cold.2+0x52/0x52 [ 301.883104] ? rcu_note_context_switch+0x730/0x730 [ 301.888055] should_fail.cold.4+0xa/0x11 [ 301.892133] ? kasan_check_write+0x14/0x20 [ 301.896382] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 301.901483] ? kernfs_activate+0x8e/0x2c0 [ 301.905626] ? ___ratelimit.cold.2+0x6b/0x6b [ 301.910044] ? mutex_trylock+0x2b0/0x2b0 [ 301.914113] ? kasan_check_write+0x14/0x20 [ 301.918343] ? __radix_tree_replace+0x188/0x2f0 [ 301.922999] ? kernfs_add_one+0x4f/0x4d0 [ 301.927063] ? kernfs_activate+0x21a/0x2c0 [ 301.931286] ? lock_downgrade+0x8f0/0x8f0 [ 301.935436] ? lock_acquire+0x1e4/0x540 [ 301.939398] ? fs_reclaim_acquire+0x20/0x20 [ 301.943718] ? lock_downgrade+0x8f0/0x8f0 [ 301.947855] ? check_same_owner+0x340/0x340 [ 301.952176] ? kasan_check_write+0x14/0x20 [ 301.956401] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 301.961316] ? rcu_note_context_switch+0x730/0x730 [ 301.966235] __should_failslab+0x124/0x180 [ 301.970471] should_failslab+0x9/0x14 [ 301.974265] kmem_cache_alloc+0x2af/0x760 [ 301.978413] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 301.983336] ? kasan_check_write+0x14/0x20 [ 301.987560] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 301.992564] __kernfs_new_node+0xef/0x5a0 [ 301.996710] ? kernfs_dop_revalidate+0x3c0/0x3c0 [ 302.001460] ? mutex_unlock+0xd/0x10 [ 302.005156] ? kernfs_activate+0x21a/0x2c0 [ 302.009378] ? kernfs_walk_and_get_ns+0x340/0x340 [ 302.014216] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 302.019744] ? kernfs_link_sibling+0x1d2/0x3b0 [ 302.024312] kernfs_new_node+0x80/0xf0 [ 302.028200] __kernfs_create_file+0x4d/0x330 [ 302.032611] sysfs_add_file_mode_ns+0x21a/0x560 [ 302.037276] internal_create_group+0x26d/0x9e0 [ 302.041844] sysfs_create_group+0x1f/0x30 [ 302.045975] lo_ioctl+0x1307/0x1d70 [ 302.049598] ? lo_rw_aio_complete+0x450/0x450 [ 302.054079] blkdev_ioctl+0x9cd/0x2030 [ 302.057968] ? lock_acquire+0x1e4/0x540 [ 302.061926] ? blkpg_ioctl+0xc40/0xc40 [ 302.065799] ? lock_release+0xa30/0xa30 [ 302.069767] ? save_stack+0xa9/0xd0 [ 302.073379] ? save_stack+0x43/0xd0 [ 302.076993] ? __fget+0x4d5/0x740 [ 302.080438] ? ksys_dup3+0x690/0x690 [ 302.084138] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 302.088714] ? kasan_check_write+0x14/0x20 [ 302.093066] ? do_raw_spin_lock+0xc1/0x200 [ 302.097290] block_ioctl+0xee/0x130 [ 302.100903] ? blkdev_fallocate+0x400/0x400 [ 302.105210] do_vfs_ioctl+0x1de/0x1720 [ 302.109099] ? ioctl_preallocate+0x300/0x300 [ 302.113507] ? __fget_light+0x2f7/0x440 [ 302.117481] ? fget_raw+0x20/0x20 [ 302.120924] ? trace_hardirqs_on+0xd/0x10 [ 302.125057] ? kmem_cache_free+0x22e/0x2d0 [ 302.129276] ? putname+0xf7/0x130 [ 302.132712] ? do_sys_open+0x3cb/0x720 [ 302.136586] ? security_file_ioctl+0x94/0xc0 [ 302.140978] ksys_ioctl+0xa9/0xd0 [ 302.144413] __x64_sys_ioctl+0x73/0xb0 [ 302.148296] do_syscall_64+0x1b9/0x820 [ 302.152176] ? finish_task_switch+0x1d3/0x870 [ 302.156655] ? syscall_return_slowpath+0x5e0/0x5e0 [ 302.161568] ? syscall_return_slowpath+0x31d/0x5e0 [ 302.166493] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 302.171503] ? prepare_exit_to_usermode+0x291/0x3b0 [ 302.176510] ? perf_trace_sys_enter+0xb10/0xb10 [ 302.181164] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 302.186004] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 302.191189] RIP: 0033:0x455927 [ 302.194355] Code: 48 83 c4 08 48 89 d8 5b 5d c3 66 0f 1f 84 00 00 00 00 00 48 89 e8 48 f7 d8 48 39 c3 0f 92 c0 eb 92 66 90 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 7d bb fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 302.213481] RSP: 002b:00007f088c102a88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 302.221186] RAX: ffffffffffffffda RBX: 0000000020000190 RCX: 0000000000455927 [ 302.228436] RDX: 0000000000000014 RSI: 0000000000004c00 RDI: 0000000000000015 [ 302.235686] RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000000a [ 302.242936] R10: 0000000000000075 R11: 0000000000000246 R12: 0000000000000014 [ 302.250191] R13: 0000000000000000 R14: 00000000004d3c90 R15: 0000000000000011 16:56:59 executing program 6: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x2000000000003e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) r1 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x8001, 0x1) ioctl$KVM_XEN_HVM_CONFIG(r1, 0x4038ae7a, &(0x7f0000000200)={0x1, 0xbdd, &(0x7f0000000080)="c3f35673eb779b554124912b356d50dda79d26305913da785a936988636b66ccf9b5bca8fc6e6b9074abc2909289c7b7524a7c94bdb9579bf7cba08e316f10695f8febefa5c971bd80b55bc388219e8d387102592c30efac3de8d8313946e52414b9432d506ea35e235e156da9da37989c", &(0x7f0000000100)="57ffb63155a02ed2c4ed402708773a774daa32884d6849eda343e3155479d3e5cc2fa63e01e3fd917015616cc5f101b92e58a17b6554a1f4a8f67399ee4f33df08502640809711116770cec93dd136d0403d2e6ecf047b7d7478e8a9e1911487baa9", 0x71, 0x62}) io_setup(0x4, &(0x7f0000a8aff8)=0x0) io_submit(r2, 0x1, &(0x7f0000b52fd8)=[&(0x7f0000587000)={0x0, 0x0, 0x0, 0x7, 0x0, r0, &(0x7f000096f000)="060063efff7f00009d", 0x9, 0xfffffffffffffffe}]) [ 302.261119] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 302.275669] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue 16:56:59 executing program 2 (fault-call:2 fault-nth:18): mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:56:59 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) chroot(&(0x7f00000001c0)='./file0/../file0\x00') r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f00000000c0)={@remote, @rand_addr, 0x0}, &(0x7f0000000100)=0xc) connect(r0, &(0x7f0000000140)=@xdp={0x2c, 0x6, r1, 0x16}, 0x80) mkdir(&(0x7f0000000040)='./file0/../file0\x00', 0x0) 16:56:59 executing program 5 (fault-call:7 fault-nth:0): r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:56:59 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x2, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r1, 0x114, 0xa, &(0x7f00000000c0)={0x3, "fdc01c"}, 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup2(r2, r3) sendmsg$netlink(r4, &(0x7f0000028fc8)={0x0, 0x0, &(0x7f0000019000)=[{&(0x7f00000001c0)=ANY=[@ANYRES64], 0x1}], 0x1, &(0x7f0000000040)=[@rights={0x18, 0x1, 0x1, [r2]}], 0x18}, 0x0) recvmmsg(r2, &(0x7f0000000b80)=[{{&(0x7f0000000680)=@l2, 0x80, &(0x7f0000000a40), 0x0, &(0x7f0000000ac0)=""/147, 0x93}}], 0x1, 0x0, 0x0) 16:56:59 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000000)={r0}) setsockopt$inet_sctp_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000080)={0x55, 0xe766, 0xff, 0x100000000, 0x1ff, 0x401, 0x7ff, 0x0, 0x8, 0x4, 0xa0f}, 0xb) r2 = socket(0x40000000015, 0x5, 0x0) bind$inet(r2, &(0x7f0000fc4ff0)={0x2, 0x0, @loopback=0x7f000001}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @loopback=0x7f000001}, 0x10) ioctl$FICLONE(r1, 0x40049409, r1) sendmsg$alg(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000580), 0x0, &(0x7f0000001b80)=[@assoc={0x18, 0x117, 0x4}, @op={0x18, 0x117, 0x3}], 0x30}, 0x0) [ 302.385187] binder: 21444:21449 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 302.393944] binder: 21444:21449 unknown command 4743953 16:56:59 executing program 7: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = dup(r0) ioctl$KDGKBDIACR(r1, 0x4b4a, &(0x7f00000000c0)=""/9) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000080)="390000001100094701bb61e1c3050000070000000200000045efffff08009b0019001a000f000000030000000000000004e9000206002d0005", 0x39}], 0x1) openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x1, 0x0) 16:56:59 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c4000007fffffff0000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 302.428583] binder: 21444:21449 ioctl c0306201 20000000 returned -22 16:56:59 executing program 6: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) write$P9_RVERSION(r0, &(0x7f00000000c0)={0x15, 0x65, 0xffff, 0xff, 0x8, '9P2000.L'}, 0x15) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x3}, 0xe) mq_open(&(0x7f0000000100)="05", 0x800, 0x18, &(0x7f0000000080)={0x4, 0x6, 0xe9, 0x6, 0xfffffffd, 0xfff, 0x3f, 0xba}) [ 302.491448] FAULT_INJECTION: forcing a failure. [ 302.491448] name failslab, interval 1, probability 0, space 0, times 0 [ 302.503883] CPU: 0 PID: 21464 Comm: syz-executor5 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 302.512305] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 302.521657] Call Trace: [ 302.524237] dump_stack+0x1c9/0x2b4 [ 302.527860] ? dump_stack_print_info.cold.2+0x52/0x52 [ 302.533052] should_fail.cold.4+0xa/0x11 [ 302.537100] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 302.542196] ? rcu_note_context_switch+0x730/0x730 [ 302.547116] ? kasan_check_write+0x14/0x20 [ 302.551337] ? __mutex_lock+0x6c4/0x1680 [ 302.555382] ? tun_get_user+0x1dcc/0x42f0 [ 302.559516] ? __init_rwsem+0x1cc/0x2a0 [ 302.563500] ? mutex_trylock+0x2b0/0x2b0 [ 302.567555] ? lock_acquire+0x1e4/0x540 [ 302.571511] ? alloc_set_pte+0x1133/0x1790 [ 302.575733] ? lock_release+0xa30/0xa30 [ 302.579689] ? xas_descend+0x20c/0x5f0 [ 302.583573] __should_failslab+0x124/0x180 [ 302.587795] should_failslab+0x9/0x14 [ 302.591577] kmem_cache_alloc+0x47/0x760 [ 302.595630] ? alloc_set_pte+0xaf6/0x1790 [ 302.599772] __build_skb+0xab/0x430 [ 302.603382] ? skb_try_coalesce+0x1c90/0x1c90 [ 302.607861] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 302.612859] ? filemap_map_pages+0xca2/0x1990 [ 302.617343] ? __alloc_pages_nodemask+0xdb0/0xdb0 [ 302.622180] ? trace_hardirqs_on+0x10/0x10 [ 302.626399] __napi_alloc_skb+0x19a/0x300 [ 302.630548] napi_get_frags+0x67/0x140 [ 302.634428] tun_get_user+0x1e36/0x42f0 [ 302.638397] ? tun_build_skb.isra.55+0x2280/0x2280 [ 302.643313] ? mntput_no_expire+0x18e/0xbc0 [ 302.647619] ? do_raw_spin_lock+0xc1/0x200 [ 302.651863] ? mnt_get_count+0x150/0x150 [ 302.655909] ? dput.part.26+0x276/0x7a0 [ 302.659894] ? shrink_dcache_sb+0x350/0x350 [ 302.664199] ? lock_acquire+0x1e4/0x540 [ 302.668180] ? __fdget_pos+0x1bb/0x200 [ 302.672061] ? lock_acquire+0x1e4/0x540 [ 302.676021] ? tun_get+0x208/0x370 [ 302.679548] ? lock_downgrade+0x8f0/0x8f0 [ 302.683679] ? lock_release+0xa30/0xa30 [ 302.687637] ? lock_acquire+0x1e4/0x540 [ 302.691595] ? lock_downgrade+0x8f0/0x8f0 [ 302.695722] ? tun_get+0x231/0x370 [ 302.699242] ? tun_chr_close+0x180/0x180 [ 302.703285] tun_chr_write_iter+0xb9/0x154 [ 302.707501] do_iter_readv_writev+0x8b0/0xa80 [ 302.711994] ? vfs_dedupe_file_range+0x670/0x670 [ 302.716739] ? rw_copy_check_uvector+0x30d/0x3e0 [ 302.721477] ? rw_verify_area+0x118/0x360 [ 302.725609] do_iter_write+0x185/0x5f0 [ 302.729493] ? dup_iter+0x270/0x270 [ 302.733103] ? proc_cwd_link+0x1d0/0x1d0 [ 302.737152] vfs_writev+0x1f1/0x360 [ 302.740761] ? __fget_light+0x2f7/0x440 [ 302.744717] ? vfs_iter_write+0xb0/0xb0 [ 302.748672] ? fsnotify+0xbac/0x14e0 [ 302.752379] ? vfs_write+0x2f3/0x560 [ 302.756081] ? wait_for_completion+0x8d0/0x8d0 [ 302.760650] ? lock_release+0xa30/0xa30 [ 302.764607] ? fsnotify_first_mark+0x350/0x350 [ 302.769169] ? __fsnotify_parent+0xcc/0x420 [ 302.773478] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 302.778996] ? __fdget_pos+0xde/0x200 [ 302.782793] ? __fdget_raw+0x20/0x20 [ 302.786492] ? __sb_end_write+0xac/0xe0 [ 302.790448] do_writev+0x11a/0x310 [ 302.793969] ? vfs_writev+0x360/0x360 [ 302.797755] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 302.803277] __x64_sys_writev+0x75/0xb0 [ 302.807237] do_syscall_64+0x1b9/0x820 [ 302.811115] ? finish_task_switch+0x1d3/0x870 [ 302.815601] ? syscall_return_slowpath+0x5e0/0x5e0 [ 302.820512] ? syscall_return_slowpath+0x31d/0x5e0 [ 302.825433] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 302.830444] ? prepare_exit_to_usermode+0x291/0x3b0 [ 302.835459] ? perf_trace_sys_enter+0xb10/0xb10 [ 302.840123] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 302.844956] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 302.850131] RIP: 0033:0x455971 [ 302.853303] Code: 75 14 b8 14 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 54 bb fb ff c3 48 83 ec 08 e8 da 2c 00 00 48 89 04 24 b8 14 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 23 2d 00 00 48 89 d0 48 83 c4 08 48 3d 01 [ 302.872429] RSP: 002b:00007ff402100ba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000014 [ 302.880125] RAX: ffffffffffffffda RBX: 000000000000004a RCX: 0000000000455971 16:57:00 executing program 5 (fault-call:7 fault-nth:1): r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 302.887381] RDX: 0000000000000001 RSI: 00007ff402100bf0 RDI: 00000000000000fc [ 302.894631] RBP: 0000000020000100 R08: 00000000000000fc R09: 0000000000000000 [ 302.901881] R10: 000000000000004a R11: 0000000000000293 R12: 0000000000000015 [ 302.909131] R13: 00000000004c20a6 R14: 00000000004d3ae0 R15: 0000000000000000 [ 302.943611] FAULT_INJECTION: forcing a failure. [ 302.943611] name failslab, interval 1, probability 0, space 0, times 0 [ 302.954933] CPU: 0 PID: 21466 Comm: syz-executor2 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 302.963326] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 302.972674] Call Trace: [ 302.975251] dump_stack+0x1c9/0x2b4 [ 302.978862] ? dump_stack_print_info.cold.2+0x52/0x52 [ 302.984042] ? is_bpf_text_address+0xd7/0x170 [ 302.988531] should_fail.cold.4+0xa/0x11 [ 302.992590] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 302.997690] ? save_stack+0xa9/0xd0 [ 303.001302] ? save_stack+0x43/0xd0 [ 303.004910] ? kasan_kmalloc+0xc4/0xe0 [ 303.008782] ? kmem_cache_alloc_trace+0x152/0x780 [ 303.013611] ? kobject_uevent_env+0x20f/0x1110 [ 303.018174] ? kobject_uevent+0x1f/0x30 [ 303.022135] ? lo_ioctl+0x1385/0x1d70 [ 303.025925] ? blkdev_ioctl+0x9cd/0x2030 [ 303.029967] ? block_ioctl+0xee/0x130 [ 303.033747] ? do_vfs_ioctl+0x1de/0x1720 [ 303.037788] ? ksys_ioctl+0xa9/0xd0 [ 303.041406] ? __x64_sys_ioctl+0x73/0xb0 [ 303.045459] ? do_syscall_64+0x1b9/0x820 [ 303.049505] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 303.054863] ? kasan_check_write+0x14/0x20 [ 303.059084] ? lock_acquire+0x1e4/0x540 [ 303.063044] ? fs_reclaim_acquire+0x20/0x20 [ 303.067349] ? lock_downgrade+0x8f0/0x8f0 [ 303.071481] ? check_same_owner+0x340/0x340 [ 303.075787] ? lock_release+0xa30/0xa30 [ 303.079751] ? rcu_note_context_switch+0x730/0x730 [ 303.084672] __should_failslab+0x124/0x180 [ 303.088891] should_failslab+0x9/0x14 [ 303.092675] __kmalloc+0x2c8/0x760 [ 303.096203] ? kobject_get_path+0xc2/0x1a0 [ 303.100420] kobject_get_path+0xc2/0x1a0 [ 303.104463] kobject_uevent_env+0x234/0x1110 [ 303.108853] ? internal_create_group+0x39a/0x9e0 [ 303.113607] kobject_uevent+0x1f/0x30 [ 303.120081] lo_ioctl+0x1385/0x1d70 [ 303.123702] ? lo_rw_aio_complete+0x450/0x450 [ 303.128178] blkdev_ioctl+0x9cd/0x2030 [ 303.132052] ? lock_acquire+0x1e4/0x540 [ 303.136012] ? blkpg_ioctl+0xc40/0xc40 [ 303.139890] ? lock_release+0xa30/0xa30 [ 303.143849] ? save_stack+0xa9/0xd0 [ 303.147457] ? save_stack+0x43/0xd0 [ 303.151068] ? __fget+0x4d5/0x740 [ 303.154505] ? ksys_dup3+0x690/0x690 [ 303.158202] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 303.162777] ? kasan_check_write+0x14/0x20 [ 303.166997] ? do_raw_spin_lock+0xc1/0x200 [ 303.171234] block_ioctl+0xee/0x130 [ 303.174844] ? blkdev_fallocate+0x400/0x400 [ 303.179153] do_vfs_ioctl+0x1de/0x1720 [ 303.183031] ? ioctl_preallocate+0x300/0x300 [ 303.187434] ? __fget_light+0x2f7/0x440 [ 303.191390] ? fget_raw+0x20/0x20 [ 303.194830] ? trace_hardirqs_on+0xd/0x10 [ 303.198959] ? kmem_cache_free+0x22e/0x2d0 [ 303.203178] ? putname+0xf7/0x130 [ 303.206612] ? do_sys_open+0x3cb/0x720 [ 303.210494] ? security_file_ioctl+0x94/0xc0 [ 303.214886] ksys_ioctl+0xa9/0xd0 [ 303.218322] __x64_sys_ioctl+0x73/0xb0 [ 303.222192] do_syscall_64+0x1b9/0x820 [ 303.226072] ? finish_task_switch+0x1d3/0x870 [ 303.230555] ? syscall_return_slowpath+0x5e0/0x5e0 [ 303.235483] ? syscall_return_slowpath+0x31d/0x5e0 [ 303.240402] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 303.245399] ? prepare_exit_to_usermode+0x291/0x3b0 [ 303.250408] ? perf_trace_sys_enter+0xb10/0xb10 [ 303.255060] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 303.259889] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 303.265063] RIP: 0033:0x455927 [ 303.268231] Code: 48 83 c4 08 48 89 d8 5b 5d c3 66 0f 1f 84 00 00 00 00 00 48 89 e8 48 f7 d8 48 39 c3 0f 92 c0 eb 92 66 90 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 7d bb fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 303.287390] RSP: 002b:00007f088c102a88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 303.295183] RAX: ffffffffffffffda RBX: 0000000020000190 RCX: 0000000000455927 [ 303.302444] RDX: 0000000000000014 RSI: 0000000000004c00 RDI: 0000000000000015 [ 303.309704] RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000000a [ 303.316962] R10: 0000000000000075 R11: 0000000000000246 R12: 0000000000000014 [ 303.324228] R13: 0000000000000000 R14: 00000000004d3c90 R15: 0000000000000012 [ 303.332954] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing 16:57:00 executing program 1: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4000, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r3, 0xc0605345, &(0x7f0000000040)={0x6a, 0x3, {0x3, 0x3, 0x40, 0x3, 0x20}}) setresgid(0x0, 0x0, r2) setresuid(0x0, r1, 0x0) ioctl$KVM_GET_LAPIC(r3, 0x8400ae8e, &(0x7f00000000c0)={"763007ef9be8ef9f82fb80e6ff840eb55e1b2b878b3aa3a2b8eed8109eeaeb650ca1868b6c9224ca2ae42882f17b89b29c0fa10a88ad2811a1493c8465a806ff252b330c01a3f1c2fba6eae5248f693a158d699391ce0a73d30a2c725dbbe4c5804b134cdd7b4a366808aa44a50ad1226209a7dd80689466d39ecce24127039ea3e532d50bd8e8cab45631bd558e38147dbc12aaac6d1897181267a68cfd1d5c62fda4fa3f0a3ead7ad3461fcce7920b1b16f7549b81d4df661463d163c0f28385f0abc732cc06ca91aa6017c6873894c149f5d68fab300a3722f8826813d46a4260166a3f67dbf31d462c1716d1667cd35a124ffb1c438ee604f91e3f446dfdc74c8640709ce92bc0ca6d42f74f18190dd5bfb7b664e2bcde90e306fc78fb6ebdf6be32029fbbb500b875c2a309447a9d38ea032cec1ff6582514c2ff5aa2087ac80007b1a836dab120ab9cbdb7ca3362f48490eb9bf4f73663b1fd10d389dc1e5d8eb93c2ac6e4202bd03feacc8352a1525ade0d43260459210b003d438bfebfbd426b4f002635704ef79859b5b4d9fef6190ac583698edb8114f4e56f3cec0b7d8e673e4f5fa7ed6e807f0ead20798df774af62c99897b1e4e3dfe1533cb64f69e7e1441b4c9637c6c3593f6f7102cab5115f88f73336d53fbf776a56cb470a606a1302beed81b9e9799a670093e14b0212cb20b2b639292d5425031668b76fc05088cf3c26f7042388910ee91d93250b4b7a697e08a9eb792fc37ceced745becc527280197181fd9b7c8351bbe95ac70ff9e4e0822bebd9db228942b81ab168a94b1cee7479f4c76ad5722b4d96e0071b585da364f9f02e05c157d3e8c406469e41f79db3b77f2b64ab1821e88e7f749e41af4dfcc7ed2f93c6f29d5328ff328ddc671320e50e882a4fd7cc7f5270e61c8cb197711c87eadd35d4060b5da0432031baeb7456435c66638834eaa517a74101f3549c233b11ae1dd3af373a1c5a043522aac0000a05c2988eab2759fc0f747674ad8821f3504a80481430e14e8fc8a1c3771c2e78c07fc1505a36b49031c0a17801a550694208f0598855cf5dfeffd52d65e5f310c704c200d962184cd6614ec0aa41b8d0c68f4eb52016da284d1d27d476f4899544c91f54ab481afbd51c354d2590ccf3a185c20db0a8501f6c2db3e062afc4004e9b5c9f9faa8540629da90ce12752da44595ec9c8fb1a1ba86b22522c361106a702253649557991624219a845c971a07d5bd46297d8c46deb57ce6b9af95cd3648bbdf796d50cfc8de2b0ab390286676fd44a3571fd070ef0e6979734f52c3e82a4a91150b9317ce88c3efb7a2af7bc8e7c3760c0d2bc9ae092e4d4afc2de25e825acbaabd4514f3207f519551b15922ab5c67cb75b1355d03629668710ef36e2c9c01ba361c0d0b0207509fa0ff9e69a0fbe184429076"}) setgid(r2) 16:57:00 executing program 2 (fault-call:2 fault-nth:19): mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) [ 303.346773] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue 16:57:00 executing program 7: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000356000)=0x1, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000040)=0x6, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) 16:57:00 executing program 0: syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x4, 0x8010) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000000380)={{0x80}, "13701b21bd0a60480000000000039b3fd5cec307e8ef3d13eb790ec9c45abaf90d229db6926c475b78f8b2000000000f0000000000000009fba8f376589701a4", 0xa9824f69d1376637, 0x10800a}) 16:57:00 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000140)=0x1f, 0x4) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000014c0)='/dev/vga_arbiter\x00', 0x4100, 0x0) mmap$xdp(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2, 0x10, r1, 0x180000000) recvfrom$inet6(r1, &(0x7f0000000000)=""/156, 0x9c, 0x20, &(0x7f00000000c0)={0xa, 0x4e23, 0x7, @local={0xfe, 0x80, [], 0xaa}, 0x541}, 0x1c) 16:57:00 executing program 6: r0 = inotify_init() r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000001480)='/dev/dsp\x00', 0x2800, 0x0) getdents(r1, &(0x7f0000001600)=""/198, 0xc6) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001400)={&(0x7f00000013c0)='user_id', 0xffffffffffffff9c}, 0x10) write$FUSE_GETXATTR(r2, &(0x7f0000001440)={0x18, 0x0, 0x3, {0x9}}, 0x18) fdatasync(r0) fstatfs(r0, &(0x7f0000000140)=""/4096) r3 = socket$inet6(0xa, 0x1, 0x0) sendfile(r0, r3, &(0x7f0000000080), 0x6) inotify_init() close(r0) r4 = creat(&(0x7f0000000040)='./file0\x00', 0x120) getsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f00000011c0)={{{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@remote}}, &(0x7f00000012c0)=0xe8) stat(&(0x7f0000001300)='./file0\x00', &(0x7f0000001340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuseblk(&(0x7f00000000c0)='/dev/loop0\x00', &(0x7f0000001140)='./file0\x00', &(0x7f0000001180)='fuseblk\x00', 0x200000, &(0x7f0000001540)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=r5, @ANYBLOB="2c6fcd324b56df557b3d", @ANYRESDEC=r6, @ANYBLOB=',blksize=0x0000000000000400,blksize=0x0000000000001800,\x00']) ioctl(r3, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket(0xa, 0x2, 0x0) getsockopt$sock_buf(r3, 0x1, 0x80000000000002e, &(0x7f0000b56f40)=""/192, &(0x7f0000000000)=0xc0) [ 303.532071] binder: 21486:21491 BC_REQUEST_DEATH_NOTIFICATION invalid ref -8454144 [ 303.540333] binder: 21486:21491 unknown command 4743953 [ 303.545844] binder: 21486:21491 ioctl c0306201 20000000 returned -22 [ 303.555635] FAULT_INJECTION: forcing a failure. [ 303.555635] name failslab, interval 1, probability 0, space 0, times 0 [ 303.566897] CPU: 1 PID: 21492 Comm: syz-executor5 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 303.575307] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 303.584668] Call Trace: [ 303.587273] dump_stack+0x1c9/0x2b4 [ 303.591006] ? dump_stack_print_info.cold.2+0x52/0x52 [ 303.596212] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 303.601757] ? rt6_score_route+0x118/0x400 [ 303.606015] should_fail.cold.4+0xa/0x11 [ 303.610091] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 303.615214] ? trace_hardirqs_on+0x10/0x10 [ 303.619465] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 303.624492] ? gup_pgd_range+0x40f/0x3410 [ 303.628660] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 303.634207] ? fib6_node_lookup+0x205/0x290 [ 303.638540] ? fib6_add+0x14d0/0x14d0 [ 303.642354] ? trace_hardirqs_on+0x10/0x10 [ 303.646596] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 303.652139] ? fib6_table_lookup+0xcac/0x14f0 [ 303.656658] __should_failslab+0x124/0x180 [ 303.660902] should_failslab+0x9/0x14 [ 303.664806] kmem_cache_alloc_node+0x56/0x780 [ 303.669323] ? lock_acquire+0x1e4/0x540 [ 303.673317] ? ip_vs_conn_in_get+0x73a/0x17a0 [ 303.677827] ? lock_downgrade+0x8f0/0x8f0 [ 303.681983] __alloc_skb+0x119/0x790 [ 303.685710] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 303.691282] ? skb_scrub_packet+0x490/0x490 [ 303.695637] ? ip_vs_conn_hashkey_param+0x315/0x6d0 [ 303.700659] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 303.706206] ? ip_vs_conn_in_get+0x6c2/0x17a0 [ 303.710722] ? ip_vs_conn_seq_start+0x1d0/0x1d0 [ 303.715407] ? ipv6_skip_exthdr+0x760/0x760 [ 303.719748] tcp_v6_send_response+0x22d/0x2540 [ 303.724348] ? tcp_v6_syn_recv_sock+0x26b0/0x26b0 [ 303.729201] ? lock_release+0xa30/0xa30 [ 303.733185] ? trace_hardirqs_on+0x10/0x10 [ 303.737424] ? tcp_dnat_handler+0x1d10/0x1d10 [ 303.741924] tcp_v6_send_reset+0x64e/0x1160 [ 303.746251] ? ip_vs_conn_out_get+0x9d0/0x9d0 [ 303.750840] ? tcp_v6_send_response+0x2540/0x2540 [ 303.755723] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 303.762064] ? inet6_lookup_listener+0x31a/0xea0 [ 303.766822] ? memcpy+0x45/0x50 [ 303.770109] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 303.775654] tcp_v6_rcv+0x1da3/0x3a70 16:57:00 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000030000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:57:01 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070922813735e56f2db91265ac38a31a6ca0d1c6e966e3f783ae0e9e90e68351c92318a756f57fbd4437869d7ec33e1b268cb37623225d429c9a0b75fffa81a3fe6e068c76fe648ba4b497d64cbc1015a645951ed6f96ba7a1c4f01e67e7d2a43bb4de70216e2461729a4435ba7a87f84488bedc4c1981c8f7e53c100c705492f1ea2a8ecaecf50df7afde8e908fb911c5bf5eb1c723c20b26a4ab34f1f9134ed5e0d6728d5bb7110f0f709d2495794cbb70711d45ac5c598a35e273c621ca2042d99620d2178ef58c2c3") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f0000000400)={{}, 'port0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x400000, 0x0) open_by_handle_at(r1, &(0x7f0000000100)={0xf2, 0x9, "ed549f601c6ef61115ef4f2d744a4d71eeb4475908563a5253cfc1345bc303375795305a757aa51ed814c3fc4c16fc8b0f2865c512c0dac6b8b4b2c3206eecd104088efbf1bc63256d590fb9df62b1171557b1a9ccf40a7a512cd7a3d6b923d7ad06011ba42a6d4c8a9a339e40510ab386db4b499c1c74b6f4bf9ef262e81238b6dd54cbefdc6e526be9714f0bfa19675a5d90faf1fa3075dc23546757318ed0e2a59443b0c3ef54a3443fc8cfa24cf780b2a83ccaf319a2321298469594f523139223222c177a00db9bf183a1dc4d393cd1e7f084a3a29adbc6a9d92ec19dbf9725ce7b0d79398da042"}, 0x400000) write$sndseq(r1, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @quote}], 0xff33) 16:57:01 executing program 7: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000180)='cpuset.mems\x00', 0x2, 0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) r3 = syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00') getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000500)={0x0, @dev, @rand_addr}, &(0x7f0000000540)=0xc) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000580)={{{@in6=@mcast2, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@rand_addr}, 0x0, @in6=@remote}}, &(0x7f0000000680)=0xe8) getpeername$packet(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000800)=0x14) getpeername$packet(0xffffffffffffff9c, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000880)=0x14) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000008c0)={{{@in6=@dev, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@dev}}, &(0x7f00000009c0)=0xe8) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000a00)={'vcan0\x00', 0x0}) getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x23, &(0x7f0000000a40)={@empty, @multicast1, 0x0}, &(0x7f0000000a80)=0xc) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000b80)={{{@in6=@ipv4={[], [], @multicast2}, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @multicast2}}, 0x0, @in6=@loopback}}, &(0x7f0000000c80)=0xe8) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000002480)={@loopback, 0x0}, &(0x7f00000024c0)=0x14) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r2, 0x84, 0xc, &(0x7f0000000140)=0xfff, 0x4) sendmsg$TEAM_CMD_OPTIONS_SET(r2, &(0x7f0000002800)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000027c0)={&(0x7f0000002500)=ANY=[@ANYBLOB="84020000", @ANYRES16=r3, @ANYBLOB="01002cbd7000fddbdf250100000008000100", @ANYRES32=r4, @ANYBLOB="6802020038000100240001006d636173745f72656a6f696e5f636f756e740000000000000000000000000000080003000300000008000400000000003c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000008000300060000000400040008000600", @ANYRES32=r5, @ANYBLOB="3800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r6, @ANYBLOB="3800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r7, @ANYBLOB="400001002400010071756575655f69640000000000000000000000000000000000000000000000000800030003000000080004007d05000008000600", @ANYRES32=r8, @ANYBLOB="40000100010001006c625f706f72745f737461747300000000000000000000000000000000000000080003000b0000000800041c0300000008000600", @ANYRES32=r9, @ANYBLOB="400001002400010071756575655f69640000000000000000000000000000000000000000000000000800030003000000080004000400000008000600", @ANYRES32=r10, @ANYBLOB="40000100240001007072696f72697479000000000000000000000000000000000000000000000000080003000e000000080004000300000008000600", @ANYRES32=r11, @ANYBLOB="40000100240001006d6f646500000000000000000000000000000000000000000000000000000000080003000500000010000400726f756e64726f62696e0000400001002400010071756575655f69640000000000000000000000000000000000000000000000000800030003000000080004000101000008000600", @ANYRES32=r12], 0x284}, 0x1, 0x0, 0x0, 0x4040}, 0x10) r13 = socket$inet6(0xa, 0x1000000000002, 0x1) ioctl(r13, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") write$cgroup_int(r1, &(0x7f0000000040)=ANY=[@ANYRESOCT=r13], 0x17) 16:57:01 executing program 6: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xd0, &(0x7f0000000180), 0x4) socketpair$inet6_icmp_raw(0xa, 0x3, 0x3a, &(0x7f0000000000)) [ 303.779459] ? tcp_v6_reqsk_send_ack+0x380/0x380 [ 303.784219] ? lock_release+0xa30/0xa30 [ 303.788199] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 303.793743] ? ipv6_confirm+0x46e/0x650 [ 303.796519] FAULT_INJECTION: forcing a failure. [ 303.796519] name failslab, interval 1, probability 0, space 0, times 0 [ 303.797720] ? ipv6_helper+0x3ab/0x540 [ 303.797739] ip6_input_finish+0x407/0x1a40 [ 303.797760] ? ip6_sublist_rcv+0x1020/0x1020 [ 303.797776] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 303.797790] ? nf_hook_slow+0x11e/0x1c0 [ 303.797810] ip6_input+0xe9/0x600 [ 303.833920] ? ip6_input_finish+0x1a40/0x1a40 [ 303.838406] ? ip6_sublist_rcv+0x1020/0x1020 [ 303.842892] ? nf_nat_ipv6_out+0x660/0x660 [ 303.847120] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 303.852297] ip6_rcv_finish+0x17a/0x330 [ 303.856257] ipv6_rcv+0x11e/0x650 [ 303.859700] ? ip6_rcv_core.isra.17+0x1c90/0x1c90 [ 303.864532] ? do_iter_write+0x185/0x5f0 [ 303.868581] ? ip6_rcv_finish_core.isra.14+0x720/0x720 [ 303.873863] ? lock_acquire+0x1e4/0x540 [ 303.877828] __netif_receive_skb_one_core+0x14d/0x200 [ 303.883008] ? __netif_receive_skb_core+0x3620/0x3620 [ 303.888192] __netif_receive_skb+0x2c/0x1e0 [ 303.892503] netif_receive_skb_internal+0x12e/0x5f0 [ 303.897596] ? dev_cpu_dead+0xaa0/0xaa0 [ 303.901563] ? kasan_check_write+0x14/0x20 [ 303.905814] ? copyin+0xb7/0x100 [ 303.909170] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 303.914704] ? eth_type_trans+0x2ea/0x760 [ 303.918839] ? eth_gro_receive+0x8d0/0x8d0 [ 303.923061] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 303.928237] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 303.933245] napi_gro_frags+0x64e/0xc60 [ 303.937208] ? napi_gro_receive+0x5c0/0x5c0 [ 303.941516] ? eth_get_headlen+0x173/0x1f0 [ 303.945747] ? eth_type_trans+0x760/0x760 [ 303.949883] ? tun_get_user+0x3184/0x42f0 [ 303.954020] tun_get_user+0x31ad/0x42f0 [ 303.957989] ? tun_build_skb.isra.55+0x2280/0x2280 [ 303.962907] ? mntput_no_expire+0x18e/0xbc0 [ 303.967216] ? do_raw_spin_lock+0xc1/0x200 [ 303.971437] ? mnt_get_count+0x150/0x150 [ 303.975488] ? dput.part.26+0x276/0x7a0 [ 303.979461] ? shrink_dcache_sb+0x350/0x350 [ 303.983772] ? __fdget_pos+0x1bb/0x200 [ 303.987658] ? lock_acquire+0x1e4/0x540 [ 303.991617] ? tun_get+0x208/0x370 [ 303.995144] ? lock_downgrade+0x8f0/0x8f0 [ 303.999282] ? lock_release+0xa30/0xa30 [ 304.003245] ? lock_acquire+0x1e4/0x540 [ 304.007207] ? lock_downgrade+0x8f0/0x8f0 [ 304.011345] ? tun_get+0x231/0x370 [ 304.014869] ? tun_chr_close+0x180/0x180 [ 304.018919] tun_chr_write_iter+0xb9/0x154 [ 304.023153] do_iter_readv_writev+0x8b0/0xa80 [ 304.027646] ? vfs_dedupe_file_range+0x670/0x670 [ 304.032387] ? rw_copy_check_uvector+0x30d/0x3e0 [ 304.037133] ? rw_verify_area+0x118/0x360 [ 304.041279] do_iter_write+0x185/0x5f0 [ 304.045155] ? dup_iter+0x270/0x270 [ 304.048788] ? proc_cwd_link+0x1d0/0x1d0 [ 304.052844] vfs_writev+0x1f1/0x360 [ 304.056455] ? __fget_light+0x2f7/0x440 [ 304.060419] ? vfs_iter_write+0xb0/0xb0 [ 304.064378] ? fsnotify+0xbac/0x14e0 [ 304.068080] ? vfs_write+0x2f3/0x560 [ 304.071784] ? wait_for_completion+0x8d0/0x8d0 [ 304.076351] ? lock_release+0xa30/0xa30 [ 304.080315] ? fsnotify_first_mark+0x350/0x350 [ 304.084889] ? __fsnotify_parent+0xcc/0x420 [ 304.089875] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 304.095500] ? __fdget_pos+0xde/0x200 [ 304.099287] ? __fdget_raw+0x20/0x20 [ 304.102989] ? __sb_end_write+0xac/0xe0 [ 304.106957] do_writev+0x11a/0x310 [ 304.110484] ? vfs_writev+0x360/0x360 [ 304.114278] ? syscall_slow_exit_work+0x500/0x500 [ 304.119109] __x64_sys_writev+0x75/0xb0 [ 304.123074] do_syscall_64+0x1b9/0x820 [ 304.126948] ? finish_task_switch+0x1d3/0x870 [ 304.131435] ? syscall_return_slowpath+0x5e0/0x5e0 [ 304.136353] ? syscall_return_slowpath+0x31d/0x5e0 [ 304.141273] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 304.146276] ? prepare_exit_to_usermode+0x291/0x3b0 [ 304.151283] ? perf_trace_sys_enter+0xb10/0xb10 [ 304.155944] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 304.160791] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 304.165964] RIP: 0033:0x455971 [ 304.169136] Code: 75 14 b8 14 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 54 bb fb ff c3 48 83 ec 08 e8 da 2c 00 00 48 89 04 24 b8 14 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 23 2d 00 00 48 89 d0 48 83 c4 08 48 3d 01 [ 304.188345] RSP: 002b:00007ff402100ba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000014 [ 304.196042] RAX: ffffffffffffffda RBX: 000000000000004a RCX: 0000000000455971 [ 304.203299] RDX: 0000000000000001 RSI: 00007ff402100bf0 RDI: 00000000000000fc [ 304.210551] RBP: 0000000020000100 R08: 00000000000000fc R09: 0000000000000000 [ 304.217804] R10: 000000000000004a R11: 0000000000000293 R12: 0000000000000015 [ 304.225058] R13: 00000000004c20a6 R14: 00000000004d3ae0 R15: 0000000000000001 [ 304.232325] CPU: 0 PID: 21504 Comm: syz-executor2 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 304.240728] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 304.250069] Call Trace: [ 304.252651] dump_stack+0x1c9/0x2b4 [ 304.256269] ? dump_stack_print_info.cold.2+0x52/0x52 [ 304.262174] should_fail.cold.4+0xa/0x11 [ 304.266225] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 304.271312] ? lock_acquire+0x1e4/0x540 [ 304.275283] ? trace_hardirqs_on+0x10/0x10 [ 304.279504] ? lock_release+0xa30/0xa30 [ 304.283482] ? check_same_owner+0x340/0x340 [ 304.287795] ? rcu_note_context_switch+0x730/0x730 [ 304.292807] ? kasan_check_write+0x14/0x20 [ 304.297032] ? lock_acquire+0x1e4/0x540 [ 304.300993] ? fs_reclaim_acquire+0x20/0x20 [ 304.305303] ? lock_downgrade+0x8f0/0x8f0 [ 304.309440] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 304.314967] ? check_same_owner+0x340/0x340 [ 304.319275] ? number+0x967/0xc90 [ 304.322725] ? rcu_note_context_switch+0x730/0x730 [ 304.327651] __should_failslab+0x124/0x180 [ 304.331967] should_failslab+0x9/0x14 [ 304.335757] kmem_cache_alloc_node+0x272/0x780 [ 304.340324] ? set_precision+0xe0/0xe0 [ 304.344203] __alloc_skb+0x119/0x790 [ 304.347903] ? skb_scrub_packet+0x490/0x490 [ 304.352211] ? lock_release+0xa30/0xa30 [ 304.356170] ? pointer+0x990/0x990 [ 304.359721] ? device_get_devnode+0x2e0/0x2e0 [ 304.364213] ? kasan_unpoison_shadow+0x35/0x50 [ 304.368784] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 304.373790] ? netlink_has_listeners+0x2cf/0x4a0 [ 304.378532] ? netlink_tap_init_net+0x3e0/0x3e0 [ 304.383190] alloc_uevent_skb+0x89/0x220 [ 304.387242] kobject_uevent_env+0x866/0x1110 [ 304.391638] ? internal_create_group+0x39a/0x9e0 [ 304.396384] kobject_uevent+0x1f/0x30 [ 304.400170] lo_ioctl+0x1385/0x1d70 [ 304.403788] ? lo_rw_aio_complete+0x450/0x450 [ 304.408279] blkdev_ioctl+0x9cd/0x2030 [ 304.412151] ? lock_acquire+0x1e4/0x540 [ 304.416110] ? blkpg_ioctl+0xc40/0xc40 [ 304.419986] ? lock_release+0xa30/0xa30 [ 304.423961] ? save_stack+0xa9/0xd0 [ 304.427573] ? save_stack+0x43/0xd0 [ 304.431192] ? __fget+0x4d5/0x740 [ 304.434633] ? ksys_dup3+0x690/0x690 [ 304.438330] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 304.442899] ? kasan_check_write+0x14/0x20 [ 304.447120] ? do_raw_spin_lock+0xc1/0x200 [ 304.451343] block_ioctl+0xee/0x130 [ 304.454954] ? blkdev_fallocate+0x400/0x400 [ 304.459260] do_vfs_ioctl+0x1de/0x1720 [ 304.463136] ? ioctl_preallocate+0x300/0x300 [ 304.467531] ? __fget_light+0x2f7/0x440 [ 304.471493] ? fget_raw+0x20/0x20 [ 304.474932] ? trace_hardirqs_on+0xd/0x10 [ 304.479065] ? kmem_cache_free+0x22e/0x2d0 [ 304.483291] ? putname+0xf7/0x130 [ 304.486731] ? do_sys_open+0x3cb/0x720 [ 304.490607] ? security_file_ioctl+0x94/0xc0 [ 304.495000] ksys_ioctl+0xa9/0xd0 [ 304.498442] __x64_sys_ioctl+0x73/0xb0 [ 304.502320] do_syscall_64+0x1b9/0x820 [ 304.506191] ? finish_task_switch+0x1d3/0x870 [ 304.510672] ? syscall_return_slowpath+0x5e0/0x5e0 [ 304.515590] ? syscall_return_slowpath+0x31d/0x5e0 [ 304.520519] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 304.525523] ? prepare_exit_to_usermode+0x291/0x3b0 [ 304.530534] ? perf_trace_sys_enter+0xb10/0xb10 [ 304.535190] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 304.540034] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 304.545212] RIP: 0033:0x455927 [ 304.548383] Code: 48 83 c4 08 48 89 d8 5b 5d c3 66 0f 1f 84 00 00 00 00 00 48 89 e8 48 f7 d8 48 39 c3 0f 92 c0 eb 92 66 90 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 7d bb fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 304.567657] RSP: 002b:00007f088c102a88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 304.575348] RAX: ffffffffffffffda RBX: 0000000020000190 RCX: 0000000000455927 16:57:01 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x4e24, @multicast1=0xe0000001}}, 0xffff, 0x88, 0x8001, 0x7}, &(0x7f00000000c0)=0x98) setsockopt$inet_sctp_SCTP_RESET_ASSOC(r2, 0x84, 0x78, &(0x7f0000000100)=r3, 0x4) socketpair$inet6_icmp_raw(0xa, 0x3, 0x3a, &(0x7f0000000140)) 16:57:01 executing program 5 (fault-call:7 fault-nth:2): r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:57:01 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) [ 304.582600] RDX: 0000000000000014 RSI: 0000000000004c00 RDI: 0000000000000015 [ 304.589861] RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000000a [ 304.597122] R10: 0000000000000075 R11: 0000000000000246 R12: 0000000000000014 [ 304.604377] R13: 0000000000000000 R14: 00000000004d3c90 R15: 0000000000000013 16:57:01 executing program 0: r0 = gettid() process_vm_writev(r0, &(0x7f0000003540)=[{&(0x7f00000000c0)=""/39, 0x27}, {&(0x7f0000000100)=""/194, 0xc2}, {&(0x7f0000000200)=""/101, 0x65}, {&(0x7f0000000280)=""/4096, 0x1000}, {&(0x7f0000001280)=""/68, 0x44}, {&(0x7f0000001300)=""/185, 0xb9}, {&(0x7f00000013c0)=""/240, 0xf0}, {&(0x7f00000014c0)=""/114, 0x72}, {&(0x7f0000001540)=""/4096, 0x1000}, {&(0x7f0000002540)=""/4096, 0x1000}], 0xa, &(0x7f00000038c0)=[{&(0x7f0000003600)=""/134, 0x86}, {&(0x7f00000036c0)=""/194, 0xc2}, {&(0x7f00000037c0)=""/56, 0x38}, {&(0x7f0000003800)=""/187, 0xbb}], 0x4, 0x0) syz_read_part_table(0x0, 0xaaaaaaaaaaaaab8, &(0x7f0000000000)=[{&(0x7f0000000040)="0000000000008128b14700000000d59863d20000000002000f2020cc00000000ff0700000000000000000000000000000000000000000000000000000000000000000000000000000000000000008a6e94c0000055aa00000000000000000000", 0x5e, 0x3}]) 16:57:01 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000007ce0000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 304.659190] binder: 21518:21521 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 304.667836] binder: 21518:21521 unknown command 4743953 [ 304.673221] binder: 21518:21521 ioctl c0306201 20000000 returned -22 [ 304.684197] binder: 21518:21521 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 304.692832] binder: 21518:21521 unknown command 4743953 [ 304.698304] binder: 21518:21521 ioctl c0306201 20000000 returned -22 16:57:02 executing program 1: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', 0x200002, 0x0) r1 = socket$rds(0x15, 0x5, 0x0) ioctl(r1, 0x1004000008912, &(0x7f0000000340)="295ee1311f16f477671070") r2 = openat$cgroup_int(r0, &(0x7f0000000000)='io.max\x00', 0x2, 0x0) r3 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x280, 0x0) ioctl$KDGETKEYCODE(r3, 0x4b4c, &(0x7f00000000c0)={0x6, 0x1ff}) write$cgroup_int(r2, &(0x7f0000000040)=ANY=[@ANYBLOB='9:4\r'], 0x4) 16:57:02 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = dup2(r0, r0) sendmsg$nl_crypto(r1, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10800080}, 0xc, &(0x7f0000000080)={&(0x7f0000000140)=@get={0xf0, 0x13, 0x200, 0x70bd28, 0x25dfdbff, {{'rfc4106(morus640)\x00'}, [], [], 0x400, 0x2400}, [{0x8, 0x1, 0xaf}, {0x8, 0x1, 0x40}]}, 0xf0}, 0x1, 0x0, 0x0, 0x40000}, 0x4) r2 = socket$inet6(0xa, 0x100040000080806, 0x0) bind$inet6(r2, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) listen(r2, 0xffffffffffffffff) r3 = socket$inet6(0xa, 0x6, 0x0) setsockopt$inet6_int(r3, 0x29, 0x8, &(0x7f0000000000)=0x8, 0x4) connect$inet6(r3, &(0x7f000000cfe4)={0xa, 0x4e20}, 0x1c) 16:57:02 executing program 4: request_key(&(0x7f0000000100)='dns_resolver\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f00000000c0)='bdevbdev]#\x00', 0xfffffffffffffffe) socketpair$inet_dccp(0x2, 0x6, 0x0, &(0x7f0000000140)) r0 = getpid() ptrace$setregset(0x4205, r0, 0x4, &(0x7f0000000080)={&(0x7f0000000000)="0aa263e96b3ff0f92e4d63", 0xb}) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='bdevbdev]#\x00'}, 0x10) write$tun(r1, &(0x7f0000000200)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @random="957babe35400", [{[], {0x8100, 0x100000001, 0x6, 0x2}}], {@generic={0x88ca, "2102af737531a978c0767c2ceec44ef14cd1282bb4f4fedadb"}}}}, 0x2b) [ 304.905009] FAULT_INJECTION: forcing a failure. [ 304.905009] name failslab, interval 1, probability 0, space 0, times 0 [ 304.916474] CPU: 0 PID: 21546 Comm: syz-executor5 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 304.924879] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 304.934234] Call Trace: [ 304.936836] dump_stack+0x1c9/0x2b4 [ 304.940473] ? dump_stack_print_info.cold.2+0x52/0x52 [ 304.945678] should_fail.cold.4+0xa/0x11 [ 304.949750] ? __kernel_text_address+0xd/0x40 16:57:02 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x20000, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000140)='cgroup\x00\x00ontrollers\x00', 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r1, 0x0, 0xffffffffffffffff, 0xe) [ 304.954335] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 304.959439] ? __save_stack_trace+0x8d/0xf0 [ 304.967682] ? save_stack+0xa9/0xd0 [ 304.971321] ? save_stack+0x43/0xd0 [ 304.974956] ? kasan_kmalloc+0xc4/0xe0 [ 304.978846] ? kasan_slab_alloc+0x12/0x20 [ 304.983001] ? kmem_cache_alloc_node+0x144/0x780 [ 304.987756] ? __alloc_skb+0x119/0x790 [ 304.991645] ? tcp_v6_send_response+0x22d/0x2540 [ 304.996383] ? tcp_v6_send_reset+0x64e/0x1160 [ 305.000867] ? tcp_v6_rcv+0x1da3/0x3a70 [ 305.004833] ? ip6_input_finish+0x407/0x1a40 [ 305.009219] ? ip6_input+0xe9/0x600 [ 305.012922] ? ip6_rcv_finish+0x17a/0x330 [ 305.017054] ? ipv6_rcv+0x11e/0x650 [ 305.020671] ? __netif_receive_skb_one_core+0x14d/0x200 [ 305.026023] ? __netif_receive_skb+0x2c/0x1e0 [ 305.030507] ? netif_receive_skb_internal+0x12e/0x5f0 [ 305.035677] ? napi_gro_frags+0x64e/0xc60 [ 305.039805] ? tun_get_user+0x31ad/0x42f0 [ 305.043933] ? tun_chr_write_iter+0xb9/0x154 [ 305.048324] ? do_iter_readv_writev+0x8b0/0xa80 [ 305.053146] ? do_iter_write+0x185/0x5f0 [ 305.057183] ? vfs_writev+0x1f1/0x360 [ 305.060964] ? do_writev+0x11a/0x310 [ 305.064661] ? __x64_sys_writev+0x75/0xb0 [ 305.068788] ? do_syscall_64+0x1b9/0x820 [ 305.072839] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 305.078195] ? trace_hardirqs_on+0x10/0x10 [ 305.082409] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 305.087928] ? fib6_table_lookup+0xcac/0x14f0 [ 305.092415] __should_failslab+0x124/0x180 [ 305.096644] should_failslab+0x9/0x14 [ 305.100445] kmem_cache_alloc_node_trace+0x5a/0x770 [ 305.105458] ? kasan_kmalloc+0xc4/0xe0 [ 305.109329] __kmalloc_node_track_caller+0x33/0x70 [ 305.114247] __kmalloc_reserve.isra.41+0x3a/0xe0 [ 305.118990] __alloc_skb+0x155/0x790 [ 305.122689] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 305.128214] ? skb_scrub_packet+0x490/0x490 [ 305.132519] ? ip_vs_conn_hashkey_param+0x315/0x6d0 [ 305.137527] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 305.143073] ? ip_vs_conn_in_get+0x6c2/0x17a0 [ 305.147550] ? ip_vs_conn_seq_start+0x1d0/0x1d0 [ 305.152203] ? ipv6_skip_exthdr+0x760/0x760 [ 305.156516] tcp_v6_send_response+0x22d/0x2540 [ 305.161086] ? tcp_v6_syn_recv_sock+0x26b0/0x26b0 [ 305.165909] ? lock_release+0xa30/0xa30 [ 305.169873] ? trace_hardirqs_on+0x10/0x10 [ 305.174091] ? tcp_dnat_handler+0x1d10/0x1d10 [ 305.178566] tcp_v6_send_reset+0x64e/0x1160 [ 305.182871] ? ip_vs_conn_out_get+0x9d0/0x9d0 [ 305.187453] ? tcp_v6_send_response+0x2540/0x2540 [ 305.192286] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 305.197803] ? inet6_lookup_listener+0x31a/0xea0 [ 305.202538] ? memcpy+0x45/0x50 [ 305.205801] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 305.211321] tcp_v6_rcv+0x1da3/0x3a70 [ 305.215109] ? tcp_v6_reqsk_send_ack+0x380/0x380 [ 305.219850] ? lock_release+0xa30/0xa30 [ 305.223818] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 305.229351] ? ipv6_confirm+0x46e/0x650 [ 305.233318] ? ipv6_helper+0x3ab/0x540 [ 305.237196] ip6_input_finish+0x407/0x1a40 [ 305.241424] ? ip6_sublist_rcv+0x1020/0x1020 [ 305.245814] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 305.250816] ? nf_hook_slow+0x11e/0x1c0 [ 305.254774] ip6_input+0xe9/0x600 [ 305.258213] ? ip6_input_finish+0x1a40/0x1a40 [ 305.262702] ? ip6_sublist_rcv+0x1020/0x1020 [ 305.267107] ? nf_nat_ipv6_out+0x660/0x660 [ 305.271324] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 305.276501] ip6_rcv_finish+0x17a/0x330 [ 305.280457] ipv6_rcv+0x11e/0x650 [ 305.283899] ? ip6_rcv_core.isra.17+0x1c90/0x1c90 [ 305.288723] ? do_iter_write+0x185/0x5f0 [ 305.292768] ? ip6_rcv_finish_core.isra.14+0x720/0x720 [ 305.298034] ? lock_acquire+0x1e4/0x540 [ 305.302010] __netif_receive_skb_one_core+0x14d/0x200 [ 305.307197] ? __netif_receive_skb_core+0x3620/0x3620 [ 305.312369] __netif_receive_skb+0x2c/0x1e0 [ 305.316680] netif_receive_skb_internal+0x12e/0x5f0 [ 305.321684] ? dev_cpu_dead+0xaa0/0xaa0 [ 305.325666] ? kasan_check_write+0x14/0x20 [ 305.329968] ? copyin+0xb7/0x100 [ 305.333324] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 305.338843] ? eth_type_trans+0x2ea/0x760 [ 305.342980] ? eth_gro_receive+0x8d0/0x8d0 [ 305.347204] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 305.352375] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 305.357373] napi_gro_frags+0x64e/0xc60 [ 305.361339] ? napi_gro_receive+0x5c0/0x5c0 [ 305.365651] ? eth_get_headlen+0x173/0x1f0 [ 305.369868] ? eth_type_trans+0x760/0x760 [ 305.373999] ? tun_get_user+0x3184/0x42f0 [ 305.378134] tun_get_user+0x31ad/0x42f0 [ 305.382097] ? tun_build_skb.isra.55+0x2280/0x2280 [ 305.387026] ? mntput_no_expire+0x18e/0xbc0 [ 305.391347] ? do_raw_spin_lock+0xc1/0x200 [ 305.395569] ? mnt_get_count+0x150/0x150 [ 305.399638] ? dput.part.26+0x276/0x7a0 [ 305.403608] ? shrink_dcache_sb+0x350/0x350 [ 305.407921] ? __fdget_pos+0x1bb/0x200 [ 305.411802] ? lock_acquire+0x1e4/0x540 [ 305.415766] ? tun_get+0x208/0x370 [ 305.419292] ? lock_downgrade+0x8f0/0x8f0 [ 305.423423] ? lock_release+0xa30/0xa30 [ 305.427382] ? lock_acquire+0x1e4/0x540 [ 305.431347] ? lock_downgrade+0x8f0/0x8f0 [ 305.435487] ? tun_get+0x231/0x370 [ 305.439013] ? tun_chr_close+0x180/0x180 [ 305.443071] tun_chr_write_iter+0xb9/0x154 [ 305.447297] do_iter_readv_writev+0x8b0/0xa80 [ 305.451771] ? vfs_dedupe_file_range+0x670/0x670 [ 305.456506] ? rw_copy_check_uvector+0x30d/0x3e0 [ 305.461243] ? rw_verify_area+0x118/0x360 [ 305.465372] do_iter_write+0x185/0x5f0 [ 305.469240] ? dup_iter+0x270/0x270 [ 305.472851] ? proc_cwd_link+0x1d0/0x1d0 [ 305.476896] vfs_writev+0x1f1/0x360 [ 305.480505] ? __fget_light+0x2f7/0x440 [ 305.484458] ? vfs_iter_write+0xb0/0xb0 [ 305.488416] ? fsnotify+0xbac/0x14e0 [ 305.492109] ? vfs_write+0x2f3/0x560 [ 305.495806] ? wait_for_completion+0x8d0/0x8d0 [ 305.500377] ? lock_release+0xa30/0xa30 [ 305.504341] ? fsnotify_first_mark+0x350/0x350 [ 305.508913] ? __fsnotify_parent+0xcc/0x420 [ 305.513218] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 305.518738] ? __fdget_pos+0xde/0x200 [ 305.522517] ? __fdget_raw+0x20/0x20 [ 305.526213] ? __sb_end_write+0xac/0xe0 [ 305.530177] do_writev+0x11a/0x310 [ 305.533711] ? vfs_writev+0x360/0x360 [ 305.537494] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 305.543020] __x64_sys_writev+0x75/0xb0 [ 305.546990] do_syscall_64+0x1b9/0x820 [ 305.552519] ? finish_task_switch+0x1d3/0x870 [ 305.557006] ? syscall_return_slowpath+0x5e0/0x5e0 [ 305.561924] ? syscall_return_slowpath+0x31d/0x5e0 [ 305.566845] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 305.571852] ? prepare_exit_to_usermode+0x291/0x3b0 [ 305.576856] ? perf_trace_sys_enter+0xb10/0xb10 [ 305.581507] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 305.586334] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 305.591504] RIP: 0033:0x455971 16:57:02 executing program 5 (fault-call:7 fault-nth:3): r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 305.594669] Code: 75 14 b8 14 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 54 bb fb ff c3 48 83 ec 08 e8 da 2c 00 00 48 89 04 24 b8 14 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 23 2d 00 00 48 89 d0 48 83 c4 08 48 3d 01 [ 305.613832] RSP: 002b:00007ff402100ba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000014 [ 305.621524] RAX: ffffffffffffffda RBX: 000000000000004a RCX: 0000000000455971 [ 305.628797] RDX: 0000000000000001 RSI: 00007ff402100bf0 RDI: 00000000000000fc [ 305.636054] RBP: 0000000020000100 R08: 00000000000000fc R09: 0000000000000000 [ 305.643315] R10: 000000000000004a R11: 0000000000000293 R12: 0000000000000015 [ 305.650571] R13: 00000000004c20a6 R14: 00000000004d3ae0 R15: 0000000000000002 16:57:02 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x6, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0xfffffffffffffeea) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000000)={r0, 0xfffffffffffffcf2, &(0x7f0000000100)}, 0x10) 16:57:03 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000020000000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 305.704016] binder: 21541:21558 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 305.712785] binder: 21541:21558 unknown command 4743953 [ 305.718221] binder: 21541:21558 ioctl c0306201 20000000 returned -22 16:57:03 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='\nxt4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) [ 305.747790] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 305.762229] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue 16:57:03 executing program 1: r0 = socket$inet(0x10, 0x80007, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_opts(r1, 0x29, 0x36, &(0x7f0000000080)=""/11, &(0x7f0000000100)=0xb) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x42000, 0x0) openat$cgroup_procs(r2, &(0x7f0000000180)='tasks\x00', 0x2, 0x0) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000000c0)="2f0000001800030007fffd946fa283bc8020000000040005031d8568130009000f0014cc16ccbb24e0710b42fa3ccc", 0x2f}], 0x1}, 0x0) 16:57:03 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f00000001c0)={0x0, 0x1c, &(0x7f0000000180)=[@in6={0xa, 0x4e20, 0x0, @dev={0xfe, 0x80}, 0x1}]}, &(0x7f0000000200)=0x10) r2 = accept4(r1, &(0x7f0000c71ff0)=@llc={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000f5effc)=0x10, 0x0) r3 = accept4(r2, &(0x7f0000000000)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @local}}}, &(0x7f0000000100)=0x80, 0x80000) recvfrom$packet(r2, &(0x7f0000000080)=""/89, 0x59, 0x0, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6}, 0x709000) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000140)={'team0\x00', 0x0}) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000300)={{{@in=@multicast2, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6}}, &(0x7f0000000240)=0xe8) setsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000400)={{{@in6=@ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}, @in6=@dev={0xfe, 0x80, [], 0xe}, 0x4e24, 0x5, 0x4e23, 0x400, 0x0, 0x20, 0x20, 0x8d, r5, r6}, {0x1, 0x0, 0x8, 0x4, 0x2, 0x7fff, 0x158fc04a, 0x7}, {0x9, 0x1, 0x6}, 0x2fc, 0x6e6bc0, 0x2, 0x0, 0x3}, {{@in=@remote={0xac, 0x14, 0x14, 0xbb}, 0x4d2, 0xff}, 0xa, @in=@rand_addr=0x46, 0x0, 0x1, 0x1, 0x383d0323, 0x3, 0x9}}, 0xe8) setsockopt$inet_sctp_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f0000238000)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xb) 16:57:03 executing program 7: mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x1}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x14cb, 0x22100) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r2, 0xc0a85322, &(0x7f00000000c0)) r3 = creat(&(0x7f0000000000)='./control/file0\x00', 0x0) write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000f86000)='./control/file0\x00') creat(&(0x7f00000006c0)='./control/file1\x00', 0x0) close(r1) 16:57:03 executing program 4: r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x10, &(0x7f0000000080)=0xfffe, 0x3e4) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") fgetxattr(r1, &(0x7f00000004c0)=ANY=[@ANYBLOB="7472757374002c713a81beb26fef48064a3798244035d1d29257c79be846e278eb4a8cdeff960cc3623cb85f718a0931e3fe929cfce97cad0d60260a5d9e36e22fd4a1587de572dde95bcc30b8a9e9894e8dbe6334d7e11e7fbee52c978db2bc6958088d9dec95644807ee3ebccf7e302b07c28262a7"], &(0x7f00000000c0)=""/156, 0x9c) r3 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0xfff, 0x100) sendmsg$nfc_llcp(r3, &(0x7f0000000240)={&(0x7f0000000180)={0x27, 0x1, 0x1, 0x6, 0xfffffffffffff111, 0x8, "266881fe2daa6d1056b20a65c499f51d00d479b3ec957034b9d55889de7fc2a67e97955b8465d714706d5dea1baf7c64061808c74ec7ba71ee914e80e9a1c9", 0x9}, 0x60, &(0x7f0000000200)=[{&(0x7f00000002c0)="a4991e3921981a4acd5f9738b6bb76c36d7855a79006eafb3d14b93b5799032b12f4464571c4d2e97bac349de4a70f285acb2c28b1477001eb2190beeb3030f39fbb425d20f22d84bf6dc4f5cc7fc0cb39d13c07134d2deee06149dcf68fcb6f9c1574f9bb61c12bfcdc1bb79446a67cb27bca3175f28db043e9ae88a900c233efc91ea303d05aaa5eedb1d93425762a4ecbf46a85b00cacbd46290f0c51f7313cac8eecd048c4dd33d99c7ae437ec27b981639a7003d859b439a3", 0xbb}, {&(0x7f0000000380)="79b5af5b0d8b226ef3797bcef84936cc6ec06e8ad1a88edb998bdad43258d39ccfa07ffb56adf6a595d8142e0bf791abe0768d9b3dfec35c41f7488065311cdcc46be8540ef4d1488b2cc6e0470277db41ddacfd4fb3b3d18d426b146148fb066289204687c6011d9b73146da4aeb6743f7d7fad395960a14424517773b01879e3b219cabdb59867a2409e4e4fa716", 0x8f}], 0x2, 0x0, 0x0, 0x4000000}, 0x800) bind$unix(r1, &(0x7f0000003000)=@file={0x1, "e91f7189591e9233614b00"}, 0xc) ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000000)) listen(r1, 0x0) connect$unix(r0, &(0x7f000066fff4)=@file={0x1, "e91f7189591e9233614b00"}, 0xc) 16:57:03 executing program 0: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x381000, 0x0) ioctl$SG_SCSI_RESET(r0, 0x2284, 0x0) ioctl$KDGETMODE(r0, 0x4b3b, &(0x7f0000000080)) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4000004000001) ioctl$SG_GET_RESERVED_SIZE(r1, 0x2272, &(0x7f00000000c0)) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000a, 0x31, 0xffffffffffffffff, 0x0) getdents(r2, &(0x7f0000000100)=""/148, 0x94) [ 305.963468] binder: 21577:21587 BC_REQUEST_DEATH_NOTIFICATION invalid ref 131072 [ 305.972662] binder: 21577:21587 unknown command 4743953 [ 305.978569] binder: 21577:21587 ioctl c0306201 20000000 returned -22 [ 305.990574] binder: 21577:21587 Acquire 1 refcount change on invalid ref 0 ret -22 [ 306.000657] FAULT_INJECTION: forcing a failure. [ 306.000657] name failslab, interval 1, probability 0, space 0, times 0 16:57:03 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c4000007a0000000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 306.011919] CPU: 1 PID: 21589 Comm: syz-executor5 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 306.020324] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 306.029679] Call Trace: [ 306.032277] dump_stack+0x1c9/0x2b4 [ 306.035920] ? dump_stack_print_info.cold.2+0x52/0x52 [ 306.041130] should_fail.cold.4+0xa/0x11 [ 306.045209] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 306.050318] ? trace_hardirqs_on+0x10/0x10 [ 306.054572] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 306.060112] ? fib6_table_lookup+0xcac/0x14f0 [ 306.064631] ? rt6_age_exceptions+0x790/0x790 [ 306.069123] ? trace_hardirqs_on+0x10/0x10 [ 306.073367] ? __nf_conntrack_find_get.part.43+0x1073/0x1bd0 [ 306.079179] ? lock_downgrade+0x8f0/0x8f0 [ 306.083344] ? lock_release+0xa30/0xa30 [ 306.087334] __should_failslab+0x124/0x180 [ 306.092268] should_failslab+0x9/0x14 [ 306.096082] kmem_cache_alloc+0x47/0x760 [ 306.100158] __nf_conntrack_alloc+0x1b1/0x7e0 [ 306.104673] ? early_drop+0xc20/0xc20 [ 306.108488] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 306.113701] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 306.119260] init_conntrack+0xffe/0x13b0 [ 306.123339] ? memcpy+0x45/0x50 [ 306.126632] ? nf_conntrack_alloc+0x50/0x50 [ 306.130971] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 306.136171] ? lock_acquire+0x1e4/0x540 [ 306.140140] ? nf_conntrack_in+0x571/0x1150 [ 306.144456] ? lock_release+0xa30/0xa30 [ 306.148434] nf_conntrack_in+0xb67/0x1150 [ 306.152580] ? ip6t_do_table+0xdf7/0x1d00 [ 306.156733] ? nf_conntrack_update+0xba0/0xba0 [ 306.161319] ? ip6t_error+0x40/0x40 [ 306.164944] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 306.170472] ? ipv6_conntrack_in+0x90/0x90 [ 306.174698] ipv6_conntrack_in+0x61/0x90 [ 306.178748] ipv6_conntrack_local+0x25/0x30 [ 306.183062] nf_hook_slow+0xc2/0x1c0 [ 306.186764] ip6_xmit+0x136a/0x23f0 [ 306.190379] ? dst_output+0x180/0x180 [ 306.194178] ? ip6_finish_output2+0x2820/0x2820 [ 306.198841] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 306.204365] ? __alloc_skb+0x4f2/0x790 [ 306.208253] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 306.213779] ? ip6_append_data+0x2d0/0x2d0 [ 306.218013] ? ip_vs_conn_hashkey_param+0x315/0x6d0 [ 306.223038] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 306.228573] ? xfrm_lookup_route+0x71/0x1f0 [ 306.232896] ? ip_vs_conn_seq_start+0x1d0/0x1d0 [ 306.237562] tcp_v6_send_response+0x16f5/0x2540 [ 306.242241] ? tcp_v6_syn_recv_sock+0x26b0/0x26b0 [ 306.247077] ? tcp_dnat_handler+0x1d10/0x1d10 [ 306.251572] tcp_v6_send_reset+0x64e/0x1160 [ 306.255888] ? ip_vs_conn_out_get+0x9d0/0x9d0 [ 306.260406] ? tcp_v6_send_response+0x2540/0x2540 [ 306.265248] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 306.270777] ? inet6_lookup_listener+0x31a/0xea0 [ 306.275528] ? memcpy+0x45/0x50 [ 306.278806] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 306.284334] tcp_v6_rcv+0x1da3/0x3a70 [ 306.288148] ? tcp_v6_reqsk_send_ack+0x380/0x380 [ 306.292906] ? lock_release+0xa30/0xa30 [ 306.296885] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 306.303031] ? ipv6_confirm+0x46e/0x650 [ 306.306991] ? ipv6_helper+0x3ab/0x540 [ 306.310891] ip6_input_finish+0x407/0x1a40 [ 306.315123] ? ip6_sublist_rcv+0x1020/0x1020 [ 306.319533] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 306.324538] ? nf_hook_slow+0x11e/0x1c0 [ 306.328529] ip6_input+0xe9/0x600 [ 306.331973] ? ip6_input_finish+0x1a40/0x1a40 [ 306.336456] ? ip6_sublist_rcv+0x1020/0x1020 [ 306.340859] ? nf_nat_ipv6_out+0x660/0x660 [ 306.345088] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 306.350277] ip6_rcv_finish+0x17a/0x330 [ 306.354237] ipv6_rcv+0x11e/0x650 [ 306.357677] ? ip6_rcv_core.isra.17+0x1c90/0x1c90 [ 306.362506] ? do_iter_write+0x185/0x5f0 [ 306.366561] ? ip6_rcv_finish_core.isra.14+0x720/0x720 [ 306.371830] ? lock_acquire+0x1e4/0x540 [ 306.375794] __netif_receive_skb_one_core+0x14d/0x200 [ 306.380974] ? __netif_receive_skb_core+0x3620/0x3620 [ 306.386157] __netif_receive_skb+0x2c/0x1e0 [ 306.390469] netif_receive_skb_internal+0x12e/0x5f0 [ 306.395471] ? dev_cpu_dead+0xaa0/0xaa0 [ 306.399433] ? kasan_check_write+0x14/0x20 [ 306.403741] ? copyin+0xb7/0x100 [ 306.407094] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 306.412630] ? eth_type_trans+0x2ea/0x760 [ 306.416775] ? eth_gro_receive+0x8d0/0x8d0 [ 306.420997] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 306.426185] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 306.431206] napi_gro_frags+0x64e/0xc60 [ 306.435179] ? napi_gro_receive+0x5c0/0x5c0 [ 306.439496] ? eth_get_headlen+0x173/0x1f0 [ 306.443723] ? eth_type_trans+0x760/0x760 [ 306.447859] ? tun_get_user+0x3184/0x42f0 [ 306.452006] tun_get_user+0x31ad/0x42f0 [ 306.455983] ? tun_build_skb.isra.55+0x2280/0x2280 [ 306.460902] ? mntput_no_expire+0x18e/0xbc0 [ 306.465209] ? do_raw_spin_lock+0xc1/0x200 [ 306.469433] ? mnt_get_count+0x150/0x150 [ 306.473480] ? dput.part.26+0x276/0x7a0 [ 306.477441] ? shrink_dcache_sb+0x350/0x350 [ 306.481754] ? __fdget_pos+0x1bb/0x200 [ 306.485632] ? lock_acquire+0x1e4/0x540 [ 306.489591] ? tun_get+0x208/0x370 [ 306.493118] ? lock_downgrade+0x8f0/0x8f0 [ 306.497253] ? lock_release+0xa30/0xa30 [ 306.501215] ? lock_acquire+0x1e4/0x540 [ 306.505179] ? lock_downgrade+0x8f0/0x8f0 [ 306.509315] ? tun_get+0x231/0x370 [ 306.512841] ? tun_chr_close+0x180/0x180 [ 306.516894] tun_chr_write_iter+0xb9/0x154 [ 306.521118] do_iter_readv_writev+0x8b0/0xa80 [ 306.525613] ? vfs_dedupe_file_range+0x670/0x670 [ 306.530363] ? rw_copy_check_uvector+0x30d/0x3e0 [ 306.535117] ? rw_verify_area+0x118/0x360 [ 306.539253] do_iter_write+0x185/0x5f0 [ 306.543129] ? dup_iter+0x270/0x270 [ 306.546741] ? proc_cwd_link+0x1d0/0x1d0 [ 306.550801] vfs_writev+0x1f1/0x360 [ 306.554416] ? __fget_light+0x2f7/0x440 [ 306.558376] ? vfs_iter_write+0xb0/0xb0 [ 306.562345] ? fsnotify+0xbac/0x14e0 [ 306.566043] ? vfs_write+0x2f3/0x560 [ 306.569745] ? wait_for_completion+0x8d0/0x8d0 [ 306.574324] ? lock_release+0xa30/0xa30 [ 306.578295] ? fsnotify_first_mark+0x350/0x350 [ 306.582864] ? __fsnotify_parent+0xcc/0x420 [ 306.587179] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 306.592701] ? __fdget_pos+0xde/0x200 [ 306.596489] ? __fdget_raw+0x20/0x20 [ 306.600193] ? __sb_end_write+0xac/0xe0 [ 306.604157] do_writev+0x11a/0x310 [ 306.607694] ? vfs_writev+0x360/0x360 [ 306.611480] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 306.617022] __x64_sys_writev+0x75/0xb0 [ 306.620985] do_syscall_64+0x1b9/0x820 [ 306.624860] ? finish_task_switch+0x1d3/0x870 [ 306.629361] ? syscall_return_slowpath+0x5e0/0x5e0 [ 306.634278] ? syscall_return_slowpath+0x31d/0x5e0 [ 306.639198] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 306.644214] ? prepare_exit_to_usermode+0x291/0x3b0 [ 306.649221] ? perf_trace_sys_enter+0xb10/0xb10 [ 306.653963] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 306.658805] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 306.663980] RIP: 0033:0x455971 [ 306.667160] Code: 75 14 b8 14 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 54 bb fb ff c3 48 83 ec 08 e8 da 2c 00 00 48 89 04 24 b8 14 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 23 2d 00 00 48 89 d0 48 83 c4 08 48 3d 01 [ 306.686442] RSP: 002b:00007ff402100ba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000014 [ 306.694143] RAX: ffffffffffffffda RBX: 000000000000004a RCX: 0000000000455971 [ 306.701396] RDX: 0000000000000001 RSI: 00007ff402100bf0 RDI: 00000000000000fc [ 306.708657] RBP: 0000000020000100 R08: 00000000000000fc R09: 0000000000000000 [ 306.715931] R10: 000000000000004a R11: 0000000000000293 R12: 0000000000000015 [ 306.723185] R13: 00000000004c20a6 R14: 00000000004d3ae0 R15: 0000000000000003 [ 306.753555] binder: 21604:21611 BC_REQUEST_DEATH_NOTIFICATION invalid ref 7995392 16:57:04 executing program 1: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x8002, 0x0) write$cgroup_int(r0, &(0x7f0000000040), 0xfffffffffffffe25) [ 306.762912] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 306.794085] binder: 21604:21611 unknown command 4743953 [ 306.799669] binder: 21604:21611 ioctl c0306201 20000000 returned -22 [ 306.807868] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬ 16:57:04 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000070000000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:57:04 executing program 4: r0 = socket$inet6(0xa, 0x80001, 0x80800000801) ioctl(r0, 0x3ff, &(0x7f0000000200)="d05eb41867e88766dec81ecfd54c375a180fd94f3f99257204cdf3ec99b3a7f2908ebddf80b161146783b566417248176835cfcf59f20ba2c2dc7db0d3ddb8994aa9dc8d58143f36ee0c2abe18d70b4740db819225100138e9dd5257c0457e04a597ee846e0173eaba25c983ee561aa7e9c1a60d44bedf47") getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000380)={0x0, @in6={{0xa, 0x4e23, 0x1, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}, 0x200}}, 0xfffffffffffffffa, 0x8000, 0xffffffff, 0x1, 0x6}, &(0x7f0000000180)=0x98) getsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f00000001c0)={r1, 0xffffffffffff0001, 0x1, 0x9}, &(0x7f0000000440)=0x10) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x220000, 0x0) ioctl$SG_NEXT_CMD_LEN(r2, 0x2283, &(0x7f0000000080)=0x75) delete_module(&(0x7f0000000140)='/dev/snd/seq\x00', 0xa00) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r2, 0x40505331, &(0x7f00000000c0)={{0x73b200000000, 0xa846}, {0x3, 0x4}, 0x7fff, 0x1, 0x4}) syz_open_dev$sndseq(&(0x7f0000042ff3)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f0000000280)) syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x84001) 16:57:04 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") clock_gettime(0x1, &(0x7f0000000180)={0x0}) futex(&(0x7f000000cffc)=0x2, 0x80000000000b, 0x2, &(0x7f00000000c0)={r1}, &(0x7f0000000100)=0x1, 0x0) futex(&(0x7f000000cffc)=0x4, 0x0, 0x4, &(0x7f000000b000)={0x77359400}, &(0x7f0000001040), 0x0) clone(0x0, &(0x7f0000000000), &(0x7f0000000140), &(0x7f0000000080), &(0x7f0000000000)) futex(&(0x7f000000cffc)=0x4, 0xc, 0x1, &(0x7f0000fd7ff0)={0x77359400}, &(0x7f0000048000), 0x4) 16:57:04 executing program 5 (fault-call:7 fault-nth:4): r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:57:04 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x0, 0x0) fcntl$setpipe(r0, 0x407, 0x10000) ioctl(r1, 0x8000000000009376, &(0x7f00000001c0)="5fe70f000000594dcb647642ddb95317e179019215e6a91ae0804f58b06fe1745e5ff4f964d8f568dbc23efdffffffffffffff16e2bbaad65a90b22d5a69b94014509bbae7876409590673a863cd94b222e73cec87c13186d0143263434f05bab4e165f7b2a34135ed08925300c8c8715994e0b46edc79827e0ad4383c501431c1e70de73bec1ccd5d7e4db47aee6beee65f05c379e610771fcbfa06e0bd595157eba4d4054c51b76ce046d9fe3ccd1e2626d15fff8ab6b7f10cf03a380f003a9caba0e6dc9e3d19fe4404f7ceda160b92776277935f0bf282c62a6e9241e6d142d61fc8d850acdb0a4f57b5d687f792d1bae7f3dcc494ae") getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000080)={{{@in6=@ipv4={[], [], @multicast2}, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@mcast2}}, &(0x7f0000000000)=0xe8) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000340)={0x0, 0x10001, 0x3, [0x3, 0x4, 0xbc]}, &(0x7f0000000380)=0xe) setsockopt$inet_sctp_SCTP_AUTH_KEY(r1, 0x84, 0x17, &(0x7f00000003c0)={r3, 0x800, 0xeb, "9cd437d920b70b2212383c5e8508fac5bb55876a61bbefe147f199dc1c62e4912e41d4e0523322409db6da4c0cc3b414fb4ecfadeffd0502462d08d2289ce81acf59f896bea6d5d45af5536c9486ce49618854a883e9c7424b7207f2355227ac30ebc11be0218dd5199357e271ddd28ad2a5e69fd4db50e2c136c208268d2c34cec70688ae0d120610b3dcaa14693a8ca962a4b8ff62d9cd656c67420b5395600c07e605204c1bb0650c01da1f6966c07ac85c81efe0afdda0a867607f9b49dff22d06189f2d181a5988163689706e338699ab841f80596cfcbebf3908720bd68f79a640d67196cacae743"}, 0xf3) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f00000002c0)={@mcast1={0xff, 0x1, [], 0x1}, r2}, 0x14) setsockopt$IP_VS_SO_SET_DEL(r1, 0x0, 0x484, &(0x7f0000000300)={0x0, @empty, 0x4e24, 0x1, 'ovf\x00', 0x26, 0xff, 0x54}, 0x2c) 16:57:04 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='%xt4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) [ 306.841327] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 306.878264] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬ [ 306.958141] binder: 21626:21628 BC_REQUEST_DEATH_NOTIFICATION invalid ref 458752 [ 306.973942] binder: 21626:21628 unknown command 4743953 [ 306.981078] binder: 21626:21628 ioctl c0306201 20000000 returned -22 [ 306.994172] binder: 21626:21628 BC_REQUEST_DEATH_NOTIFICATION invalid ref 458752 [ 307.001934] binder: 21626:21628 unknown command 4743953 [ 307.007562] binder: 21626:21628 ioctl c0306201 20000000 returned -22 [ 307.022623] FAULT_INJECTION: forcing a failure. [ 307.022623] name failslab, interval 1, probability 0, space 0, times 0 [ 307.033922] CPU: 1 PID: 21638 Comm: syz-executor5 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 307.042325] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 307.051702] Call Trace: [ 307.054305] dump_stack+0x1c9/0x2b4 16:57:04 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c40000007cd00000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:57:04 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x1, 0x0) r2 = dup(r0) fanotify_mark(r2, 0x12, 0x40000000, r1, &(0x7f0000000040)='./file0\x00') bind$inet6(r1, &(0x7f0000000180)={0xa, 0x4e20}, 0x1c) sendto$inet6(r2, &(0x7f00000007c0), 0xfd06, 0x20000008, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) r3 = open(&(0x7f00000008c0)='./file0\x00', 0x20141042, 0x1b0) ftruncate(r3, 0x80080) sendfile(r1, r3, &(0x7f0000000000), 0x6) sendfile(r2, r3, &(0x7f0000d83ff8)=0xf39b, 0x2008000fffffffe) openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x40, 0x0) 16:57:04 executing program 1: r0 = memfd_create(&(0x7f0000000000)="2e001b2121894de067a1504545d99e", 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000043ff3)='/dev/snd/seq\x00', 0x0, 0x802) r2 = dup2(r1, r0) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x151, 0xfffffffffffffff7}) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000041f74)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') ioctl$KVM_PPC_ALLOCATE_HTAB(r2, 0xc004aea7, &(0x7f0000000200)=0x7c23) sendmsg$IPVS_CMD_GET_INFO(r2, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000", @ANYRES16=r3, @ANYBLOB="00022b40bd1f1caaaf039eedaebd70ff778de15f47ccbaf70ce200ffdbdf250f000000"], 0x14}, 0x1, 0x0, 0x0, 0x8040}, 0x4004000) write$sndseq(r0, &(0x7f0000000040)=[{0x0, 0x3, 0x0, 0x0, @tick=0x7ff, {}, {}, @addr}], 0x126) [ 307.057946] ? dump_stack_print_info.cold.2+0x52/0x52 [ 307.063163] ? lock_acquire+0x1e4/0x540 [ 307.067161] ? debug_object_activate+0x41a/0x690 [ 307.071936] ? lock_downgrade+0x8f0/0x8f0 [ 307.076101] should_fail.cold.4+0xa/0x11 [ 307.080189] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 307.085315] ? kasan_check_write+0x14/0x20 [ 307.089572] ? mod_timer+0x5ee/0x13d0 [ 307.093387] ? lock_downgrade+0x8f0/0x8f0 [ 307.097547] ? trace_hardirqs_off+0xd/0x10 [ 307.101797] ? _raw_spin_unlock_irqrestore+0x63/0xc0 [ 307.106917] ? kasan_check_read+0x11/0x20 [ 307.111067] ? do_raw_spin_unlock+0xa7/0x2f0 [ 307.115500] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 307.119885] binder: 21647:21648 BC_REQUEST_DEATH_NOTIFICATION invalid ref -855179264 [ 307.120089] ? calc_wheel_index+0x260/0x260 [ 307.120108] ? __save_stack_trace+0x8d/0xf0 [ 307.120128] ? trace_hardirqs_on+0xd/0x10 [ 307.120144] ? mod_timer+0x5f3/0x13d0 [ 307.120161] ? mod_timer_pending+0x14b0/0x14b0 [ 307.120174] ? kmem_cache_alloc+0x12e/0x760 [ 307.120191] ? init_conntrack+0xffe/0x13b0 [ 307.128773] binder: 21647:21648 unknown command 4743953 [ 307.132378] ? nf_conntrack_in+0xb67/0x1150 [ 307.132391] ? ipv6_conntrack_in+0x61/0x90 [ 307.132403] ? ipv6_conntrack_local+0x25/0x30 [ 307.132421] __should_failslab+0x124/0x180 [ 307.132438] should_failslab+0x9/0x14 [ 307.132451] kmem_cache_alloc+0x47/0x760 [ 307.132467] skb_clone+0x1f5/0x500 [ 307.132478] ? skb_split+0x11f0/0x11f0 [ 307.132500] ? lock_release+0xa30/0xa30 [ 307.137065] binder: 21647:21648 ioctl c0306201 20000000 returned -22 16:57:04 executing program 4: r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0xa, 0x4) umount2(&(0x7f0000000040)='./file0\x00', 0x4) ioctl(r0, 0xfffc, &(0x7f0000000000)="025cc83d6d345f8f762070") r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x440400, 0x0) ioctl$TCGETA(r1, 0x5405, &(0x7f00000000c0)) shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000300)) [ 307.140936] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 307.140951] ? ip_vs_conn_in_get+0x6c2/0x17a0 [ 307.140970] neigh_probe+0x59/0x120 [ 307.140985] __neigh_event_send+0x443/0x13c0 [ 307.141008] ? neightbl_fill_parms+0x11b0/0x11b0 [ 307.228932] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 307.234489] ? ip_vs_conn_fill_param_proto+0x42d/0x750 [ 307.239779] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 307.245319] ? tcp_conn_schedule+0x58a/0xa00 [ 307.249727] neigh_resolve_output+0x6e5/0xaf0 [ 307.254223] ? ip_vs_conn_in_get+0x17a0/0x17a0 [ 307.258806] ? lock_release+0xa30/0xa30 [ 307.262776] ? __neigh_event_send+0x13c0/0x13c0 [ 307.267439] ip6_finish_output2+0xc95/0x2820 [ 307.271862] ? ip_vs_out_icmp_v6.isra.27+0x6c0/0x6c0 [ 307.276980] ? ip6_copy_metadata+0xc60/0xc60 [ 307.281391] ? lock_acquire+0x1e4/0x540 [ 307.285362] ? ip6_mtu+0x39e/0x520 [ 307.288913] ? lock_downgrade+0x8f0/0x8f0 [ 307.293076] ? lock_release+0xa30/0xa30 [ 307.297059] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 307.303049] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 307.308602] ? ipv6_confirm+0x46e/0x650 [ 307.312577] ? ipv6_helper+0x3ab/0x540 [ 307.316458] ? ipv6_helper+0x540/0x540 [ 307.320344] ? ip6_mtu+0x160/0x520 [ 307.323874] ? ip6_dst_ifdown+0x4e0/0x4e0 [ 307.328015] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 307.333546] ip6_finish_output+0x5fe/0xbc0 [ 307.337768] ? ip6_finish_output+0x5fe/0xbc0 [ 307.342163] ip6_output+0x234/0x9d0 [ 307.345779] ? ip6_finish_output+0xbc0/0xbc0 [ 307.350173] ? ip6_fragment+0x3930/0x3930 [ 307.354310] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 307.359506] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 307.364509] ? nf_hook_slow+0x11e/0x1c0 [ 307.368474] ip6_xmit+0xf4a/0x23f0 [ 307.372004] ? dst_output+0x180/0x180 [ 307.375799] ? ip6_finish_output2+0x2820/0x2820 [ 307.380459] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 307.385992] ? __alloc_skb+0x4f2/0x790 [ 307.389881] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 307.395418] ? ip6_append_data+0x2d0/0x2d0 [ 307.399645] ? ip_vs_conn_hashkey_param+0x315/0x6d0 [ 307.404654] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 307.410180] ? xfrm_lookup_route+0x71/0x1f0 [ 307.414514] ? ip_vs_conn_seq_start+0x1d0/0x1d0 [ 307.419180] tcp_v6_send_response+0x16f5/0x2540 [ 307.423847] ? tcp_v6_syn_recv_sock+0x26b0/0x26b0 [ 307.428691] ? tcp_dnat_handler+0x1d10/0x1d10 [ 307.433188] tcp_v6_send_reset+0x64e/0x1160 [ 307.437503] ? ip_vs_conn_out_get+0x9d0/0x9d0 [ 307.441993] ? tcp_v6_send_response+0x2540/0x2540 [ 307.446830] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 307.452364] ? inet6_lookup_listener+0x31a/0xea0 [ 307.457107] ? memcpy+0x45/0x50 [ 307.460376] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 307.465902] tcp_v6_rcv+0x1da3/0x3a70 [ 307.469701] ? tcp_v6_reqsk_send_ack+0x380/0x380 [ 307.474447] ? lock_release+0xa30/0xa30 [ 307.478414] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 307.483936] ? ipv6_confirm+0x46e/0x650 [ 307.487900] ? ipv6_helper+0x3ab/0x540 [ 307.491780] ip6_input_finish+0x407/0x1a40 [ 307.496013] ? ip6_sublist_rcv+0x1020/0x1020 [ 307.500419] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 307.505421] ? nf_hook_slow+0x11e/0x1c0 [ 307.509395] ip6_input+0xe9/0x600 [ 307.512845] ? ip6_input_finish+0x1a40/0x1a40 [ 307.517340] ? ip6_sublist_rcv+0x1020/0x1020 [ 307.521736] ? nf_nat_ipv6_out+0x660/0x660 [ 307.525974] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 307.531156] ip6_rcv_finish+0x17a/0x330 [ 307.535123] ipv6_rcv+0x11e/0x650 [ 307.538568] ? ip6_rcv_core.isra.17+0x1c90/0x1c90 [ 307.543399] ? do_iter_write+0x185/0x5f0 [ 307.547446] ? ip6_rcv_finish_core.isra.14+0x720/0x720 [ 307.552717] ? lock_acquire+0x1e4/0x540 [ 307.556681] __netif_receive_skb_one_core+0x14d/0x200 [ 307.561859] ? __netif_receive_skb_core+0x3620/0x3620 [ 307.567045] __netif_receive_skb+0x2c/0x1e0 [ 307.571354] netif_receive_skb_internal+0x12e/0x5f0 [ 307.576356] ? dev_cpu_dead+0xaa0/0xaa0 [ 307.580331] ? kasan_check_write+0x14/0x20 [ 307.584567] ? copyin+0xb7/0x100 [ 307.587920] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 307.593453] ? eth_type_trans+0x2ea/0x760 [ 307.597595] ? eth_gro_receive+0x8d0/0x8d0 [ 307.601815] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 307.606992] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 307.611999] napi_gro_frags+0x64e/0xc60 [ 307.615968] ? napi_gro_receive+0x5c0/0x5c0 [ 307.620277] ? eth_get_headlen+0x173/0x1f0 [ 307.624499] ? eth_type_trans+0x760/0x760 [ 307.628643] ? tun_get_user+0x3184/0x42f0 [ 307.632787] tun_get_user+0x31ad/0x42f0 [ 307.636762] ? tun_build_skb.isra.55+0x2280/0x2280 [ 307.641680] ? mntput_no_expire+0x18e/0xbc0 [ 307.646009] ? do_raw_spin_lock+0xc1/0x200 [ 307.650246] ? mnt_get_count+0x150/0x150 [ 307.654302] ? dput.part.26+0x276/0x7a0 [ 307.658273] ? shrink_dcache_sb+0x350/0x350 [ 307.662587] ? __fdget_pos+0x1bb/0x200 [ 307.666571] ? lock_acquire+0x1e4/0x540 [ 307.670531] ? tun_get+0x208/0x370 [ 307.674059] ? lock_downgrade+0x8f0/0x8f0 [ 307.678196] ? lock_release+0xa30/0xa30 [ 307.682168] ? lock_acquire+0x1e4/0x540 [ 307.686132] ? lock_downgrade+0x8f0/0x8f0 [ 307.690284] ? tun_get+0x231/0x370 [ 307.693814] ? tun_chr_close+0x180/0x180 [ 307.697866] tun_chr_write_iter+0xb9/0x154 [ 307.702090] do_iter_readv_writev+0x8b0/0xa80 [ 307.706575] ? vfs_dedupe_file_range+0x670/0x670 [ 307.711324] ? rw_copy_check_uvector+0x30d/0x3e0 [ 307.716068] ? rw_verify_area+0x118/0x360 [ 307.720214] do_iter_write+0x185/0x5f0 [ 307.724097] ? dup_iter+0x270/0x270 [ 307.727711] ? proc_cwd_link+0x1d0/0x1d0 [ 307.731762] vfs_writev+0x1f1/0x360 [ 307.735372] ? __fget_light+0x2f7/0x440 [ 307.739332] ? vfs_iter_write+0xb0/0xb0 [ 307.743290] ? fsnotify+0xbac/0x14e0 [ 307.746988] ? vfs_write+0x2f3/0x560 [ 307.750691] ? wait_for_completion+0x8d0/0x8d0 [ 307.755266] ? lock_release+0xa30/0xa30 [ 307.759230] ? fsnotify_first_mark+0x350/0x350 [ 307.763797] ? __fsnotify_parent+0xcc/0x420 [ 307.768115] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 307.773649] ? __fdget_pos+0xde/0x200 [ 307.780130] ? __fdget_raw+0x20/0x20 [ 307.783833] ? __sb_end_write+0xac/0xe0 [ 307.787801] do_writev+0x11a/0x310 [ 307.791331] ? vfs_writev+0x360/0x360 [ 307.795124] ? syscall_slow_exit_work+0x500/0x500 [ 307.799957] __x64_sys_writev+0x75/0xb0 [ 307.803932] do_syscall_64+0x1b9/0x820 [ 307.807805] ? finish_task_switch+0x1d3/0x870 [ 307.812291] ? syscall_return_slowpath+0x5e0/0x5e0 [ 307.817210] ? syscall_return_slowpath+0x31d/0x5e0 [ 307.822130] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 307.827137] ? prepare_exit_to_usermode+0x291/0x3b0 [ 307.832141] ? perf_trace_sys_enter+0xb10/0xb10 [ 307.836798] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 307.841644] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 307.846820] RIP: 0033:0x455971 [ 307.849991] Code: 75 14 b8 14 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 54 bb fb ff c3 48 83 ec 08 e8 da 2c 00 00 48 89 04 24 b8 14 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 23 2d 00 00 48 89 d0 48 83 c4 08 48 3d 01 [ 307.871002] RSP: 002b:00007ff402100ba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000014 [ 307.878704] RAX: ffffffffffffffda RBX: 000000000000004a RCX: 0000000000455971 [ 307.885969] RDX: 0000000000000001 RSI: 00007ff402100bf0 RDI: 00000000000000fc [ 307.893232] RBP: 0000000020000100 R08: 00000000000000fc R09: 0000000000000000 [ 307.900487] R10: 000000000000004a R11: 0000000000000293 R12: 0000000000000015 [ 307.907741] R13: 00000000004c20a6 R14: 00000000004d3ae0 R15: 0000000000000004 [ 307.950220] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 307.969943] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬ [ 307.990580] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 308.004327] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬ 16:57:05 executing program 5 (fault-call:7 fault-nth:5): r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:57:05 executing program 6: r0 = inotify_init1(0x0) r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x200042) ioctl$sock_bt_bnep_BNEPCONNDEL(r1, 0x400442c9, &(0x7f0000000040)={0x4}) capset(&(0x7f00000fc000)={0x19980330}, &(0x7f000047efe8)) ioctl$void(r0, 0xc0045878) 16:57:05 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f00000002c0)='./file0\x00', &(0x7f0000000080)='configfs\x00', 0x0, &(0x7f0000000040)) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) getdents(r0, &(0x7f0000000140)=""/233, 0x21e) 16:57:05 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c40000007ce00000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:57:05 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)="8c78743400", &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:57:05 executing program 7: r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_int(r0, 0x0, 0xf, &(0x7f0000d10ffc)=0x3, 0x4) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000040)={0x0, 0x3}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f00000000c0)={r1, 0x6, 0x1, 0x4c105947, 0x3, 0xce}, &(0x7f0000000100)=0x14) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='./file0\x00') setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @ipv4={[], [0xff, 0xff], @dev={0xac, 0x14}}}, @in={0x2, 0x0, @multicast1=0xe0000001}, @in={0x2, 0x0, @loopback=0x7f000001}], 0x3c) 16:57:05 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000080)='cpuset.cpus\x00', 0x2, 0x0) pwritev(r1, &(0x7f0000001480)=[{&(0x7f0000000140)="3020ef", 0x1}], 0x1, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x10000, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') ioctl$KVM_ASSIGN_DEV_IRQ(r2, 0x4040ae70, &(0x7f0000000480)={0x4, 0x3fe00000, 0x5, 0x500}) ioctl$PIO_CMAP(r2, 0x4b71, &(0x7f00000001c0)={0x2, 0x8001, 0x7, 0x10000, 0x4, 0x80000001}) sendmsg$IPVS_CMD_ZERO(r2, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x108840a}, 0xc, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="080028f6c8f5c4dbdf25100000000800040007000000080006000008000008000600079aaa053b8b0e000008000600090000000800050001000000080004000001000008000600010000000800050064270000100001000c0006006c626c6372000000"], 0x64}, 0x1, 0x0, 0x0, 0x800}, 0x1) write$FUSE_OPEN(r2, &(0x7f0000000040)={0x20, 0x0, 0x1}, 0x20) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000340)={{{@in6=@mcast2, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @loopback}}, 0x0, @in=@remote}}, &(0x7f0000000200)=0xe8) setsockopt$inet6_IPV6_PKTINFO(r2, 0x29, 0x32, &(0x7f0000000440)={@loopback={0x0, 0x1}, r4}, 0x14) 16:57:05 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x100, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r1, 0x84, 0x1c, &(0x7f0000000080), &(0x7f00000000c0)=0x4) syz_emit_ethernet(0x32, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv4={0x800, {{0x7, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}, @local={0xac, 0x14, 0x14, 0xaa}, {[@timestamp={0xffffff86, 0x8, 0x0, 0x0, 0x0, [{}]}]}}, @igmp={0x0, 0x0, 0x0, @multicast1=0xe0000001}}}}}, &(0x7f0000000000)) 16:57:05 executing program 7: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) mmap(&(0x7f00001ed000/0x4000)=nil, 0x4000, 0x0, 0x4012, r1, 0x0) connect$inet(r0, &(0x7f0000000100)={0x2, 0x0, @loopback=0x7f000001}, 0x10) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000000)={&(0x7f00001f0000/0x8000)=nil, 0x8000}, &(0x7f0000000040)=0xfc35) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000080)='hybla\x00', 0x6) 16:57:05 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:57:05 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f000070ffe3)={0xa, 0x4e20, 0x0, @ipv4={[], [0xff, 0xff], @multicast2=0xe0000002}}, 0x1c) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x5, 0x4) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x800, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000100)={0x81}) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000000300)=0xdf, 0x7, 0x2) get_mempolicy(&(0x7f00000000c0), &(0x7f00003e8000), 0x401, &(0x7f0000336000/0x3000)=nil, 0x2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = accept$inet(0xffffffffffffffff, 0x0, &(0x7f0000000000)) getsockopt$inet_mreqn(r4, 0x0, 0x24, &(0x7f0000000040)={@multicast1, @local}, &(0x7f0000000080)=0xc) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000d1c000)=0x2c, 0x4) accept4$inet6(r3, &(0x7f0000000140)={0x0, 0x0, 0x0, @loopback}, &(0x7f0000000180)=0x1c, 0x80800) bind$inet6(r3, &(0x7f0000000240)={0xa, 0x4e21, 0x0, @ipv4={[], [0xff, 0xff], @multicast2=0xe0000002}}, 0x1d7) [ 308.245100] binder: 21692:21694 BC_REQUEST_DEATH_NOTIFICATION invalid ref -838402048 [ 308.262551] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 308.272084] binder: 21692:21694 unknown command 4743953 [ 308.283048] binder: 21692:21694 ioctl c0306201 20000000 returned -22 16:57:05 executing program 4: r0 = socket(0x10, 0x3, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffff9c, 0xae41, 0x2) ioctl$KVM_GET_XCRS(r1, 0x8188aea6, &(0x7f0000000080)={0x3, 0x54bf, [{0x7, 0x0, 0x4}, {0x3f, 0x0, 0x3}, {0xfffffffffffffff7, 0x0, 0x50000000000}]}) ioctl$sock_ifreq(r0, 0x2000000089f1, &(0x7f0000000040)={'ip6tnl0\x00', @ifru_settings={0x0, 0x7fff, @fr_pvc}}) [ 308.291975] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬ [ 308.312259] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 308.326759] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬ [ 308.332512] binder: 21692:21694 BC_REQUEST_DEATH_NOTIFICATION invalid ref -838402048 16:57:05 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000cb0700000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:57:05 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='e\nt4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) [ 308.340611] binder: 21692:21694 unknown command 4743953 [ 308.351181] binder: 21692:21694 ioctl c0306201 20000000 returned -22 16:57:05 executing program 0: mkdir(&(0x7f0000ed6000)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000014ff8)='./file0\x00', &(0x7f0000014000)='ramfs\x00', 0x0, &(0x7f00006dafff)) r0 = openat(0xffffffffffffff9c, &(0x7f0000012ff8)='./file0\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_RECVSEQ(r0, 0x111, 0x2, 0x0, 0x4) symlinkat(&(0x7f000045bff8)='./file0\x00', r0, &(0x7f00000cc000)='./file0\x00') linkat(r0, &(0x7f000001b000)='./file0\x00', r0, &(0x7f0000017000)='./file1\x00', 0x0) 16:57:05 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000000, 0x4010, r0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000700)=@nat={'nat\x00', 0x19, 0x2, 0x290, [0x20000780, 0x0, 0x0, 0x200007b0, 0x20000938], 0x0, &(0x7f0000000000), &(0x7f0000000780)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x400011, 0x0, 0x0, 'ifb0\x00', 'teql0\x00', 'dummy0\x00', 'ip6gretap0\x00', @link_local={0x1, 0x80, 0xc2}, [], @link_local={0x1, 0x80, 0xc2}, [], 0xb0, 0x120, 0x158, [@owner={'owner\x00', 0x18}]}, [@snat={'snat\x00', 0x10, {{@dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}, @snat={'snat\x00', 0x10, {{@dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, @snat={'snat\x00', 0x10}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x13, 0x0, 0x0, 'bridge0\x00', 'team_slave_0\x00', 'ip6gretap0\x00', 'syzkaller1\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @random="eec374026e21", [], 0x70, 0x70, 0xa8}}, @snat={'snat\x00', 0x10, {{@random="62d1faecfd41"}}}}]}]}, 0x308) 16:57:05 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0xfdef, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:57:05 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000000)=0x3) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x7, 0x0) getsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f0000000040), &(0x7f0000000080)=0xc) [ 308.504538] binder: 21730:21737 BC_REQUEST_DEATH_NOTIFICATION invalid ref 130744320 [ 308.524354] binder: 21730:21737 unknown command 4743953 [ 308.540966] binder: 21730:21737 ioctl c0306201 20000000 returned -22 16:57:05 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") 16:57:05 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000000000004800000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:57:05 executing program 0: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0x10000400, 0x0) ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f0000000000)={'icmp6\x00'}, &(0x7f0000000140)=0x1e) syz_mount_image$jfs(&(0x7f0000000040)='jfs\x00', &(0x7f0000000080)='./bus\x00', 0x0, 0x0, &(0x7f0000000140), 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="a66be5246778b3696e74a765f37359f87acff45334d6c72fd0f552839501000000000000000000"]) [ 308.552473] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 308.567295] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬ [ 308.578614] kernel msg: ebtables bug: please report to author: Unknown flag for bitmask 16:57:05 executing program 6: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f0000000100)=0x59aa, 0x4) syz_emit_ethernet(0x437, &(0x7f0000000140)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd60c22df704011100fe800000000000000000000000000000fe8000000000000000aa00004e2004019078000087ae00ca83452b00b32def4f1142b6793bb530f9b20e90aa25d5c2b9431efd840a07c1922833b2c789aefbbaee9f63cbab38a8acfb8dba0595ecb683e74ea2bc44a7aee9c52e18ca01c06a5c354712b8b1ff75f45ba55a3487c83849023d37e037d2d3e3e842e9ba099e9ed8775d1173d8e78335aa65d58f54c1d78d4fce897cfefa24b7f268f90be76c7f4e1bfe4d84a869353e931c3732afea55697618a1318ecb657b34172b93fd59d7988d43630cf81e976a0ea01fd8b2547ab593db605c985f56664b84ed3c9f90ffb666e030c794e2d2d5070af38d83dc275da88cfe6910b2ded59f6c418af5d247237eceb14857c1d7c3ee32e729d9793040f8f4e432eb875a89fe31cbed117f0e76643797169fba3dac3f377d145ce97980ba626da7a279e698a9e040a22d63c535f0ee06adb59e9e06ad7295e6601f3a5fe9b581975993c6c775734212bccb26288d42a672c965d40e80d0e1908f04425a60a08241378ec7ff88315de073b64c5f9647e51732be34988e0948f12e6c560bedbece811bca501d4389dbfe20e4df5160cd7324c0670c7b3e8980b061e31b1c8461d6f7a63f9e9fd24326924c076e01631a0b9703a6106accfaa064075fa1f16e16c51753ce576651a38b03e3c3321b6a324e8642b2ab76618b824110c312ab12d9f65d6a980634a6a7cba8bf89e01a91259f446232476a1c490982636b78d1300befab1a2f6e8261e07336c5692db37bb7d3cebf4a942b62f2fa6cceb7e488aa02b2e52c6f82bd3792845fff41cce52e0469d14821ce11491864860c11421a92dae3152eb23106a0c679d2b1f0a9809b56abdcf893f9531508f24e64ec911fd8e8b3c8fd2291f1a7b910222c38533d4caadac9acd194be7e53549c1719bdf668887a0e19db83b5356f8f7d93cbef1ef3505dcc40d0d2a02a2745ab518979b9c3774babfe8e70ead767c7a00289b8cc6e51d1a957548270cb3f5064961a88f61b34f9442d78ae5a8551713f9afb4269d689f9adb6b4a902a637184f7f899efe9fa0ddb45cd1076c4eeeda51ca8dc20dcfc9cc5f56768073b3f4c2c9f543324a4fd0b8bc7b95e232bf85bf222394fa4336ab4007d7ad2dc85afa6eb79ad2624c4be6c674ee98fce9a51786b7cc2b5044de114d36d2690e13bcedf96590c7d5aeb8040b74c4d6a5aa38a7c1f0857522f4f968795056b9a7034dc3444784f9486b575e44dec3216d72845500e6328bd7197961e7e593ea3411001d1d47ba42d70e7af8e91246c02d7e37ff0eb60abebc37dd00315b4fbb09e77a6b5f7e8441818ebcfafecf622731f1db8a11fa2de8e30d808bedbfee104b3b1100f5094675521da07dd2a28be7e486b325a0f0e6d75116be1bbc2aa20deb64a6e4e7b824b12d009e6f1802f5a8e31559b125d71d00a5684fbde4668f5af1eb4ca04fa7c4ef4d2a194b0856e007"], &(0x7f0000001780)) recvmmsg(r0, &(0x7f0000001600)=[{{&(0x7f0000001400)=@nfc_llcp, 0x80, &(0x7f00000015c0), 0x0, &(0x7f00000037c0)=""/4096, 0x1000}}], 0x1, 0x40, &(0x7f0000001740)) 16:57:05 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)="658c743400", &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) [ 308.607376] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 308.621640] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬ 16:57:05 executing program 4: r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) timer_delete(0x0) mlockall(0x1) r1 = socket(0x5, 0x800, 0x1) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000140)={@multicast2, @multicast2, 0x0}, &(0x7f0000000200)=0xc) connect$can_bcm(r1, &(0x7f0000000240)={0x1d, r2}, 0x10) r3 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x20, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000080)={0xffffffffffffffff}, 0x13f, 0xf}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r3, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f0000000040), 0x3, {0xa, 0x4e22, 0x4, @mcast2={0xff, 0x2, [], 0x1}, 0x5}, r4}}, 0x38) [ 308.725100] binder: 21759:21768 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 308.733816] binder: 21759:21768 unknown command 4743953 [ 308.747091] binder: 21759:21768 ioctl c0306201 20000000 returned -22 [ 308.797551] jfs: Unrecognized mount option "¦kå$gx³int§eósYøzÏôS4ÖÇ/ÐõRƒ•" or missing value [ 308.841372] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 308.855287] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬ 16:57:06 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000050000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:57:06 executing program 1: r0 = socket(0x400000000010, 0x3, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$fiemap(r1, 0xc020660b, &(0x7f0000000200)=ANY=[@ANYBLOB="4000000000000000030000000000000003000000040000000300000000000000ff030000000000000100000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000cb03000000000000010000000000000000000000000000000001000000000000000400000000000000000000000000000300000000000000090000000000000006000000000000000000000000000000000000000000000001200000000000000000000000000000"]) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000140)=0x9e8e, 0x4) r2 = memfd_create(&(0x7f0000000380)="656d30766d6e657430776c616e31ea285c2600", 0x1) ioctl$TIOCLINUX6(r2, 0x541c, &(0x7f00000003c0)={0x6, 0xbc64}) getsockopt$inet6_mreq(r0, 0x29, 0x1c, &(0x7f0000000040)={@remote, 0x0}, &(0x7f00000000c0)=0x14) ioctl$sock_inet6_SIOCDIFADDR(r0, 0x8936, &(0x7f0000000100)={@local={0xfe, 0x80, [], 0xaa}, 0x2f, r3}) write(r0, &(0x7f0000000000)="2400000021002551071c0165ff00fc020200000000100f000ee1000c08000b0000000000", 0x24) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000340)={&(0x7f0000000300)='./file0\x00', 0x0, 0x8}, 0x10) 16:57:06 executing program 7: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x34000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0xfffffffffffffe30, 0x8000000000029, 0x82d, 0x0, 0x0, {0x3}, [@nested={0xc, 0x1, [@typed={0x8, 0x0, @str='\x00'}]}]}, 0x20}, 0x1}, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer\x00', 0x1, 0x0) setsockopt$RDS_CONG_MONITOR(r1, 0x114, 0x6, &(0x7f00000000c0)=0x1, 0xffffffffffffffab) syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x40, 0x20400) 16:57:06 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x2000014a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:57:06 executing program 6: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000040)={&(0x7f0000000ec0)=ANY=[@ANYBLOB="640400000000000000000000000000000000000076d9dcfd196bbdd8cee64461924dba1298ba5bab1c195bf6f5c3a67096e5a88d93ea07e43c77a58345f461ae74698b1901c32a2078bb9433cd721712ed661f46d2675fd30e42898c771f792eb4f0643ae91cedc33cb2824f760374ed56e0a8a291d60e300560de2e2f23d666c7a190015e00e5c543c988969be547f1e257705a373f7c766ab1998aeb7e23ddf3edf9a7af33689d0408cce4b8f8462d2c9680edbde689b2cca01259a7145f01f151f047c858e22165d8c837aa18f3e262633621d22a0e32e8ab7cd8bcf36e4e9878fca70f1c02bf7daf1d441eee9d7e8db9a33c6cc70f25c194e9ad01769085805db1874c5df37157b20487a7718d70520efc4ff7278164f45488c90e02781cb193c67644e24613ac1551b955ddcead3978c0f371c65c251558fa2cc4b7d87bbc61e8a51baa06"], 0x147}, 0x1}, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000000), 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil}) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x8000, 0x88) ioctl$PPPIOCGFLAGS(r3, 0x8004745a, &(0x7f0000000180)) ioctl$KVM_RUN(r2, 0xae80, 0x0) io_setup(0x3, &(0x7f00000001c0)=0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) io_pgetevents(r4, 0x8, 0x2, &(0x7f0000000200)=[{}, {}], &(0x7f0000000280)={r5, r6+10000000}, 0x0) 16:57:06 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)="659c743400", &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:57:06 executing program 4: r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000d0fff5)='/dev/audio\x00', 0x802, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000100)={0x0, 0x6}, &(0x7f0000000200)=0x8) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xae44, 0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000240)={r1, 0x80, 0xffffffffffff1f7b}, &(0x7f0000000280)=0x8) r2 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={0x73, 0x79, 0x7a, 0x3}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$setperm(0x5, r2, 0x204) fcntl$setstatus(r0, 0x4, 0x800) r3 = memfd_create(&(0x7f0000000000)='\x00', 0x2) ioctl$int_in(r3, 0x800000c0045002, &(0x7f0000000040)=0x1) read(r0, &(0x7f0000000140)=""/143, 0x8f) 16:57:06 executing program 0: syz_emit_ethernet(0xe, &(0x7f0000000200)={@empty, @empty, [], {@generic={0x88f5}}}, 0x0) r0 = getpid() ptrace$setopts(0x4206, r0, 0x40, 0x100004) [ 309.415738] binder: 21808:21815 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 309.424450] binder: 21808:21815 unknown command 4743953 [ 309.438296] binder: 21808:21815 ioctl c0306201 20000000 returned -22 16:57:06 executing program 0: r0 = socket$inet6(0xa, 0x100100080006, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet(0x2, 0x80000, 0x5) bind$inet(r1, &(0x7f0000000400)={0x2, 0x4e25}, 0x10) sendto$inet(r1, &(0x7f0000000000), 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23}, 0x10) shutdown(r1, 0x1) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000080)={0x100000001, {{0x2, 0x4e22, @multicast1=0xe0000001}}}, 0x88) r2 = dup2(r0, r1) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r2, 0x40505412, &(0x7f0000000000)={0x7, 0xffffffffffff63ca, 0x0, 0x0, 0xf}) 16:57:06 executing program 1: r0 = socket$inet6(0xa, 0x4, 0x6) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f00000002c0)={0x1, {{0xa, 0x0, 0x3, @mcast2={0xff, 0x2, [], 0x1}, 0x7}}, {{0xa, 0x0, 0x3, @remote={0xfe, 0x80, [], 0xbb}}}}, 0x608) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x440000, 0x0) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f0000000080)={0x1e, 0x0, 0xc8dc}) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000140)={0x0, {{0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}}}, {{0xa}}}, 0x108) connect$inet6(r1, &(0x7f0000000280)={0xa}, 0x1c) getsockopt$inet6_buf(r1, 0x29, 0x30, &(0x7f0000000000)=""/40, &(0x7f0000001000)=0xfffffffffffffff9) [ 309.459548] binder: 21808:21826 Acquire 1 refcount change on invalid ref 0 ret -22 16:57:06 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/bnep\x00') ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000180)={[{0x10000, 0x100000000, 0x4, 0x8000, 0x8, 0x906, 0x2, 0x10000, 0x81, 0x19e4, 0xffffffffffff8000, 0x7bd8, 0x1}, {0xa7cb, 0x9, 0x70b4, 0x0, 0x0, 0x6, 0x1000, 0x6, 0x514, 0x3, 0x6, 0x0, 0x3}, {0x2b7c, 0x7f, 0x2, 0x10001, 0x81, 0x5, 0xfffffffeffffffff, 0x81, 0x4, 0x80000000, 0x9, 0x2c6171fb, 0x5b9754a1}], 0xa7c6}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000580), 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000040)=[@textreal={0x8, &(0x7f0000000000)="ba6100ecf3af0f8aa100baf80c66b8f65b3e8466efbafc0cb000eeb800008ed00f5eae2bd90fc79f0100260f01cbdb4a0e2e0f525a00", 0x36}], 0x1, 0x0, &(0x7f00000000c0), 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000100)={0x5}) ioctl$KVM_RUN(r3, 0xae80, 0x0) openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x40000, 0x0) 16:57:06 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ex%4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:57:06 executing program 6: r0 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000000)={0x0, 0x1}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r0, 0x84, 0x5, &(0x7f0000000080)={r1, @in6={{0xa, 0x4e20, 0x1, @mcast1={0xff, 0x1, [], 0x1}, 0x6}}}, 0x84) getsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000140), &(0x7f00000001c0)=0x8) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r0, 0x84, 0x3, &(0x7f0000000180)={0x0, 0xfffffffffffffffd}, &(0x7f00000004c0)=0x19e) 16:57:06 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000740000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:57:06 executing program 7: r0 = getpid() sched_setattr(r0, &(0x7f0000000140)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a4ceaa05d9a00000000000000039b3fd4cec307e8ef3d13eb790ec9c65abaf90d229db692542e5b78f8b29e0a27800f0000000000000009fb42f376589701a4", 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000240)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(0xffffffffffffffff, 0x402c5342, &(0x7f0000000040)={0x0, 0x0, {0x0, 0x0, 0x0, 0x1, 0x100000000}}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000000300)={0x7, 0x400, 0x912, {0x0, 0x1c9c380}}) bind$nfc_llcp(0xffffffffffffffff, &(0x7f00000003c0)={0x27, 0x0, 0x1, 0x3, 0x0, 0x4, "a126c286c89bb8ef40f0f15c0390c324bf2adcf4f64ac5350000029dda6ad5d44f5fc9daad14d4cc9ca95078151d981c0a6c8a54f3af6cada8d10fb793b439", 0x5}, 0x60) socket$kcm(0xa, 0x1, 0x0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vcs\x00', 0x0, 0x0) ioctl$PPPOEIOCSFWD(r3, 0x4008b100, &(0x7f0000000480)={0x18, 0x0, {0x4, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x17}, 'veth1_to_bond\x00'}}) getsockopt$bt_BT_VOICE(r2, 0x112, 0xb, &(0x7f0000000200)=0x4, &(0x7f00000002c0)=0xffffffffffffffe1) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0x12, 0x8, 0x4, 0x1}, 0x2c) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r3, 0xc0505405, &(0x7f00000005c0)={{0x0, 0x2, 0x6, 0x0, 0xb4b3}, 0xfff, 0x6, 0xfffffffffffffffd}) modify_ldt$write2(0x11, &(0x7f0000000440)={0x1af, 0x1000, 0xffffffff, 0x0, 0x3, 0x0, 0x0, 0x1, 0x5, 0x100}, 0x10) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r4, &(0x7f0000000000)='o', &(0x7f0000000040)=""/250}, 0x18) write$P9_RRENAME(0xffffffffffffffff, &(0x7f0000000380)={0x7, 0x15, 0x1}, 0x7) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000000)=0x3) ioctl$TIOCGLCKTRMIOS(r3, 0x5456, &(0x7f0000000640)={0x6, 0xffffffff, 0x57d, 0x100, 0xfffffffffffffcd7, 0x6, 0x7f, 0x3, 0x6, 0x51546405, 0x1, 0x5}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r1, 0x4058534c, &(0x7f000035d000)) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000580)='/dev/sequencer2\x00', 0x80, 0x0) bind$nfc_llcp(r5, &(0x7f0000000500)={0x27, 0x1, 0x0, 0x6, 0xa76, 0x1f, "ce600be8fde56286f59f3b40d16f4b4fa11cc47929f17d7fe054a5865cb3b77bffa5f112d3c6d77f25f841f3761fe94d60f467729a3e54b37f693d9aa5e035", 0x23}, 0x60) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r3, 0x84, 0x13, &(0x7f00000004c0)=0x6, 0x4) 16:57:06 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) close(r0) r1 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x8, 0x24800) readlinkat(r1, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)=""/167, 0xa7) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000289fa8)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000001f3a)="ad56b6c5820faeb995298992ea54c7beef9f5d56534c90c2", 0x18) r3 = accept$alg(r2, 0x0, 0x0) io_setup(0x100000001, &(0x7f0000e4b000)=0x0) sendmsg$alg(r3, &(0x7f00000013c0)={0x0, 0x0, &(0x7f0000001300), 0x0, &(0x7f00000004c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) io_submit(r4, 0x1, &(0x7f0000bd9fe0)=[&(0x7f0000617fc0)={0x0, 0x0, 0x0, 0x0, 0x0, r3, &(0x7f0000000500)="00a65418709f8000013749aeb96daa3d", 0x10}]) 16:57:06 executing program 6: mkdir(&(0x7f0000000000)='./control\x00', 0x0) r0 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x4, 0x2000) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r0, 0x111, 0x3, 0x0, 0x4) r1 = creat(&(0x7f0000000080)='./control/file0\x00', 0x0) fallocate(r1, 0x10, 0x4, 0x4) [ 309.676233] binder: 21862:21864 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 309.685046] binder: 21862:21864 unknown command 4743953 16:57:07 executing program 0: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000440)='/dev/ppp\x00', 0x204180, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x7704, 0x0) acct(&(0x7f0000000740)='\x00') r1 = socket$unix(0x1, 0x5, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000140)={{{@in=@loopback, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @loopback}}, 0x0, @in6=@mcast2}}, &(0x7f0000000240)=0xe8) lstat(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='fuse\x00', 0x2000, &(0x7f0000000340)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions='default_permissions', 0x2c}, {@allow_other='allow_other', 0x2c}, {@max_read={'max_read', 0x3d, 0x8001}, 0x2c}, {@default_permissions='default_permissions', 0x2c}]}}) sendto$unix(r2, &(0x7f0000000000)="7115583bc3c6b5d0fa90972cd107ee6dfdff84b491d60fc5b05fb9a7035913a9f7c0597ea60ce6bd5c9908840b24c8cdb0484bb458a2c4da4ac06de430c9ff6c874d013fc55a2dc95937b3af1616c512bf74536df40fcd3a0f59391ae8a8f0ed68580c0228a23eb4d4fad25762154001b9a53916be501131dc93b1fc09332e93ca464920612af93d506868248c5557602a3506", 0x93, 0x4800, 0x0, 0x0) 16:57:07 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x7ffff000, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:57:07 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)="65788c3400", &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) [ 309.743076] binder: 21862:21864 ioctl c0306201 20000000 returned -22 16:57:07 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000006000000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:57:07 executing program 4: write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000c00)=ANY=[@ANYBLOB="000000000000000000000000000000000000000000000000000000000000a0499a68689181f3233b00"], 0x29) r0 = accept(0xffffffffffffffff, &(0x7f00000000c0)=@ipx, &(0x7f0000000000)=0x80) ioctl$KVM_IRQ_LINE(r0, 0x4008ae61, &(0x7f0000000140)={0xfffffffffffffffb, 0x100000001}) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='oom_score_adj\x00') write$cgroup_int(r1, &(0x7f00000000c0)=0x200000b3c0, 0x12) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup2(r3, r3) sendmsg$netlink(r4, &(0x7f0000028fc8)={0x0, 0x0, &(0x7f0000019000)=[{&(0x7f00000001c0)=ANY=[@ANYRES64], 0x1}], 0x1, &(0x7f0000000040)=[@rights={0x18, 0x1, 0x1, [r2]}], 0x18}, 0x0) recvmmsg(r2, &(0x7f0000000b80)=[{{&(0x7f0000000200)=@l2, 0x80, &(0x7f00000005c0), 0x0, &(0x7f0000000600)=""/84, 0x54}}, {{&(0x7f0000000680)=@l2, 0x80, &(0x7f0000000a40), 0x0, &(0x7f0000000ac0)=""/147, 0x93}}], 0x4000000000002ce, 0x62, 0x0) 16:57:07 executing program 1: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = dup(0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffff9c, 0x84, 0x14, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f00000000c0)={0xff, 0x4, 0x0, 0xc4ef, r1}, 0x10) r2 = epoll_create(0x20040000000401) fremovexattr(r2, &(0x7f0000000000)=@random={'os2.', '\x00'}) 16:57:07 executing program 6: r0 = socket$inet6(0xa, 0x2000000802, 0x0) r1 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x20000000000000, 0x80) mmap$xdp(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x10, r1, 0x17ffffffd) r2 = socket$inet6(0xa, 0x6, 0x0) ioctl(r2, 0x8912, &(0x7f0000000180)="025cc83d6d345f8f762070") ioctl$KVM_GET_REG_LIST(r1, 0xc008aeb0, &(0x7f00000000c0)={0x7, [0x3ff, 0x1, 0x13, 0x6, 0x1, 0x1, 0x998b]}) writev(r2, &(0x7f0000000300)=[{&(0x7f0000000100)="1ef0c2cb018192216a62a1280e077a27496e16d4ba1c1f7b27b34cc7f51d7d7176788feaafd2d667e27adbd463d97d", 0x2f}, {&(0x7f0000000200)="479cfc5b2ed190ffb89388933eeed5df836ef4998720744ddffb05769362329f0eadf34b5a43911099bb12d81cf7a42246f4bfffcde12c72ac372cc9a2b0ded39fa12a083617b762254869619c96ba2ee26be5ddaccc5cd0cded44b98f8854b1c259f869b034b27e71c6997efdfe70565f71e81f51a660c7fd9227ad23fa47ab2dbd323d82b30a8fc0686b697a59374bf33c6ef37c0a3e36cfb07b1035e82df68bbe7a8092535be521b2f2487da9bdf60b27fc686f8014fe30177a9eca85018f6cfffe36c61e", 0xc6}, {&(0x7f0000000140)="29797854178dc22ffa6778260847b17adaabd82d8d60dd82ed47291ca40c95052e95be2b1ebdecb07a2828b923a34c4e9b14b5b066", 0x35}], 0x3) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000f68000)={@loopback={0x0, 0x1}, 0x800, 0x0, 0xff, 0x1}, 0x20) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000040)={@loopback={0x0, 0x1}, 0x800, 0x40000000000001}, 0x20) 16:57:07 executing program 0: r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000000180)={0x2, 0x0, @loopback=0x7f000001}, 0x10) socket$inet6(0xa, 0x0, 0x9) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x20000, 0x0) write$FUSE_OPEN(r1, &(0x7f0000000040)={0x20, 0x0, 0x4, {0x0, 0x3}}, 0x20) sendmsg$rds(r0, &(0x7f00001c3000)={&(0x7f0000014000)={0x2, 0x0, @multicast1=0xe0000001}, 0x10, &(0x7f0000004000), 0x0, &(0x7f0000003b80)=[@rdma_args={0x48, 0x114, 0x1, {{}, {&(0x7f0000001840)=""/18, 0x12}, &(0x7f0000003b00)}}], 0x48}, 0x0) 16:57:07 executing program 4: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x1, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000040)=0x7, 0x2) futex(&(0x7f00000000c0), 0x1000000000009, 0x0, &(0x7f0000586ff8)={0x77359400}, &(0x7f00000acffd), 0xfffffffffffffffc) socket$nl_route(0x10, 0x3, 0x0) socket(0x1a, 0x800, 0x3) 16:57:07 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ex\n4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) [ 309.940216] binder: 21898:21904 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1610612736 [ 309.958110] binder: 21898:21904 unknown command 4743953 [ 309.964807] binder: 21898:21904 ioctl c0306201 20000000 returned -22 16:57:07 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x2) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000300)={0x53, 0xfffffffbbfffffff, 0x6, 0x0, @buffer={0x0, 0xe9, &(0x7f0000000080)=""/233}, &(0x7f00000002c0)="9b247f9c1793", &(0x7f0000000240)=""/126, 0x0, 0x0, 0x0, &(0x7f0000000480)}) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x47) getsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, &(0x7f0000000180)=0x2, &(0x7f00000001c0)=0x2) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x5c832, 0xffffffffffffffff, 0x0) read(r0, &(0x7f0000000380)=""/42, 0xf0) 16:57:07 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000000000000700000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:57:07 executing program 6: r0 = inotify_init1(0x0) fcntl$setown(r0, 0x8, 0xffffffffffffffff) fcntl$getownex(r0, 0x10, &(0x7f0000000000)={0x0, 0x0}) ptrace$setopts(0x4206, r1, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = accept4(r2, &(0x7f0000000040)=@xdp, &(0x7f00000000c0)=0x80, 0x80800) getsockopt$inet_udp_int(r3, 0x11, 0x22876c0b49494aea, &(0x7f0000000100), &(0x7f0000000140)=0x4) wait4(r1, 0x0, 0x1, 0x0) [ 310.141404] binder: 21934:21943 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 310.150101] binder: 21934:21943 unknown command 4743953 [ 310.181801] binder: 21934:21943 ioctl c0306201 20000000 returned -22 16:57:08 executing program 7: clone(0x200, &(0x7f0000fbf000), &(0x7f0000744000), &(0x7f0000f8b000), &(0x7f0000804000)) mknod(&(0x7f0000000000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000080)='./file0\x00', &(0x7f0000000280), &(0x7f00000001c0)) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='attr/fscreate\x00') writev(r0, &(0x7f0000000340)=[{&(0x7f00000002c0)="8e", 0x1}], 0x1) getsockopt$inet6_buf(r0, 0x29, 0x0, &(0x7f00000000c0)=""/13, &(0x7f0000000180)=0xfffffe8b) write$P9_RREMOVE(r0, &(0x7f0000000280)={0x7, 0x7b, 0x2}, 0x7) execve(&(0x7f0000000140)='./file0\x00', &(0x7f0000000000), &(0x7f0000000200)) creat(&(0x7f0000000040)='./file0\x00', 0x0) 16:57:08 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) close(r0) 16:57:08 executing program 1: setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000080)="00000000fa9131bdfb2d6388fd21c6498b4ccf60442f6e17ef62ae383e15dc82ed0504e666327e944783770881024e316786faad9f384e8b6f93c1f080affe0bb3f4dd34c299218004477fe4b2fb0254d3e9bba049cc3336", 0x58) ioctl$sock_inet_SIOCGIFBRDADDR(0xffffffffffffffff, 0x8919, &(0x7f0000000040)={'rose0\x00', {0x2, 0x4e22, @loopback=0x7f000001}}) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x80, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000180)=@assoc_value, &(0x7f00000001c0)=0x8) r1 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x7, 0x80000) ioctl$BLKIOOPT(r1, 0x1279, &(0x7f0000000100)) 16:57:08 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext\n\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:57:08 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000000000000400000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:57:08 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0xfffffffffffffdef, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:57:08 executing program 6: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x9, 0x5, 0x2, 0xfffffffffffffffd, 0x20, 0xffffffffffffffff, 0x8}, 0x2c) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000040)="c86b2fc4123d8ff188ff18d2632190ac917caa1bc9424b2e2f0a63a45049057b78cda4c80a44213caf982430a853e415f3e7987c297f14dfdf1c6897b60f3850be7f7d8f8c2ea93b20c2b63a8a9988f5d5b0a41039964b82c6e5a1c500b3563c57d42beb5707ad0d4ccdd633165e2b41e902aa9dedee341f52224ea1f469404443b2d8dfd264f64cf88b321e8122ab8e50f800530fb957953b48ae936bfbb4e2ab503e289ad5c4d31aa92117121e6aa84c71e24f55eac15349613d05a3d8642d391a80d35489589e243fa717d439b0a5bdc698dc5dbae45c902083bdf345f27e1802224e02621ec0d9fbd8e35abfbeb8af5a801858e85deee0a3", 0xfa}, {&(0x7f0000000140)="5b59392221f0", 0x6}], 0x2) r1 = dup3(r0, r0, 0x80000) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r1, 0x40bc5311, &(0x7f00000001c0)={0xffffffffffffffdd, 0x1, 'client0\x00', 0xffffffff80000000, "210db278573dd86a", "c8aa3f9ea654dcbd45187c029675268ca2aa554676b9012610289783f165c36a", 0x7, 0x4}) readv(r0, &(0x7f0000000380)=[{&(0x7f0000000280)=""/251, 0xfb}], 0x1) pwrite64(r0, &(0x7f00000003c0)="b0a85186a3", 0x5, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ppp\x00', 0x1, 0x0) symlinkat(&(0x7f0000000440)='./file0\x00', r2, &(0x7f0000000480)='./file0\x00') ioctl$TIOCSCTTY(r0, 0x540e, 0x3) r3 = semget(0x0, 0x3, 0x0) semctl$IPC_STAT(r3, 0x0, 0x2, &(0x7f00000004c0)=""/92) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r1, 0x800442d2, &(0x7f0000000580)={0x1, &(0x7f0000000540)=[{0x0, 0x0, 0x0, @local}]}) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0x40a85323, &(0x7f00000005c0)={{0x401, 0x270}, 'port1\x00', 0x80, 0x40004, 0x1bc2, 0x9, 0x4, 0x8, 0x0, 0x0, 0x4, 0xffff}) syz_mount_image$hfsplus(&(0x7f0000000680)='hfsplus\x00', &(0x7f00000006c0)='./file0\x00', 0x2701, 0x6, &(0x7f0000000b00)=[{&(0x7f0000000700)="42c6430100ffcc53bddeef3f4476a5499f5acbb5bf7ffd8671bc0548898f1cbc4cef497f521371bbbb39d7f468e4852352e89dd628358de8cfa728bcd93fc13c37250cb782d41d6259b8a2a98d0635dbcb0e5e833223fcd3bc37c0b8d0b38b2f04a6d752dea57eb9d0f22fcae6e82167882892c702d36e42bb0316c250bd045c0f134da1d0a828f980b2edccb4c6233f9ae33fcf2281dc86c558d7f1c330caccc1de494a46f997ce2089d0d02e36317f00ae60d4ffe4f9ac66c3219a02080cd87582f485d0dc255ec7446758c1e6dd0abea0da7efbc3e65cc8380a12c2ccf3e6a198f67da3ae579c2b0448055f686a07e560afbfc9f929a71bdb3b", 0xfb, 0xfffffffffffffe01}, {&(0x7f0000000800)="f798df38f4371a47d13f63dda564dd56206ba818c59f2d442a06caefabdc5f6e8e24ac36a0f29059d2e12d40fbf4061eb803b82f82541634ae4c401643d6a5901b1ab3a5eaf2f52a1ef8ff9b3710086776408dcdbcdad1fb91eaf5157e5815badd6b461dc35010eaea73834661e03438676b1b5bfc18f657b6a100d937253cc158f6f4198ccb36c5ca81df110e886a8b7a3a21f051495c2c6a5b1a00fce0fcbbd2b9f7031368032d383ae9ccf2d106e0cd375e5a39d83229000ebf413f638fa296b02452a760d193702f0ebd81c6099731508e328388b40c3f51e79c19e66f77458ea1a6b7917d26fdaf72699835cfb7c3b34f", 0xf3, 0x6}, {&(0x7f0000000900)="bea6622d2fc50cc3a0af47b87c47f8dadc19ebb27356a4dbfd8af8b4f5f053178e312d830d0175fa92313585e974c518bd8415443417cd81e79dd89fd3ed0278e03b5ad1399b54b910269317c26547a9f6f3cca1cbd2898da8bfac9797ed71bae1f442617b11096642944aabab1a157137349470490ed53adaf2b7dac99899790730cf35ab5f874bd827d794d40c5f3b3cc452c2d4fb64f6e5dec4c0b4870f058bbd17371b3fed60979c7ba9f3f2ea339f36e50f5b632edecf8cb43ad420d3e0c36aee72ca24e5864cf12f4c68a2191121764769d22b927604f2e055be222251748b1ed1cf68d940594a0ee5715469d26390827f58b691f9221467", 0xfb, 0x80000000}, {&(0x7f0000000a00)="48e17f16b05a8170ecad40330d2c3da6118d03c4f1bd4d160ada164a01e6b48e6ea6f82680005c523c1b4eb139f499f0cd5d8b", 0x33, 0x5}, {&(0x7f0000000a40)="90fc36920ba325ae3bb2ba7cd883c9dde8d84d6ae3e821ba81f9644ee2b7416f52112fd1b37ae206bfbeca216ce1b3e3b2dfbeb11ebe99a73fd131740e5b59ead9f0441c3c26df71d0b89cfae61093aa6a226a7aa6482bc33cc9188a0408a92cab09bbab7c5207296765167fa98b", 0x6e, 0x3}, {&(0x7f0000000ac0)="0426f5274082b62e", 0x8, 0x6}], 0x400, &(0x7f0000000bc0)={[{@type={'type', 0x3d, "16409a24"}, 0x2c}, {@nobarrier='nobarrier', 0x2c}, {@creator={'creator', 0x3d, "640acbcf"}, 0x2c}]}) ioctl$KVM_SET_VAPIC_ADDR(r1, 0x4008ae93, &(0x7f0000000c00)) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000e80)={0x2, 0x1, &(0x7f0000000c40)=""/163, &(0x7f0000000d00)=""/134, &(0x7f0000000dc0)=""/166}) msync(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1) ioctl$RNDADDENTROPY(r2, 0x40085203, &(0x7f0000000ec0)={0x7, 0xcf, "01bcbb7b41946d044ec14d4d0eb5ba481ed64141cc6e7d0aa0309974160ff476dc6e87790fa43654783e2a770f33e0daf1288e032190b2d63cd5d18bdb87a68bebb6f9e604743c5b7ef2766ecb3b6039e1bfd30b11461550808ebd05fd2a70beb64beb0cea9f2c565d6399c8ac6496a9d306f74de24b42a6a8b4ccc4a544e0435e9f0801a0526b14889d3a8397bfb066976d9b4bb5001a655e908228b1971f6b92f2b2b29f48f3d3fbf1f3bf3e552260a4279988fc4788713849e8f9c23710046f9160bb08bd25fe4cfa501b8cdcc7"}) lgetxattr(&(0x7f0000000fc0)='./file0\x00', &(0x7f0000001000)=@random={'system.', '.%(wlan0:self\x00'}, &(0x7f0000001040)=""/52, 0x34) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000001080), &(0x7f00000010c0)=0x4) ioctl$RNDADDENTROPY(r1, 0x40085203, &(0x7f0000001100)={0x1, 0x1000, "5efad373e9c7aaf158d7a560fcefd59d7fe62f0738283348993f3e0223ea38e763b714d84f3533a69e67f664b298febffb042d7505bd517e84c11e18512f5afbf294a4100a8ccecef3a04285350e2c0ec16137bc1dda94a2d0f03b270d7915cc0049b757a35345807a5214354bd4014cd2c1780ed34e84e49a24fea1b1f8853febe7d218a031a5eeacb3a0b3703f953214a5c600a6c643191207619c993ee4d87e34d6bb9c5ec3de65e0f206717cc1c3652c824fb291c6135fa0f239d54063d8b74695eec7426abdf7541c21e9f5b4ad9de2e82ff5b6e9f4372b1f87323b085fde5aa2f67b4047b9536c20a6e7ca0f4e77e7868d25e87f8b33f52fe69511daa38d9f576ffe379c57a8de0a336f7dcf00fb14af1198ff0844164527aaabbafa1c0189b2feaf3ab484ea412c8545e242f3f85f65807fe2b9bc11bce5a3f03685a2f1829ed4b2609f66e1cf5d765af0ee1fe85622078c1d1519bf18c81286f2caa74f56cf3c0bdf27e2b186ab8346e3bb56986fc6c2f8d3edb9968a468a12b95b7a5c77f7cd861179fcf3cd04d993da8789617c99a855750230c9335a2b9e27397b3689e2217e993cb1e54e679a7e5812f0e9c449273b2a1cc8dc9050b0bdbc68cead0558d8ad162b8ec0c4369b0cdb37b1bb03893b967c0f2f633c34608089feb54eef4dfdb793f16d8cf6dc851e9fd75414de7508550cc26f6aea8b8c38da7cc2edc0db598917dc3eca89178f8abdab629fd527c8a84720951ae0ee0ea301de8a09b839ad5e924f23d0f30c404790f20c9434c9282dde8918fb647eeedae8ddd8725d1de8e88b6b2322419b18d78bc0fd04394054bbdb1b1816bfc3ecc186c24d1abbc90bce360f6df06479c4015c8f498e7f5e07653f27c121ef88ce6d7fcb1e0eac4715f82b7a8b218deff9231179577f8aecfd8ad790fdbe12e65609eed5791d058ca3352343f6d00cb98f3acb35fbdc6e45fffc123c0da22075751493241239a11cec7b80aa971af0c59c85bf093a8f26132c2631fac6b2bf66e894921b22988e1b296d3b6abce203f0a5a015bb125b14eff3c3fbad0374ed9375c403785688eb9a116718eb274f5df1fd08fa9ee2ee700f8eeb4f2a3cdfbcc2edcfee9562a934c3ef0b130518ea3602d80457ae7c6cf2e82f644787864ef07a3e7c50efd067372b44697497dc841c0a66b8ea3654bff8ea42d167169e1852273029b22e4e9d5ba93e8b5833c4f721f2336a9087bd61c9cd610ad67b26b2170f247ffc7890d2407e0e4219c312034d75cdb0b072c47d742dc7f7b2e78b470630df30a8b46ad91e5e9e5d2a3d72cc1b894046f80dbdd03f0d19c14a3c030e981e408104738452abab51df23f5ed934da4bc58cfe9bd81ff6314c0683a4021617bd855e13a65b187f4993d9f2dee93b799fac21b1b7d9f3236719e706c33ef3c2f8eccd990f29b3d366e8d00ac9351dc8711ced7f3611bd113d63b83e0c8b7a00eafb971c84ce84748bda517deeb001658cec806a0516632705a6b1a4268551e978362020cfc6bbaef9fc255b5147d2b7699dd53a404afdc3f80512be402c70fa8424135ac24149b52745aada6e02730e1b2edd414cd23c4235186acee4da5e62f9534481b90769b762cf45af94c19be5756b571080cc59b69abeccb32be76823b4fb58d88e4219b5d165263d50acce21e086af1a6b8a41a721a7a7943543190074ac709462779994adb50d1b72c68885d209c114e0103b0b3109006e516dd1b1b113b24eef86ac9145c403af45bce115b9fe9ce38b9f09e847f71ce9deb01790da2e8989539822bd66b94e2663c3fa9cc695902d56d60e13d3280c90e4eb3c7519ca4f3e92d0337be8e56e61bfbb97d3c936fc3ac5772fb736fee9fdd91aa67ffed61e42938df825cdd96d5d6256c45c437981d1468115baeb29a70592a0111a13a9c55a92cf049eda6983d53345fb90db13cdf189a94242a3ec385e9859de91db0a18337be02e6b42f648cc4d884a8be34ece3c588825ecadb747ce1483c93fcd3a6a4417044f0e0d22084a8b6db81e8f43aece248dd0bdd2e7e6801ee5cf41348ba983f43144d58fd72ae3d3a7523c471da4ec6a8f147fb55b2cbf7694477addc1c15a2204181bff52a5319e86453e9cbc2ade86c6d98900c0e28c53c62fff08c479d3912d84e3de2a9af406a068aba549bf6556578904597b6d1e675d55ee94e6ecd8727190c321c5675b6a29c5883aa6b8eb06b2c674b7ef791263d5c34559275a9295edf6795b10f1c8e71484361c2087d61c86a16f3fb4e0209c6619bd49111290fb0a647c93bb34703aa0689226f1190b7c4fe031f292a79050bd46d69c622052b00e2dce1cf55a270ea9cf6b8e6b741d49df172411f49a7f51af61c2b2036f9df304271fe8d3029905f74b22dda274ba8f04d837132fe05866fc683c42a2ae610f6e4308038dc2549291f3ea6011cce666208379fdfaa60fce320a5b8f8baf6df3c436873f0b0ab1710279bce624e252267bcaa2dabc05c12906aa0a39f594b920907caaee36fe333921f81075a7dee56dd2c4a69b85bec0471fa0ed4815de21ecfffc36b95686dfd4efd337e855fbcce8ad8cc1dc3233b8c94bdb76abece59871a3541c38cb8ebedf54eb8d33f60ae6319fd64e6067fac088feb56e64a5a9db6e4f4418288deb43f496f2e052e93e6977092e47a4a04c196b7725825c762fbbdbafcbd91760f4574be891101d88acf5d9efc554bd06f33331a529be31acbe079b41f4d50d7f51fcc615fbb53c43e4b62f08cf02499fe8a53927015edca30d07798393b2a096f5139e628d33401094380a51b0e6f44bdc5aae7133def4785538d6849bd66046c6e38808bdfd9a5db7f7e619b0e43e76c91f453a4246f75068f9566589d7d4e306813ee115394dd8b3b936f15e5f82d4b71d28f8632c9c1f3bc326a2b8548db6699277a95bf7fafd0248a0f16fa191d615fd641c6aa109a9a01dd0f0c97c248173c23f0e7a7832c6cb6c6f4b2c64dd1b47e2750f43e441bdc9ac03b683a4690b6c0170f19a5ab8241b0032e7439d83859c42a14a7597c74fb1a0eb07cc400d0c0ba63320ff50291561367ea21483b88073683d1f3dea37681b32d3c0692065bedfda47c5eb45dec972ca9e4ca13489ed9fee62efd344c65ed4dfc0838552bd8e001345a1c9384ff5ae795769c59645583745d0e53929a570635446281fcddc4e62db047decc24a68859f17edb8adcb0ab61892f9cb700109ebbb0c1d3999b7411fdf06806d1fe96c0af7fe2e9c9cf7b53b6d8da71d57dbfc39b3277a0951dd452959bf2ce2d34e6905a1f3ba1cb65f23c627c47204eb83aa5af61ce7789ebc9c97870fedd940c5ebfbd6999ba3a4383a42acd8e908a46dc77febfcdbe61a9bdb5e71047d1fb99c20a3278ed85d1f3a17dba32111dee2708645f7f02f2e0cf41a55613274825dfdc30c9a5e67d9a88240b4c4f21ea79b4d1ebde2d9c2be4d4f474f52cd18ac71d0424e5cd2aa0ec988607f58d8fd245feb88a4d119d254c9b27531847565c0362df4c85be8eecb2a02f9a77b9a7b2425be7fa18a292332dcf749af733e61f556a252663d440b8cdcd4cf7194802e2c2e6ef87020e11cb2c61d1d077c3e8eaf07b3e5b00ab3db1f8329afe6590617df39b2f673847b91d14d33fcc8d9c01ada6d7870244404d860fd9da9afd7dae2fbd75b93a1dc268f808cfd16175e30827f9f393ba2411fcdcbb71585abdcc15224c0a13ed5523c137378973ecb818dee12568d1170b6ed5b2b78ff52e8777977a9bbc8d7f3d9ca372cead5a3ba434c7d19d9df72def6f95fd0bfd30a17c98dad258c079de0dd9b27d3fe29f612f3d36c96da62088b1d2e06379b588729b452010cfe2fa9ee5203565e67d4e461e04a7347dc840688e7c85d6fe84f4eb7e2deeafd9775df95a363a53ed8260eafeaac89db5d3b2fa6203c4da6fb5d7ab1ec926c5c3cbecd854a0dad2be28ba4a9c95a7b640af7e1c30e7d82414cb3bd0b6a6c11d3656698c5809e393ddd1139b33bfacf502f2f617fcafe413826956b42a9bf09348feddbc46a7c24a63d4bf084a445b7b5364fe132b9b9ef3d5b87b32eaa580c0270a924f6ae5e495782f83554b26d3e621e3cac26d370d8b07b2dc2ac49289b45fe52b6d4a830e6acf8ce18bc97a45c5ae814de79e783e6ed7c1eabdb7ec541589d843a68ebde71fe8d4c7a9127a766fdfb6803747a794ecc1c386c92ebecec10f491d1f487e91420c366b6f83e2171baa91ed2d17d2a6075988fa09783022955c862ca0e7906f66a6402a4bffa676148eb5a7279f41b3d5db128eac3a2094425187bf9027ff2fa9ae632acdd7ef53ede3c7f0d1a67f41c76b4530b0d72b68edb5f839cc2dce0d25bf3b1f54170c02c47f16a2ee4ae6f695330c6b8a55da71ef50e9ed0fb98ee211e3f6044de710bb45fe6d254191875f9017b0cbd9504d271e6243eb01213c67cb54a789f2f6d390713b666693fba796ddc7122de8e5ada4c682504a030a2755215e467f6ac7c640308be6e770ae97091d44aa27df0878a9033b67bb6aaa0771473ea9225fa0c0134e091d9267b78a99a290402f8575279cc379f3a4d55a09decc7634af3fe10da0f32ae161288d1d3049d10264f2e71b5cb3d837102ac9ba4575b4b3c39e3d4001c03353b31b0f7c8e7a63d6e2a6e4d978ced50894b50151bff3b77a73beea70e901e8720f70630862a85f37d5c513f70022d0dd66d5f2dbe42844ba8b4fb57f60e5b5f560c748b3a50ca9b3279d8206bcdc3cdd10fd248539e41893f769341e7727c302e34f127e6951c7bba122170ed67e11eb4679e16c5a1eb9d2fa676ef80367cde05f1ce8f9607b9690773f99b7f1c7c7a5f2be9dde3a73aedaae60a792a2a6b8796747b2ee3ad78ab4faaa05b759892e69a32e1771e16cf103b2712364f4fd67397ae70549fb4600b9dc0d0520803b599c6cfd4c9c1f11d213967bab480ebea644b6120d6794e57f535e73d16bc1ffd9554eabab9c8800d6b38d2e6d2ce00b34251fafa308291d369e707b8a92568b9876fa41d8f69c774f2b7ff4205a485884563fdb5c963e80b63e44a17cb832f84a069157eef44b6fdfcaa758a82a13aab4be0b7da799e23db03fc40480d715bc6ce1954758b8194b4dd3ff2743f81b4a92e405af3ed85a14f6a7403189c860c9ae82930b4e412717b5f18879116afbb94602bdecf82334c563e982d293d6e5b96007ad8ceaf61e20b7b5e48e4c9c7c70dd6a943da493746e801965033b1981f38fa68821d695001ecd8e02e2bbc0fd58f654ab34b57701f91dbddd03be4b825640523b9c236d1450ed89acd2e19591bca2bf2f67a5e37ae723fffb7c294f0f900ef147c03a6288f32cfebd2539129c4de5c1c6fd42b5b9ccaafd9296a7162f1c72f090c9b7155067c659fe103c9ee15fa82bdeb2cb72992cb87fb0f51bbd1dc24b292c99e43b62b4b4667d26ae1cac5ddaac2f1f751f3e1d7243bd8e7305ddece1c5e9d538ed0e97f174dd02448298481020fda5c4e6327d212f7ae300bcc6f05226990700fdcc118f6a652aa272c9493bbef2f614b1ea864f8ab79b70118dcc97acd7afc8dd4b7980ef393752f3bc9aafc1cef6408f02c8d3de5366940878b84eee67b8c2de788d0278839921b34045f672f59a9f3fe7c7d96fb119f0913f0f433dce8da10f95bacb18254bfbc2b350379f6f239584e8abe065c94589d25c5961957dcc46df5728c1d260a30ecbf5c8097638faaf753a13a727a9c2dd939bcab788efdd6e2422"}) ioctl$EVIOCGLED(r2, 0x80404519, &(0x7f0000002140)=""/19) getsockopt$inet6_mreq(r2, 0x29, 0x1f, &(0x7f0000002d40)={@empty, 0x0}, &(0x7f0000002d80)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000002dc0)={'team0\x00', r4}) r5 = shmget(0x3, 0xc000, 0x200, &(0x7f0000ff4000/0xc000)=nil) shmctl$IPC_STAT(r5, 0x2, &(0x7f0000002e00)=""/68) mknodat(r2, &(0x7f0000002e80)='./file0\x00', 0x4, 0x9) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) acct(&(0x7f0000002ec0)='./file0\x00') ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f0000002f00)={0x3, r1}) [ 310.811990] binder: 21964:21970 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 310.820716] binder: 21964:21970 unknown command 4743953 [ 310.826159] binder: 21964:21970 ioctl c0306201 20000000 returned -22 [ 310.849246] binder: 21964:21970 BC_REQUEST_DEATH_NOTIFICATION death notification already set 16:57:08 executing program 1: perf_event_open(&(0x7f0000000100)={0x2000000005, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0x8, &(0x7f0000000180), &(0x7f0000000040)=0xffffffa7) 16:57:08 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0xfffffffffffffffd, 0x10031, r0, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0x4, 0x40000) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x40082406, &(0x7f0000000100)="6c6f2e5d7365637572697479295d402c4075736572003d976cd441775ca9e11eb72191e4ee9f213b81b77e36f29ec3fa1cac2f2d6d860096663017514a6833ad6aa7e2b461230a90d323088e513b487c60f6727f3f36168e1537a9d9ea558eb352fd8061904d5abbfe3d2e98e64c1b079e8047cc1338fa97b5dcc09a112ae7ae75e3fd25c2ca2bec00d79f4851926d8e5a2638c7c77b311dc80bb033f6fd18776a9d996a8166ff4c35b97b2c3dc24a133f24d9dc911e1d419ec0412c7d521be487a3ce7721580ac3819a1005e8776ad4e9feb3f5") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f0000000000)={&(0x7f0000ff9000/0x4000)=nil, 0x4000}, &(0x7f0000000040)=0x10) 16:57:08 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000020000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 310.857183] EXT4-fs error: 9 callbacks suppressed [ 310.857196] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 310.858040] binder: 21964:21970 unknown command 4743953 [ 310.882666] EXT4-fs: 9 callbacks suppressed [ 310.882677] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue [ 310.889073] binder: 21964:21970 ioctl c0306201 20000000 returned -22 [ 310.903337] hfsplus: unable to find HFS+ superblock 16:57:08 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x140, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 310.921999] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 310.941591] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue [ 310.966462] hfsplus: unable to find HFS+ superblock 16:57:08 executing program 4: socket$nl_xfrm(0xa, 0x3, 0x87) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0xf401, 0x1f4, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)={0x0, 0x0, [0x0, 0x0, 0xffffffffffffbffc, 0x800000000000000]}) 16:57:08 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext%\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:57:08 executing program 6: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$rds(0x15, 0x5, 0x0) ioctl$sock_ifreq(r0, 0x89f4, &(0x7f0000000040)={'sit0\x00', @ifru_mtu}) mlock(&(0x7f0000ffa000/0x4000)=nil, 0x4000) mlock(&(0x7f0000ffb000/0x3000)=nil, 0x3000) 16:57:08 executing program 0: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000000040)=0x80000000040, 0x4) socket$xdp(0x2c, 0x3, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x0) 16:57:08 executing program 1: r0 = mq_open(&(0x7f00005a1ffb)='eth0\x00', 0x0, 0x2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x1, 0xa}) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r1 = syz_open_dev$sndpcmc(&(0x7f0000000340)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) mount$9p_fd(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)='9p\x00', 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r0, @ANYBLOB=',h']) [ 311.081240] binder: 22007:22014 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 311.089965] binder: 22007:22014 unknown command 4743953 [ 311.095467] binder: 22007:22014 ioctl c0306201 20000000 returned -22 [ 311.107094] binder: 22007:22014 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 311.115805] binder: 22007:22014 unknown command 4743953 [ 311.124512] binder: 22007:22014 ioctl c0306201 20000000 returned -22 [ 311.196021] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 311.210301] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue [ 311.246080] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 311.261454] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue [ 311.283126] 9pnet: Insufficient options for proto=fd 16:57:09 executing program 7: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000140)='/dev/snd/seq\x00', 0x0, 0x0) r1 = memfd_create(&(0x7f0000000100)='\'', 0x0) ioctl$RNDGETENTCNT(r1, 0x80045200, &(0x7f0000000280)) r2 = syz_open_dev$sndseq(&(0x7f00000000c0)='/dev/snd/seq\x00', 0x0, 0x101000) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f00000002c0)={0x10000, 0xff, 0xff, 'queue1\x00', 0x4}) r3 = dup2(r2, r1) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476e9d753d000aa8faf8fb574dbcfa6dc4d"}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r3, 0x402c5342, &(0x7f0000000180)={0x0, 0x0, 0x0, {0x77359400}}) 16:57:09 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000000000000500000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:57:09 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0xd, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:57:09 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r1, &(0x7f0000000140)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) r2 = socket(0xa, 0x1, 0x0) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x100, 0x0) ioctl$KVM_GET_PIT2(r3, 0x8070ae9f, &(0x7f0000000180)) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000040)={0x2, {{0x2, 0x0, @multicast2=0xe0000002}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000440)={0x6, {{0x2, 0x0, @multicast2=0xe0000002}}}, 0x90) 16:57:09 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext\a\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:57:09 executing program 0: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000340)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RREADDIR(r1, &(0x7f0000000480)={0x2a, 0x29, 0x1, {0x0, [{{}, 0x0, 0x0, 0x7, './file0'}]}}, 0x2a) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) pipe2(&(0x7f0000000080)={0xffffffffffffffff}, 0x80000) ioctl$ASHMEM_SET_SIZE(r2, 0x40087703, 0x0) write$P9_RSTATFS(r1, &(0x7f0000000640)={0x43, 0x9, 0x1}, 0x43) write$P9_RREADDIR(r1, &(0x7f00000003c0)={0xb, 0x29, 0x1}, 0xb) write$P9_RREMOVE(r1, &(0x7f0000000180)={0x7, 0x7b, 0x1}, 0x7) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000900)='9p\x00', 0x0, &(0x7f0000000840)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@access_uid={'access', 0x3d}, 0x2c}]}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='system.posix_acl_default\x00', &(0x7f0000000400)=':\x00', 0x2, 0x0) 16:57:09 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x2c, 0x4) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000000000)=0x2, 0x4) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={[], [0xff, 0xff], @multicast1=0xe0000001}}, 0x1c) 16:57:09 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000140)="025cc83d6d345e8f762070") r1 = socket$alg(0x26, 0x5, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000180)=0x14) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000001c0)={@mcast2={0xff, 0x2, [], 0x1}, r2}, 0x14) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'xcbc(aes-asm)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000100)="0a0775b0d5e36eddaa1e6ea64aa8e1c9", 0xffffffffffffffa1) r3 = accept4(r1, 0x0, &(0x7f00000000c0), 0x0) sendmmsg(r3, &(0x7f0000009500)=[{{0x0, 0x0, &(0x7f0000007180)=[{&(0x7f0000006f00)='O', 0x1}], 0x1, &(0x7f00000071c0)}}, {{&(0x7f0000008f00)=@ipx={0x4, 0x0, 0x0, "632ac09b863c"}, 0x80, &(0x7f0000009440)=[{&(0x7f0000008fc0)="08a32831793ae3455a6f29facd88402ce7", 0x11}, {&(0x7f0000009280)="0e6e15620827b594", 0x8}], 0x2, &(0x7f00000094c0), 0x0, 0x10}, 0x4}], 0x2, 0x4000000) 16:57:09 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000280)={0x26, 'hash\x00', 0x0, 0x0, 'crct10dif-generic\x00'}, 0x58) r1 = accept4(r0, 0x0, &(0x7f0000000140), 0x0) connect$rds(r1, &(0x7f0000000040)={0x2, 0x4e23}, 0x10) sendmsg$rds(r1, &(0x7f0000000700)={&(0x7f0000000000)={0x2, 0x0, @broadcast=0xffffffff}, 0x10, &(0x7f0000000540), 0x0, &(0x7f0000000640)}, 0x0) [ 312.109959] binder: 22055:22061 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 312.118692] binder: 22055:22061 unknown command 4743953 [ 312.124693] binder: 22055:22061 ioctl c0306201 20000000 returned -22 [ 312.137479] binder: 22055:22061 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 312.146213] binder: 22055:22061 unknown command 4743953 16:57:09 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r1 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_SET_TIME(r1, 0x4024700a, &(0x7f0000000000)={0x0, 0x0, 0x0, 0xb, 0x0, 0xee}) getsockopt$IP_VS_SO_GET_DESTS(r1, 0x0, 0x484, &(0x7f0000000040)=""/79, &(0x7f0000000140)=0x4f) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x101ff, 0x3, 0x1f000, 0x1000, &(0x7f0000ffc000/0x1000)=nil}) 16:57:09 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r1, 0x8200) write$binfmt_elf64(r0, &(0x7f0000000740)={{0x7f, 0x45, 0x4c, 0x46, 0xbd5, 0x70fd, 0xfffffffffffffe00, 0xee13, 0x8001, 0x3, 0x3e, 0x7, 0x31e, 0x40, 0xe, 0x0, 0x2, 0x38, 0x1, 0x1f, 0x6, 0x100}, [{0x3, 0x8, 0x4, 0x7f, 0x743, 0x6, 0x7db2, 0x80000000}, {0x6474e553, 0x1, 0x10000, 0xdfe, 0x3, 0x2, 0x20, 0x603d}], "90cf0f987d72e3c0236d15b31891c85f0374d678c6c5fb608e0ff26ad371e82ecd9292d9e8d59c2ada2eeb7fb3b10895ca9ba9458bf18a286db492f91c277f7d592a0d51842e93495ca0f9c83d5bf5bed75bedc3970a023d8bbfe53ed789fb3fd508a59250048e99eef979cb2d028da5a7f1f01131267e8fc3e8474627381bb1aa2cead2a20a43758fbae35b06cfcdf191e14c5760f71f3e31b614f35338b11fa8126a37e54a50fd62d8269bf517f7bcb963e15a0300f459eb7f1fb7d7f2a021805413b6faf49b7505bb25d8674cb3ac87cbc200316126049d09b34552", [[], [], [], [], [], [], [], [], []]}, 0xa8d) r2 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r2, 0x0) mlock2(&(0x7f0000004000/0x2000)=nil, 0x2000, 0x0) mlock(&(0x7f0000006000/0x2000)=nil, 0x2000) 16:57:09 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0xfffffdef, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:57:09 executing program 6: r0 = syz_init_net_socket$bt_sco(0x1f, 0x3, 0x3) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) shutdown(r0, 0x0) recvmmsg(r0, &(0x7f00000068c0)=[{{&(0x7f00000055c0)=@ax25, 0x80, &(0x7f0000005880), 0x0, &(0x7f00000058c0)=""/4096, 0x1000}}], 0x3d3, 0x0, &(0x7f0000006b00)={0x77359400}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r1) getsockname$packet(r2, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, &(0x7f0000000400)=0x14) accept4(0xffffffffffffffff, &(0x7f0000000680)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000700)=0x80, 0x0) recvmsg(r1, &(0x7f000000ce80)={&(0x7f000000a740)=@can, 0x80, &(0x7f000000bdc0)=[{&(0x7f000000a7c0)=""/4096, 0x1000}, {&(0x7f000000b980)=""/172, 0xac}], 0x2, &(0x7f000000be80)=""/4096, 0x1000}, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f000000cfc0)={{{@in6=@ipv4={[], [], @remote}, @in=@dev}}, {{@in6=@mcast2}, 0x0, @in=@loopback}}, &(0x7f000000d0c0)=0xe8) r3 = syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0x6d26, 0x20000) ioctl$KVM_SET_CLOCK(r3, 0x4030ae7b, &(0x7f00000000c0)={0x54}) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0xa101, 0x0) 16:57:09 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c40000000020e100000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 312.153984] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 312.158928] binder: 22055:22061 ioctl c0306201 20000000 returned -22 [ 312.185374] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue 16:57:09 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='extM\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) [ 312.224554] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 312.239490] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue 16:57:09 executing program 7: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000300)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c50400aeb995298992ea5400c2", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$can_raw(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x1d}, 0x10, &(0x7f0000000200)={&(0x7f0000000140)=@canfd={{}, 0x0, 0x0, 0x0, 0x0, "b5a419fb5df128c83ad9430362a22a5abf1e4123efccc641602c2da3630b58d04766c58b254ff2a965ccb226c8c7355c33306c99adaa0aa59006f8dc9b01b737"}, 0x48}, 0x1}, 0x0) recvmmsg(r1, &(0x7f0000003340)=[{{&(0x7f00000000c0)=@sco, 0x80, &(0x7f0000000100), 0x0, &(0x7f0000000540)=""/94, 0x5e}}, {{&(0x7f00000003c0)=@pptp={0x0, 0x0, {0x0, @dev}}, 0x80, &(0x7f0000003200)=[{&(0x7f0000003100)=""/226, 0xe2}], 0x1, &(0x7f00000005c0)=""/239, 0xef}}], 0x2, 0x0, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x200, 0x0) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r2, 0x81785501, &(0x7f0000000440)=""/241) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r2, 0x54a3) 16:57:09 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$sock_SIOCBRADDBR(r0, 0x89a0, &(0x7f00000000c0)='team0\x00') ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") rseq(&(0x7f0000000000), 0x20, 0x0, 0x0) rseq(&(0x7f0000000000), 0x20, 0x1, 0x0) utime(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0xfffffffffffffffb, 0x1ff}) 16:57:09 executing program 4: r0 = creat(&(0x7f0000001380)='./file0\x00', 0x0) ioctl$fiemap(r0, 0x40086602, &(0x7f0000000200)=ANY=[]) write$cgroup_type(r0, &(0x7f0000000000)='threaded\x00', 0xfe63) open(&(0x7f0000000040)='./file0\x00', 0x20000, 0xa) ioctl$fiemap(r0, 0xc020660b, &(0x7f0000000140)={0x7, 0x7e9, 0x1, 0x0, 0x2, [{}, {}]}) 16:57:09 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x101640, 0x0) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x61, &(0x7f0000000180)={'filter\x00', 0x4}, 0x68) clone(0x0, &(0x7f0000000040), &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r1, 0xc0145401, &(0x7f0000000140)) [ 312.359480] binder: 22100:22106 BC_REQUEST_DEATH_NOTIFICATION invalid ref 33554432 [ 312.383545] binder: 22100:22106 unknown command 4743953 [ 312.389821] binder: 22100:22106 ioctl c0306201 20000000 returned -22 16:57:09 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x543, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:57:09 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c40000007cc00000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 312.412920] binder: 22100:22106 Acquire 1 refcount change on invalid ref 0 ret -22 16:57:09 executing program 7: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x1, 0x0, 0x1}, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000000)='./control/file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) chmod(&(0x7f0000000100)='./control/file0\x00', 0x0) unlink(&(0x7f0000000140)='./control/file0\x00') close(r1) [ 312.493224] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 312.507801] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue [ 312.533244] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 312.547207] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue 16:57:09 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)="6578748c00", &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:57:09 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x88a8ffff, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:57:09 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000080)='/dev/sg#\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0xffffffffffffffff, 0x32, 0xffffffffffffffff, 0x0) ioperm(0x80, 0x7fffffff, 0x3) ioctl$SG_GET_LOW_DMA(r0, 0x2283, &(0x7f0000000000)) syz_mount_image$vfat(&(0x7f0000000380)='vfat\x00', &(0x7f0000000440)='./file0/../file0\x00', 0x1, 0x2, &(0x7f0000000500)=[{&(0x7f0000000480)="e715988619ba5ae2784c5544a3203794b8cf4c083e0bacbba5b453c481e75177cbaa9600eab1a7dcc4ce7a39062d88fc80a5efe86a9640d985426fa98806d289421de893962ed0e23a9475e311c88d043ef5f649cac01412166f21e678a823001f3aa785dace6c05b3109bfaf9634c2db3e7d97f327ca10f5b01", 0x7a, 0x100000001}, {&(0x7f0000000580)="56987266309c12e82637af27ad10f013b0a302ef888336e9f72c06169733e7a54374355e6dcd2edb225564d0aaa09c4c595e1330627001c3dd01dad069acbc68d008698013c195ec66e63596e91ba159e1b37ce07c7d1c2d549926fb34dbd978bf7691b83c2910dc182dd1429f56f360da6acad9921909d1c5dc90580ff3c656a1eab6263cda96d5e2ae8527923170c75b7ab69918a11ca6422c80e01036a3768ad8f5b1c8d64249522477341c3c17de000a979e2d13d16a32abda936ceed8fe36a73e3c68c61caeb2e675022e1f827e68de570374091bd0b5e556", 0xdb, 0x100000001}], 0x80, &(0x7f0000000680)={[{@uni_xlate='uni_xlate=1', 0x2c}, {@uni_xlateno='uni_xlate=0', 0x2c}, {@uni_xlate='uni_xlate=1', 0x2c}]}) r1 = msgget(0x1, 0x10) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000000c0)={{{@in6=@remote, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f0000000040)=0xe8) r3 = getgid() r4 = geteuid() socketpair$inet6_dccp(0xa, 0x6, 0x0, &(0x7f0000000540)={0xffffffffffffffff}) ioctl$sock_inet_SIOCGIFPFLAGS(r5, 0x8935, &(0x7f0000000400)={'bridge_slave_1\x00', 0x3}) write$FUSE_NOTIFY_STORE(r0, &(0x7f0000000f40)={0x2c, 0x4, 0x0, {0x6, 0xffffffff, 0x4, 0x0, [0x0, 0x0, 0x0, 0x0]}}, 0x2c) lstat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = getpgid(0xffffffffffffffff) syz_open_dev$admmidi(&(0x7f0000000340)='/dev/admmidi#\x00', 0x44, 0x800) syz_genetlink_get_family_id$team(&(0x7f00000003c0)='team\x00') ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000280)=0x0) msgctl$IPC_SET(r1, 0x1, &(0x7f00000002c0)={{0x3f, r2, r3, r4, r6, 0x80, 0x1}, 0x8, 0x6, 0xfffffffffffffffa, 0x7fffffff, 0x7, 0x3, r7, r8}) 16:57:09 executing program 4: r0 = socket(0x200040000000015, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f00000007c0)=0x2, 0x4) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00006dbffc), 0x4) bind$inet(r0, &(0x7f0000000840)={0x2, 0x4e20, @loopback=0x7f000001}, 0x10) sendto$inet(r0, &(0x7f0000000000)="ba", 0x1, 0x0, &(0x7f000069affb)={0x2, 0x4e20, @loopback=0x7f000001}, 0x10) bind$bt_sco(r0, &(0x7f0000000040)={0x1f, {0x10001, 0x0, 0x5, 0x4, 0x0, 0xff800}}, 0x8) sendto$inet(r0, &(0x7f00004b3fff), 0xf00, 0x0, &(0x7f00002b4000)={0x2, 0x4e20, @loopback=0x7f000001}, 0x10) setsockopt$inet_MCAST_LEAVE_GROUP(r0, 0x0, 0x2d, &(0x7f00000000c0)={0xfffffffffffffffa, {{0x2, 0x4e22}}}, 0x88) recvfrom$inet(r0, &(0x7f0000000080)=""/40, 0x28, 0x0, 0x0, 0x0) shutdown(r0, 0x1) 16:57:09 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000000000000600000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 312.613782] binder: 22132:22141 BC_REQUEST_DEATH_NOTIFICATION invalid ref -871956480 [ 312.631179] binder: 22132:22141 unknown command 4743953 [ 312.646502] binder: 22132:22141 ioctl c0306201 20000000 returned -22 16:57:09 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, 0x100000001}, 0x1c) r1 = dup2(r0, r0) setsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f00000002c0)={@remote={0xac, 0x14, 0x14, 0xbb}, @loopback=0x7f000001}, 0xc) [ 312.802275] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 312.818849] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue [ 312.838937] binder: 22162:22168 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 312.847719] binder: 22162:22168 unknown command 4743953 [ 312.853202] binder: 22162:22168 ioctl c0306201 20000000 returned -22 [ 312.877773] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 312.899225] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue 16:57:10 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0x100000000000e801, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000210010a020002260af8", 0x16}], 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='/']) 16:57:10 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt6_stats\x00') ioctl$EVIOCRMFF(r1, 0x40044581, &(0x7f0000000000)=0x8) read(r0, &(0x7f00000003c0)=""/250, 0xffffff9a) 16:57:10 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x300, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:57:10 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$netlink(0x10, 0x3, 0xc) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x101000, 0x0) ioctl$SNDRV_CTL_IOCTL_HWDEP_NEXT_DEVICE(r2, 0xc0045520, &(0x7f0000000040)=0x3) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'bond_slave_1\x00', 0x0}) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000300)={r3, 0xe, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x10) 16:57:10 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000000000000300000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:57:10 executing program 6: r0 = socket(0x40000000015, 0x805, 0x0) bind$inet(r0, &(0x7f00000a9000)={0x2, 0x0, @loopback=0x7f000001}, 0x10) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0xff, 0x488104) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x30000, 0x0) sendto$inet(r0, &(0x7f0000000040), 0x0, 0x4000000, &(0x7f0000000100)={0x2, 0x0, @broadcast=0xffffffff}, 0x10) 16:57:10 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext\t\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) [ 313.349682] binder: 22187:22193 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 313.358409] binder: 22187:22193 unknown command 4743953 [ 313.363863] binder: 22187:22193 ioctl c0306201 20000000 returned -22 [ 313.376826] binder: 22187:22193 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 313.385537] binder: 22187:22193 unknown command 4743953 [ 313.391551] binder: 22187:22193 ioctl c0306201 20000000 returned -22 16:57:10 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000001080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) r2 = getpgid(0x0) sched_setattr(r2, &(0x7f0000000000)={0x0, 0x1, 0x0, 0x0, 0x3}, 0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000fcdfe8)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f000086c000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r0, &(0x7f0000465f8e)=""/114, 0x13) r3 = fcntl$dupfd(r0, 0x0, r0) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r3, 0x2403, &(0x7f0000000180)) openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x400, 0x0) ioctl$RNDADDENTROPY(r3, 0x40082406, &(0x7f00000001c0)) ioctl$KVM_SET_PIT(r3, 0x8048ae66, &(0x7f0000000100)) ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000c22ff0)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) mmap(&(0x7f000037c000/0x4000)=nil, 0x4000, 0x9, 0x20070, r1, 0x0) 16:57:10 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0xff030000, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 313.407591] FAT-fs (loop4): Unrecognized mount option "/" or missing value [ 313.475655] FAT-fs (loop4): Unrecognized mount option "/" or missing value 16:57:10 executing program 7: r0 = socket(0x10, 0x3, 0x0) bind(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x4e20}}}, 0x80) ioctl$sock_ifreq(r0, 0x0, &(0x7f0000000100)={'gretap0\x00', @ifru_data=&(0x7f0000000000)="ac8be4abd0f79d6325ae476aab5970a3131f2fb4bbfb3c75500e33d0612f430d"}) 16:57:10 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c4000000000000000020e1000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:57:10 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext-\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:57:10 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x220000, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'irlan0\x00', 0x2}) ppoll(&(0x7f0000000200)=[{r0}], 0x1, &(0x7f0000000240)={0x0, 0x989680}, &(0x7f0000000280), 0x8) 16:57:10 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndtimer(&(0x7f00000001c0)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x6}) r1 = syz_open_dev$midi(&(0x7f0000000100)='/dev/midi#\x00', 0x8, 0x200) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000340)={0x2, 0x0, [{0x10000, 0xa3, &(0x7f0000000280)=""/163}, {0x15002, 0xc, &(0x7f0000000140)=""/12}]}) r2 = open(&(0x7f0000000040)='./file0\x00', 0x240, 0x1) connect(r2, &(0x7f0000000080)=@ipx={0x4, 0xc000000000, 0x8, "6c97f7d851ad"}, 0x80) 16:57:10 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0xc0ffffff, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:57:10 executing program 6: r0 = socket(0xa, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000140)=@nat={'nat\x00', 0x3c1, 0x2, 0x2b0, [0x20000660], 0x0, &(0x7f0000000000), &(0x7f0000000600)=[{}, {}, {0x0, '\x00', 0x0, 0x0, 0x2, [{{{0x3, 0x0, 0x0, 'vcan0\x00', 'bridge0\x00', 'sit0\x00', 'team0\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x140, 0x140, 0x178, [@physdev={'physdev\x00', 0x70, {{'veth1_to_bond\x00', {}, 'syzkaller1\x00'}}}, @cluster={'cluster\x00', 0x10}]}}, @snat={'snat\x00', 0x10, {{@dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}}, {{{0x5, 0x0, 0x0, 'team_slave_1\x00', 'irlan0\x00', 'irlan0\x00', 'syzkaller0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @random="f646793b7b39", [], 0x70, 0x70, 0xa8}}, @arpreply={'arpreply\x00', 0x10, {{@link_local={0x1, 0x80, 0xc2}}}}}]}]}, 0x328) fdatasync(r0) [ 313.653148] binder: 22232:22239 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 313.661868] binder: 22232:22239 unknown command 4743953 [ 313.670255] binder: 22232:22239 ioctl c0306201 20000000 returned -22 16:57:10 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) [ 313.787468] kernel msg: ebtables bug: please report to author: Chains don't start at beginning [ 313.798938] kernel msg: ebtables bug: please report to author: Chains don't start at beginning 16:57:11 executing program 7: r0 = socket$nl_generic(0xa, 0x5, 0x84) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x280000000000, 0x900) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f0000000040)={0x0, 0x20, 0x20}, &(0x7f0000000080)=0xc) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f00000000c0)={0x100000000, 0x4, 0x6, 0x7, r2}, 0x10) setsockopt(r0, 0x0, 0x82, &(0x7f0000000140), 0x0) 16:57:11 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c4000000000000000020d7400000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:57:11 executing program 4: r0 = socket(0x10, 0x2, 0xc) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(r0, 0x112, 0xa, &(0x7f0000000040), 0x4) write(r0, &(0x7f0000000100)="1f0000000104ff00fd01000000000020000501000800010003f2511a10df00", 0x1f) 16:57:11 executing program 6: syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0x100000000000e002, 0x1, &(0x7f0000000040)=[{&(0x7f0000000080)="eb64c86d4f66732e66617400020441000500077008f80000d8c32d8cbe59628cf9d9ed7b2c", 0x25}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = socket$inet6(0xa, 0x1, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x200, 0x0) write$FUSE_NOTIFY_RETRIEVE(r1, &(0x7f00000001c0)={0x30, 0x5, 0x0, {0x0, 0x5, 0x7f}}, 0x30) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") creat(&(0x7f0000000140)='./file0/file0\x00', 0x0) mkdir(&(0x7f0000000180)='./file0/file2\x00', 0x0) 16:57:11 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x8035, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:57:11 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x9, 0x4000) setsockopt$RDS_CANCEL_SENT_TO(r2, 0x114, 0x1, &(0x7f0000000040)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10) dup3(r0, r1, 0x0) sendmsg$inet_sctp(r2, &(0x7f0000000840)={&(0x7f0000000080)=@in6={0xa, 0x4e20, 0x5, @remote={0xfe, 0x80, [], 0xbb}, 0xffffffff}, 0x1c, &(0x7f0000000740)=[{&(0x7f00000000c0)="ab88f603079a83496303e45e21ea75b3f58f3be16f3066c0913495ca64f776ba1e7f95b4817f4e2900de2dce2940b194a0e6ef11e4a4bb776a5b73919cfb1f7a46c60df9ba1051f4cca3ddee5a7a329b8de3bcb52dc1e5d13cf09a", 0x5b}, {&(0x7f0000000140)="c8f972c2d3d82d3276c4027c475d8d71f1f27d16341b048298b1e6ec55711559058de9ad85248c4c418a842a68ace3a62bc1c16a5f1e45baee22581d21659ab719803bca1d38a354acd06bb5b9173d397b026abdbfc5359f00e9bf9ffa20cc2429ea7bcde39c3afd1e14e4619c2701b6f20b184638028401fb3c4aeb5d8ab0df49ba869382ed", 0x86}, {&(0x7f00000002c0)="aaed8572d82d8c9b036e20ef19525798a54eddac80d77567d8ebd8b25e2703dc1e53927a7649346944436b4250cc6a39650751773e2639c2f294155042e899f59f93d7c1541296a535602276874f9e1e019310bfed441304bf29cd35fac7a38ec421389498af0cb8982ffa54bf85838a734c7b04a8bc0abf9d1a888fedbe267f0754fedb0eb6767fdfd8ec391975c2e458b29f9952290b13988424eede9095bb1bb0530393989e953916c48d2410fc81fd0960c674bbd15ada48fdd8496028dd591c352a875311754a856f13c854e0e290149788646cfd", 0xd7}, {&(0x7f0000000200)="aa22ed3b28a38ca375f3db70b005227a1ea15251f1d218c5a3c83e7fc16b710091bfa08a083efe7d548f354c0e76a91d9332cf4e6c032d69da642d06", 0x3c}, {&(0x7f00000003c0)="bc7d7f11fd912324707509b488949338d2de67d97da4918502ae697f9795b4931c816b41c54078f83a7e9d54402d240ca71bd12f2a6ee716e46bb76aaac2f7d68b80639e1e34ac8ebc5f9b2bc1fca5f552cb81744395d3f66d9d09ae8b9cfbddb9f0f3db824ac38d1e0ebcaf7fe807def534500f18cacf2d57e6c8e53370d91b6df699f76ccecef6423381b27dc620534cc42d240addf0753976931bae76253499b4", 0xa2}, {&(0x7f0000000480)="8b9a1ecb0cd3f1d504a462164b8d76d5e195fe8deac22a5926c476d9d96fbd4843ecf68656a69390dee5f2ddefa5b9c1570840aa3c3e8961494d85090bb064cc2676de3d13a349ce31eb63689633c1fc1ebfd0c22c20d671b19be6c6", 0x5c}, {&(0x7f0000000240)="585e4f08f1c0affed5901d4544c31ebfe73cd0c2c6c2245a35a9afa860b761bc5934bc1ade8ea31793cb", 0x2a}, {&(0x7f0000000500)="976b86279ab279c7c579f377c889b1cade045561a265b1170bbec0d1f12942d74e93d9faa053b7708c44330b3c47ab98710ccd3ea334d36b98af15c02f8425d4d16422fd5c352c4eb4fcf3256034eea521c9d0894aa1520063c4cdebbd8a3a46077e50ce190f7ebc6cecf8d54340a0c2da25127692621ed1817e3a5aaf27b35d83deccc9ae081b101ea83e594ff67ec0af21b3661505c3a0bc7e953ec10567dc3bf6b9b25cf661b9aedadf09452ce208f0057573c9a79fe79efbc5ed918c", 0xbe}, {&(0x7f00000005c0)="eb1a432174f1f03772603a1d031042edbcbd43de319a457fe7ad1c485500f904ac5c1116996c27a3e9d451c4955df58943f7ffc8e1d578f96653669a4d111960ae8332805dab86adedf75447e0d24bdd2a086c17e63b3d8106c3f74707fed5c0418722e99372b41d1b39289b351f30cc7a0a10580b9ee5da95fcba3dc0c4dc3ed044ea351721d864f09b5e7f40c71ada68ede68e3f2176a446ef7a917aa06113b1c9e5a1b8740f391648308455674c321c93ffb46c37442a4a294b9401053d45b82cf094ead6f8f2c8ee1c43093ac4af3b3ccec0a53052de9e3cb7fb08cede859e", 0xe1}, {&(0x7f00000006c0)="03752dd092ce13645d24f47641f8a9ec53a9c8c530b0f10e61bcc3f3035b3dcaa398d485905dd77258083f021b1684cef77e008c0e037f342bf308b5a503084abab4122f440cd26f46a17cc56fde86cbce5edd581d2a", 0x56}], 0xa, &(0x7f0000000800)=[@dstaddrv6={0x20, 0x84, 0x8, @loopback={0x0, 0x1}}], 0x20, 0xc000}, 0x8000) [ 314.346838] netlink: 3 bytes leftover after parsing attributes in process `syz-executor4'. [ 314.349997] binder: 22285:22292 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 314.364167] binder: 22285:22292 unknown command 4743953 [ 314.370062] binder: 22285:22292 ioctl c0306201 20000000 returned -22 [ 314.381597] FAT-fs (loop6): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) 16:57:11 executing program 0: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x40000, 0x0) prctl$getreaper(0x28, &(0x7f0000000100)) r1 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x8, 0x20000) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000140)={0x0, @in={{0x2, 0x4e24, @loopback=0x7f000001}}, 0x2, 0x1f, 0x100000001, 0x1, 0x2}, &(0x7f0000000080)=0x98) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f00000000c0)={r2, 0x1000}, 0x8) 16:57:11 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:57:11 executing program 7: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(hmac(sha256-generic))\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000840), 0x11f) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/mixer\x00', 0x4800, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000540)=0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000580)={0x0, 0x0}, &(0x7f00000005c0)=0xc) lstat(&(0x7f0000000600)='./file0\x00', &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f00000006c0)=0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000a40)={{{@in=@multicast2, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @rand_addr}}, 0x0, @in=@loopback}}, &(0x7f0000000700)=0xe8) lstat(&(0x7f0000000740)='./file0\x00', &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000780)=0x0) stat(&(0x7f00000008c0)='./file0\x00', &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x0, 0x0}) r11 = getegid() r12 = gettid() getresuid(&(0x7f0000000bc0)=0x0, &(0x7f0000000c00), &(0x7f0000000c40)) lstat(&(0x7f0000000c80)='./file0\x00', &(0x7f0000000cc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000d40)=0x0) r16 = geteuid() fstat(r0, &(0x7f0000000d80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000e00)=0x0) fstat(r1, &(0x7f0000000e40)={0x0, 0x0, 0x0, 0x0, 0x0}) r20 = getegid() sendmmsg$unix(r2, &(0x7f0000002f40)=[{&(0x7f0000000200)=@abs={0x1, 0x0, 0x4e20}, 0x6e, &(0x7f0000000500)=[{&(0x7f0000000280)="021c4ec097b4537bbfd8c8a73c1812446f9cdb30e7988a6170b3b5383ccf7427161efa79813bc2d58027e23c28f1c1bbf95e0fc29119206fb71f6542c428ff49b0c096bc644f924313f7b169b8c0126602567e106b61aef11212cfe72cfc8314c5f35d87ea0c7198907504291030679b92ad08cc13a9651eb4d276d3f7d5decc5c502f447d8adb260515a3e9cb087eac6596a6d8d7c318fec46cb805f848aa335bdd4fea4e4bf701131a2cd4028c011db175ace517bd9970de03fcfef8d39765d114d1bf7277c3bf0417ad602a7f08d39ca7ac05a3049a506b02e1296389698210e9e46939d571ee2350a025f9b054eeab836c19bf87d3eed4312ce799cbfe", 0xff}, {&(0x7f0000000380)="f42c3b2f9b14358a09bcde5d43cd523838a5e4eaa8f49267aab323c11b97df459c4c5500c25cb70e1acd2c85718e09323079970d0de7ede897d94a0a1243bd03eb328482e16b39db08bdd60125eedbc7010bfb6ec24af1e3c9b54a9ba98928e57f879b9b27e050d384771f375cd1ae981f8b4be9cb2525e08e4a41", 0x7b}, {&(0x7f0000000400)="ed2b04750a0d4037b7bec396987f96f8629260a591608b27aa465839fc64fd0a2b37c7910d4ac431aa2539539c7a291d469cae91d6391037f1495a7de6364c650408fdbfe53bb4f150195f7077f8f41780f75c19525c3246ad13ce19afd3a8d5d4fa50", 0x63}, {&(0x7f0000000480)="def6505c7c380724c1cc65efff32898330664c77bd05d02ba5ef0c9d75d0048bbec9f7d34d5d1106581bd809f3edf97ca2776b1948464a692e4134b0e629f2a95a4dc73acde67b2adda00486c842fce1cd13a3a1ad20cb76607c95572ab115274d49a024ae7dca2b522d", 0x6a}], 0x4, &(0x7f0000000ec0)=[@cred={0x20, 0x1, 0x2, r3, r4, r5}, @cred={0x20, 0x1, 0x2, r6, r7, r8}, @cred={0x20, 0x1, 0x2, r9, r10, r11}, @cred={0x20, 0x1, 0x2, r12, r13, r14}, @cred={0x20, 0x1, 0x2, r15, r16, r17}, @cred={0x20, 0x1, 0x2, r18, r19, r20}], 0xc0, 0xc0}, {&(0x7f0000000f80)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f00000013c0)=[{&(0x7f0000001000)="984adc8174d17c5d4d8ad831a42e31f0294eea7de9a27c6367b150590ffe2bb33eda08bfb9ef1a3b2b1e5ff4aa93ae49074d8dd5f74c5ee818a6cfc8a48d670a8796b126661aa38592c5fec1f06f11d18302ad1d2fe6d41c8ef8e0a9b2c51e2c4a9877fd2fa192e4461bd3f7249b019a085d299dfaad", 0x76}, {&(0x7f0000001080)="54a6b57ece320dfa8c33961115b1318fdc976bd2b441267db6b617462ba71a6e9a893e260dd58576ea22d2bc98ba7d929a82779bffda82967008145ef2d1b8fa0f4e87f4543d5eaf3856ad15e13da18dc3f640b0287226475acb2b1b57028c6ba7b00f099f135b53df050cbf13cc2f9cd8d39b8355da6830654482d8eceaf79154c5ec25d6ff85075e48ca9f42c1734d348874856b363b4f1346dcb3bb84096da7a808be68", 0xa5}, {&(0x7f0000001140)="36f8270dd0b89d94cc7cc722c8520315acaa9af45a1ceb35c74ef9380fc8536982445772f8b4ed9dbb6450aef48971f35709b9203457cd661a4397952a66e07caf46540639dbf9dea769eb0ae701ce9e271f3892f39fa70dac2c8d653c2565d0b180314fd2f7487486723a21df5c6f3794c3ce3077de2854d23dfd62e13231d77da867cc3e9474473e1d175369783bc2a2f9bb", 0x93}, {&(0x7f0000001200)="b467cb0e5dd5c7b559cc90a787681ed701a292f604dafaf9e6b7ea4ca8fd165e8415622adec77ffd64181faa2e275fc428deae2d11f473da7dd2407a3b6819445c3a2dd6", 0x44}, {&(0x7f0000001280)="fd75e0fd6fa942b73be5ce9b07624f92cf8edbfb0ff635ec8f6c18ef34960a6c92af4fe1e26d5ba352f5740106d9ef6606b0b6cea494ceae2d99c99db7a4d1679d663820d6f988f126532a03faa27a776b3a8aa47aeabbd54f6f3957fcecdc4c41bb1193e78ba1e63b9406d32ab4a51bc93a5898d0a6fd31d1f0dc575c4559ba4519e52d81dc0227f74ce3b9e238cb8c8110d0d3afd7fe0e07471f56308d2c4102c56dc379bf2a74f5969182aee6983cbe535144035a", 0xb6}, {&(0x7f0000001340)="85fc256891d537fec0062f97670c3b70b845e6464b112a30ccec515a679905b10619844c47e79cba59c92bf3b277803e0e2b10b5a43fc14a99343e8a95d560466e8a6b434c48b64f1b81b002482b9c0d25b1fed9cd", 0x55}], 0x6, &(0x7f0000001440)=ANY=[@ANYBLOB="28000000000000001100000001000000", @ANYRES32=r1, @ANYRES32=r0, @ANYRES32=r0, @ANYRES32=r0, @ANYRES32=r1, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r1, @ANYRES32=r0, @ANYRES32=r0, @ANYRES32=r1], 0x48, 0x4000080}, {&(0x7f00000014c0)=@abs={0x1, 0x0, 0x4e21}, 0x6e, &(0x7f0000001780)=[{&(0x7f0000001540)="aaf8016cad89ff70a6c311228399db6e4166f93a90786debf240a0503c3d0bca123d21944e67669c413a0facd93386759131aca4307551d2acf14ce3fbd27e99f6180f41d25caeda312beccfc9ce0b02898d7024d80d7b83971dfad92b76f782133718813131039b4a633955f32f7006bb35bd1294dddb368b37611a82784ba94d64f89cf17e2d662533cef349af878f60f50410fbc141e5c2d4cdbe8744ce6458ecf3f3789f906df151210ce8cb5584fe61f8d3b921be9ab53863887546", 0xbe}, {&(0x7f0000001600)="ed546488e23c232bcc6616083d3d2d8402ffb2826a5f0ab994bc72a542e7b252d919cae82a9c2038acc9e00a1b48d12e17cf497d9af2abd06cdab6865345634286850ce35cbf0c4780d342205764984be788a62e7ea2fdd9ed78048b5decb31fca7b93cf454675e2ccefb04a93f478f198ae4584e4e136f4783d4a06e2c6c2f28e816542ae9c0700218dd4ba3e9e24730ef71ee93138635e9000d0809d78fba5cb274515f53faae2bbb8f4f4621d9c4aac1632bbfb", 0xb5}, {&(0x7f00000016c0)="3e25eede2411c97ee0401231a9efe11f96481e1fecbc69b3dfb0208ead420d4768bebd0474f17b80776bb8514969b5065bcaf056a9c0ae3c1a4812cf2cbf0520a03dc500f90af6d29ca454918600fb23840778b122b3ea3b474770024b211efb777d1069718893c229aa6b9188b9682010e82b247ee1b3a0f7392065dc125b680c8907307a10cd4feab26417301a544b75fc608c2e0791538e523c2a", 0x9c}], 0x3, &(0x7f00000017c0)=[@rights={0x18, 0x1, 0x1, [r0, r0]}], 0x18, 0x40044}, {&(0x7f0000001800)=@abs={0x0, 0x0, 0x4e23}, 0x6e, &(0x7f0000002dc0)=[{&(0x7f0000001880)="a4495a28c89972322f8391fdea0aa6a71f445d35bb685ac1b2e89253c6c8", 0x1e}, {&(0x7f00000018c0)="48fe5dcff9b9c22397b611f3c65cce6b0f64cc7230a90922a222531a78e73c0bc461d58d622b9c235c0830326ee7af88cdab80226146de79359bb857973e1011edb7611e40b3cb8895011abf3a03aaf7c062610af0e77893aa8cce43fc7d0a05dcdc2957e5399e79c5c98120b83050526193005dc3a06b04771bf4287bfd8ed161672663db31aebb6993349bfe9388ab400df4c94f8420aa4b04b220", 0x9c}, {&(0x7f0000001980)="231eae7b8c4afb4de2e5b6e9abc3b018f8e42d14de7ba3c85a5eab13184665514d4b", 0x22}, {&(0x7f00000019c0)="d151d8ee00ad5fe90175b74741e3b7c50d88c9d225a69c13a655ae22d5236aac3f4ff086513bfc960318dabeeb7fe88c74f74800453b133a9fdace192275f19cdf4fe18bd43478383bd7b6094eb9a82c5a1cdc413a9565b70e768c114457123ee26e6f0a9781272e8040ce98b1b89e94a71c0245f78cd4a79b24ab5f805dce518f625956be1cc33c7e7e1989cc91763065fe2641d5595c4f40b8e4ae11a216a9939a6d4f7878642b2a463ea249314bf1d26901c7f5566db92c9fbd03dd66841c8ea9fa02c659e39b2cbda75b3ea1030b5608827279cdda56509d4fdd43a93aed4f0110b743ddaec0f52ea1878ddc6ff8e441515618d23b5faa5a00cb600ab359d4e39c4306205ea41d0f1802f5a2dd3138cc755cf6795e829cebb0ff8eb1e603e62b83404f36100d9c3918d7cd41b4f366a86f006f7c5f7b77b7b8d2f70ce5c49fd060558a4c6c8d4a6c29b8cc868d21b6349b568735c1a640cd2b455c8be3f4d100751cc745fe7d38ac49afc96e2c0123af2cee9487435856ec5233b65502f9bc6fb57577261065a5862f51079fa22b874bcab3177004568f44464d26148fd4ff5eb7e8646d106e430715b31a2006e31bc44376711a9bb746a22d7bad0e92217e35949eea515f9eec9a876c8baa12053ff0f0d97bfcf59bf2c3fcb76c2b58642a97bc4efa0fcff4158ba0f9d5030c9bf73fe9884bee6a7c04f2acab8d6ab99950ca7af0cfde9cbd80628b501dc19eb4b6978407487d3b52cd980da7d45709039513fe2417600d931d9a7f39aacfbedacc35b0a3eb9b3ac22eac5c3cf57cbc403d61f652e626660b3e28cfb1b72420c3404298bbb3365f84d3afbe760378be5e738f239c04e71ec21bf7146d281350f17c9ad29ac36459a4d3e6cf1fd2331b6c5013367d29901e477031aa3eb29fe277f10570fbb08b60b03f73a051c7f83c817b69d69fe88fa9402d464d9506cf40eaf0dca0f27dc9241fe4cf185a0a2c5ee8528bcedaf899491bf8143bdf344ca2393d817a8c2bbef9fac397fa07ca5afca2679847aef53f38731a0c4dc949e35bbd6350d891a7575e10adf939b29cecaca035648e6101af1994c34294f5ddd85b8b0351916f463d98c85c3d6568b7a2dd2c5eb1994b612c18671074f44b48d762600b188578f1f2b65d306c78c3e3e5bc0edcddecf381995c30f1cf34ea186575a1828eb70f25218611653ef32fbb6a7df4a7dc869edb12db7d94ecb2b418e1aaf62be9eb1a166369bbaeccf7a31e0e16361c00db22d0d372f6deebbe9c6187268214c014a6fa890b96fe2804a14a97648147515bfb471c19ab1d682c6cd8541af3b616bf5ed4a936e90d588ca921eac312ea65f868377c475dcb2e7fe2c8362e82987e7962623bf19f084b47f23536465ea9f3f6f2b23c249e81f2e901a76c8684ed324c5f1efa95c7b8605973ded8b75b1c1b383cfeb8c5a217c3ac54d3a2cfc86479db007c9c676037f1be42036ff9dac098f07cc1a5db8463e3a9f113c9a81d1d4e8b154756c70a2b0d2c6077a03c8cf7c8668087c1e7cbe8d1664dc6f081b44ec66638e1ec1660229d7ac154d1fec56bfd7f87edc1df0673f18f11f05a1e348b2be3ce1c1764a816a194860b21e53f0a2a0d037a23f687552e06a272dde9e36bcda4c6be0b96a0a23b28b3191dc764e30b13facc61944abecdd9bbc66b5ba4c3e00c0e31a7a1ed5adbde30e496b38e82d9b3c445f36c52e122c5b4bd71db40adbd00bccc91201a449a4e5115e4a37f96cffca2f2808261d1b28afa9117ae37641aeea77d13ec63122144b0fae3ee01edc4d134eec83ac30e06f65f431fc2a837bc0db60623d7aa71301db680328b21533354d399c5b8607473d0f28ea5a9375b3b241c3bbba09f1c5deb744b106b0fb664fc81547fcae11778d67544d25e9fddcf590ed7e6d194c5228302397391b718dd2767e7fb81daa3b792579aaf5d0117fd6dc5c4858a3b43d95946b3ce867de6257744fb347e751d0aeddc5d6e82f15790a3fef5308126f4cdf1e9872fecc6c058c126601b3b876fd72540188ebf4af39b1a381c5272fa89b1fc9526435f0280497fe8200c2535da0c90f6118f8ddf776ef3c927afae1b1ed8c6e4c3d4a8f84188e0d18f3f87ff050237afd83c66b83faa76f72bfe16818ad554d492f698f588bf1535c497bf09cb3e8d1c0514d6a418ad22a6de25b1481b9ab0174a0631ad0e302445324d81a2d8f012e6edafb424a0cc95b60f8a65c0abbc650629d404532a522ed7585f5a2191055f92e1d194594102c31b7bea47834270ecb44efb2e7bba150c58c69d88e958717656a5093cf530f4dda4034f5bb9cb62f996c7948a1d9908792f6b9f0aee1fedcb6d0f5beba4cb713abe9bc23faa82496b647d9afb7ab9be102bbfdcfb6af75a1bb8da08e33a8c2691a212777b5e25ea987a1217542b47722208fafc58e6eb18c2edef4578eb2e64189bff85b53cd76e939c18f6cf970984716dec1d360449247a39c2adb714c5e54e9edc26e02a3a2db650cda0a04ac353a54258c048d44e64911a40ed9a5cd695ce46dd658419e5a96e72b3b9a3597ecb7168994a77936be14f6e892547de6b0eecf1d65367c53d274228cb912e4bf49c6f883792ec377236b7f71ed70b686d19faaceb45c26d42d6b55976d0d3821d1337b2e3b6ad558a39d02fd410a36538c7cc127c9d47fa197628f788302b8f2885c87669bbafd02c9c54883c71cbe659be24b4eb0c3e264c0a61167e7b6ba108c8f28f3e65a4562359beaf36dc39d84a12cce8119171c08c7b5d552b6bc0fc17b48e789e93511f15b842332a6f196b28b537e78d85379cbf455e76bb76c25e11a5a813d07efbd247c44bf10a9be72727ad83679e6e442bd23a0e0268ae74786c870bafba17ae4f01606ecede8cea93e5de8bc295cabbd2864afab75e9ff01ba5557dee53029a5e2676a07f0140981ac7729498174865956b31c61242311e88674bdf7c315e526dc874d71b6432496ef66a939b864e13770cc70b49edb7cd9428824fbe43aa4f8dabd0f2ba6e4d75eb2f3fb916d795ffc9f03a511a3605beb2955d0cfe60fd4020eb2c5d16a63d55cb5cbe3bd701ce7c5b8d91a37e5c40c4f63887957c14452ed02bab9c43e812d4ada4cce36e7985e9e7c70f0e0cab6457f4ee566b93859a7aca3203d1025e6861f0f0f45892c8fa4c1d810f4e0ac7b48db273a1e4a387987357898bb36ed2a61a8ed04c6343d60f287e1bb228c88b0615a0e538d843439ad83c85edf2e90b4ce9019ffd291d263676d33a9ada81e633b7320508e686beeeb0a7ea4937eafcd78b1e7fbef17c74083f72ccba12b976d1d8a29f39df81b64e4daebae66b89c0fa45e46db6eabba211888d9b7ec5a4bb057c0dc19bacec5ccf2361db9ee24b378813a429f6c92c23c7c434371a43a67311a6f3b7a0a853604f286aab3fa9da407ee429c0824ee351c7c37e472d5428a7d5884968cc46736aee05ee914488c15568a9320f323380c1d6b270a7e0041313bb94f1c0db7ec72527db7321983fe21d4fca8fbcbb69e730cd9494405bfb5a3389f88a75b86bc14d77cb78bad6978a7b929ae7709856cfafc6bec061eba131e93d482356c3dba1a97b664bd7d9625fa5c4df5fb3b220e9d4b55a65b7e3421e54cb4800b52d76c8b178558c8b7dcd04f1ff9ee0e73def740bf68a70ec49c0f360bf369cc328d2c1fa70da863617ab1d545df8ff4f22a07eeffa791fe9c9e9d3383472b26b7965a4d351618aed0a4da431a69962ec4d5e42b617a1a9acd65540eb27a3b9f9a7e51c2fbe25eaaad89a45e60c2c6e654c39c09bc6e5949c7152eb0c5e074b749fff7f41a4358bf31f49b95af1437eb3fc67ccc17d6612b59c8d757823fcd2b55ef0762a10645e41999b736088a7c43179f2565c24f0ccae73b276e7db0160edc9b9c9e471ed80c09d71a19788555548b1906d90cad3580a5d54f4cb4088d36e06156a15dd96e96bfe2f8a44beeaecef3a32552792632e5be5e60ec4fcb9ceb51e45a6844f7f8d6989e6a186b5bc38f50dbf3fc3fe96d79bda8794b97fb21282cce1760c7f4e14fba0b792997b4d07e9276ba8d123eef5395ee0362369fedd382766e418c737ff0ddbb2f41f213511b095968cda4a249b25c88b33d7e9d99e6ad2d31d3067be8cf3e4c0521877452377eb245a256e30f2a4bd911016beaecca745cdef0ee875a07b07fb12e5514375015f5ba191ca32d009b8c305bfd7ff051a60e8c49be5df42b197e8c4fd8bc726c87e8b143eee459c78853f0f84067c5f64d9cc52a5858e9b0b574ef3f5cc05c1e23bac0b91a7f035ae15c619771fd2be218e25fa5c96b8659c921faa5c74729805a286d741c74e3dca70114346d9b0aac86e01577c030684c69bc7045d8e8c75891e05767319e3bfe864e3192b7e4031f161cf0db78e7650ad33640227536623abd89b913ccb3fb0009dd1a1cfe29fa3cac4c91524376ec5cf9bbd85fb02c8b18f58113b99732ceee350fa07c06822eb3e275d480430d6b018f2cd7c3376c9c0dc5a47de14bbd7abd6b3d720114e14094b49ad1ecafff5660a4fdae56e0ebefdee48c3bcea88085e6964db33475804aeee67032ff3f25520db565cf5ab5839eb5279a29fdb3d8f8c1807d8d3eba145c1cdad9bbad264d9f07413ca261cb174e2ab9d9968188b192a0d5d435a52fc187a61e1bbeeb0c633e354f7cf210bbb9e85ba895be778c2a96e012a0897ce584628f6f618b1e8a52690d766e371ccee9de124bac55e7b6dcfb4f87912afe05fee793f42e8eae76099a45d5a067aa281d388e381ce60d78ae680ae02273043b026d429c043b06fd3b5aaae2f28165fbace8eddfc1af1a88765caabb6a98182b4d07ecfd4fe958a18009577c9f181bd7ca017f9fe6621469a07728a9f8786fbe5884b8cbdd0535d62cfd34b8e45719c5f55fd30b7f27e42b8f52ec5ea86fd4f6cecf625552cdc842188153a1c59fb557d6ab44385f3de79178e7ae8668a33de85f7a3be2696d2069aca8270d85af14a31c4bcacf108c02903567ead0523e1e5ca7d1c27788da8508d2b9432097028ac95711ad9bd834db9e2973c9b18fc8ef80ac0b8e5a34df7cc57045b06eaef0523957e0fa6810b569f2e419e1517766878484d02bbf00c6ae30908db0b466c077be521d1b5eb4e7992d89547b923747d9a743ff517087b2bf790ef8313cead83a5b6482c76b0978578be11801bc0726eef0f6596fddf5496f4ae0c2b6572ba07100f2a599dd54a72ae6ed8e9fa5ae21cfffdad9178c90b1dafbdebb5a6efa2afd962083324284f0d1e9d12d0711d2f15533b0220c1f9cc16b6b17ec5c983708100171d7b4f3690c54fb0106b65342419637769a8dba1cdf80e4fc8a76db6e3bda9a745d3fd0504aa8ddd45a03647f96b3f5e3a10065910d2c01e6a61ce88eb92f0a3c86c64eb35773158ec95f90d3db881b0435f81dcec763f0e027293f70da8e631f51331884229345be31d62dfbddba668574cbd423cddbb791eb6b2e03e9219ed2af9a0555925f6fd3416394ea0be03935f82b371dafe3fc5bbea3f89447f3838fafa7e72eff3eea1fff1ae1b667bdcecde3e238f617f2a9e4ee9e6fe323e5c8df18950c23dcf03c46204a477219b66ff88699c85bf32d24712364300d5859ed38690124729e3a8963e9ab7cd1fe65f003632f368d9bee0d447c10099348fd021cae01ddceb759e1b7b297b7305f236d095ed504ecb1ade5046873457b5e295048f62a742c2149316c25247f43cdfa232f3d2", 0x1000}, {&(0x7f00000029c0)="59620d5db1902e7cb995cb955b6ac7f9d8528bb54c2f4b54853afedc9aeec191c8b999b96e26b152089236eb6587e575ba658ecd88ebd81e2beb2dddd4b339c85b48c3fedd53f5bcd0080c6b25043dc50265e111f7ccbcd5c2235d970a52712dfea9b32192661faa774d5374ad383f37be93e1d60256023c173d89f9f1e09dcc69bb4bf3fc06db9d2189105bfb85c02ee601ad6c3d64005d67ab87aa8fad7a5d2d20d90c9f6e4a117f9d8087d13e55ebfe520a688fcc5ab77d6ffaddc99d998e732173971951696451c49ca72cad", 0xce}, {&(0x7f0000002ac0)="ed517cf15462827307249f35b8c7bf7172df23aa47e19c367b1501602a32c29bc07a89b73940e21774b5df4295072bb36072d17fcb6842e9a31641ab6618fbe0db77ff1f2e22ae5e920cd0ceb51d64940f8e03097a16b2bcd585521b58e9245156176aa924d35bd66b6c0a9f944129b26dc9b55774f5a1bcdbd59373b1d2b93e73e926089e149bee281067", 0x8b}, {&(0x7f0000002b80)="2c5d4e97c3844b72c654a768b2c726036f3ea7a52f02a0b68b745c62f9fd97d42f152caefea1e448954e10e4fe6e7f0d2368e0f59d162e105fe59978c7f268a7b8c7fc0ca17bcc22ef453ef08098b2a32f02d383231d0e23d9bdebcf8231e00a84b02fe93d17c553ce559f37b6a8f4d7480f888161c37388c76ccf", 0x7b}, {&(0x7f0000002c00)="b07ae64f3d440b18f0cada3a61b4b264b190bf0989fd4176a486afec59bdd1e1148acac7b882cd93c29ced7d41", 0x2d}, {&(0x7f0000002c40)="128965d3a84f559608080f19833561d0031678dd5a80d49ebb4b47e02ebbe2ed622e9aaed2f94f0aaea97f33f68ab7ae0c56e808a837f06c3568b131592a10b8017099023b83ecc600df77aabbeade9c7e07874642a012a18046d799cd905484f3a5c2b1432536a12378d07abe1adae2668e6114c40006603ee870c668de7def99e4631fb9a4d0913ccb29d021b47afb12dc423347ebc328b89cf48206", 0x9d}, {&(0x7f0000002d00)="a18533186ce47dca61edb37299dec507624d17a304155d017d3744af754283353823f7df194abc6ec2cb14191c550a6ddcc1b099d475147844cc54bf7964658d58f088ab00a67d2345b9852d2fdb98c860390f413d3a67b61e1a8344f5f9fdd85b5269e5c91fb2b6d4d8fc51684735bf2897ef52036d37c2770a9f226082e787266cab4226c0e56e261aada0aa63a1c3068c98e7626e446c2f2d59f160cf2d05cdb06c811bcb43f86bf5eca2f214719ec6984406a12e", 0xb6}], 0xa, &(0x7f0000002e80)=[@rights={0x38, 0x1, 0x1, [r0, r0, r0, r1, r1, r0, r1, r0, r1]}, @rights={0x20, 0x1, 0x1, [r0, r0, r0]}, @rights={0x38, 0x1, 0x1, [r1, r0, r1, r1, r1, r1, r0, r1, r1, r0]}], 0x90, 0x800}], 0x4, 0x4) r21 = fcntl$dupfd(r1, 0x0, r1) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000040)={0xffffffffffffffff}, 0x106, 0x6}}, 0x20) mq_getsetattr(r21, &(0x7f0000000180)={0x8, 0x100000000, 0x1, 0x7fff, 0x80000001, 0x8, 0x8}, 0x0) write$RDMA_USER_CM_CMD_LISTEN(r21, &(0x7f00000000c0)={0x7, 0x8, 0xfa00, {r22, 0x8}}, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x40000, 0x0) recvmmsg(r1, &(0x7f0000000a00)=[{{&(0x7f00000007c0)=@l2, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000000900)=""/252, 0xfc}}], 0x1eb, 0x0, 0x0) 16:57:11 executing program 4: r0 = dup3(0xffffffffffffffff, 0xffffffffffffff9c, 0x80000) getsockname$packet(0xffffffffffffff9c, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000040)=0x14) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000080)={r1, @remote={0xac, 0x14, 0x14, 0xbb}, @loopback=0x7f000001}, 0xc) syz_emit_ethernet(0x4e, &(0x7f00000000c0)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], {@ipv6={0x86dd, {0x0, 0x6, "d4b36b", 0x18, 0x6, 0x0, @local={0xfe, 0x80, [], 0xaa}, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}, {[], @icmpv6=@mld={0x0, 0x0, 0x0, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}}}}}, &(0x7f0000000140)={0x0, 0xfffffffffffffffc, [0x80000000000, 0x214]}) 16:57:11 executing program 6: syz_read_part_table(0x80200000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000640)="5244534ba7011c0000000000009c9ba2000000080074b8cbca71a68025", 0x1d}]) syz_read_part_table(0x3, 0x2, &(0x7f0000000180)=[{&(0x7f0000000080)="59d512b9e232e9b0f1a4fb4e56e8de863dacdf7b2bd526da6cea1c7d787eb42c881e5abe91282aae9401d848504fc5c0f74ffdd6b5f8642d364e77776c7753c4faf5c2ea2fcfedef5fb5ea2be9578ef85cf0b5ce29f359b41f80ebd2e4afa313fe1bf61cdb1277f7c2ad66f1947acce0d9f0a216c4ffee4872ebd79d1474898716a6fdf8768a365695bfb2209928811a91b55481c771db38dde0fe7eeb720439a4eae2b0f5c984c90c19cda1ce64fdb5d369d2201162b1ad2c6052e1fa46c31c8b2b1b14e56e195ba789203e4d927f373fac76b6819f7b0055c4769b786e61fedbd249d86fcbab50872e6c647f9da3b1f4506771e838332cf8dc22e17e", 0xfd, 0x100000001}, {&(0x7f0000000000)="84c39a6af1168f9d9c0ad0c3dd915343855c68f99cbff7079adb9795", 0x1c}]) r0 = syz_open_dev$vcsa(&(0x7f00000001c0)='/dev/vcsa#\x00', 0x10000, 0x40000) ioctl$TIOCEXCL(r0, 0x540c) 16:57:11 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000010000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:57:11 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0xffffff80, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:57:11 executing program 1: r0 = socket$inet6(0xa, 0x1000000000003, 0x100000003) r1 = getpgid(0x0) ptrace$peek(0x1, r1, &(0x7f0000000000)) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xffffffffffffffff) keyctl$unlink(0x16, 0x0, r2) [ 314.494243] FAT-fs (loop6): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) 16:57:11 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") bind$alg(r0, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm_base(ctr-camellia-aesni,hmac(md4-generic))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000000080)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r2, &(0x7f0000000200)={&(0x7f0000000180)=@pppoe, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000240)=""/135, 0x87}], 0x1, &(0x7f0000000400)=""/166, 0xa6}, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x80000) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r2, 0x84, 0x66, &(0x7f0000000040)={0x0, 0x4}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r3, 0x84, 0xf, &(0x7f0000000300)={r4, @in={{0x2, 0x4e23}}, 0x4, 0xc723, 0x0, 0x5, 0x1}, &(0x7f00000003c0)=0x98) 16:57:11 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)="65787434f6", &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) [ 314.583710] binder: 22313:22329 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 314.592498] binder: 22313:22329 unknown command 4743953 [ 314.598007] binder: 22313:22329 ioctl c0306201 20000000 returned -22 16:57:11 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x600000000000000, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:57:11 executing program 7: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300)='/dev/net/tun\x00', 0x48000, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'vlan0\x00', 0x2003}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x6, 0x800c0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r1, 0x84, 0x65, &(0x7f0000000040)=[@in={0x2, 0x4e21}, @in6={0xa, 0x4e20, 0x3, @mcast1={0xff, 0x1, [], 0x1}, 0x3}], 0x2c) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000001c0)={'bond_slave_1\x00', 0x1000}) 16:57:11 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000007cd0000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:57:11 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$sock_int(r1, 0x1, 0x7, &(0x7f000059dffc), &(0x7f0000000080)=0x17d) 16:57:11 executing program 0: socketpair(0x0, 0x0, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet(0x2b, 0x5, 0x0) ioctl$TCGETA(r0, 0x5405, &(0x7f0000000000)) connect$inet(r1, &(0x7f0000000140)={0x2, 0x0, @loopback=0x7f000001}, 0x10) connect$inet(r1, &(0x7f0000000100)={0x2, 0x0, @broadcast=0xffffffff}, 0x10) 16:57:11 executing program 6: mkdir(&(0x7f0000796000)='./file0\x00', 0x4000000000000000) r0 = inotify_init1(0x0) msync(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x7) mount(&(0x7f000016d000)='./file0\x00', &(0x7f0000a2aff8)='./file0\x00', &(0x7f000035d000)='mqueue\x00', 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) inotify_add_watch(r0, &(0x7f0000ac5000)='./file0\x00', 0xa400295c) r1 = open(&(0x7f0000fa3000)='./file0\x00', 0x0, 0x0) dup2(r0, r1) 16:57:12 executing program 4: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$admmidi(&(0x7f0000000180)='/dev/admmidi#\x00', 0x6, 0x200800) ioctl$KVM_SET_ONE_REG(r1, 0x4010aeac, &(0x7f00000002c0)={0xffffffff}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_open_procfs(0x0, &(0x7f0000000140)='fd/4\x00') r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@textreal={0x8, &(0x7f0000000240)="ba4300b00bee0f017edaf02114650f1ea7f07f0f20e06635040000000f22e03e0fc72dbaf80c66b80fb2578d66efbafc0cb001ee0fc75ba2f40f3805800060"}], 0xaaaaaaaaaaaa84c, 0x0, &(0x7f0000000140), 0x10000000000000c5) r5 = open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) ioctl$sock_bt_hci(r5, 0xc00448dc, &(0x7f0000000540)="96a449025efedfdf75864f6335b706e1a05d3726c7024a4e091b55100a63f437cc529818a9cee427200023afbf2bd3cd3131cae5ef84fb490b1e8312c2da57245d85881429667c8ec2162d7ea5bb7653e8c30e47845d1b45cc8cd10658d0d35a943d9dacb9beda82837a9cdfdb6828f6eb5362d4d7fcc2232b12bcc68020ad6fd37dac27edd5ba25d9f3629975a0cb37d052838e5cd36b0f10e2dd43") r6 = openat$null(0xffffffffffffff9c, &(0x7f0000000500)='/dev/null\x00', 0xfffffffffffffffe, 0x0) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000080)) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000300)={0xffffffffffffffff}, 0x111, 0x1009}}, 0x20) chdir(&(0x7f00000001c0)='./file0\x00') write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r6, &(0x7f0000000380)={0x15, 0x110, 0xfa00, {r7, 0x400, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x16}}, @in={0x2, 0x4e23, @multicast2=0xe0000002}}}, 0x118) rt_sigtimedwait(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000200)={0x77359400}, 0xfffffffffffffe9c) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f00000004c0)={0x5}) socket$inet6(0xa, 0x80000, 0x5) ioctl$KVM_RUN(r4, 0xae80, 0x0) 16:57:12 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:57:12 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280)='/dev/sequencer\x00', 0xc01, 0x0) syncfs(r0) bpf$OBJ_PIN_MAP(0x12, &(0x7f0000000140)={&(0x7f00000000c0)='./file0\x00'}, 0x10) pwritev(r0, &(0x7f0000000040)=[{&(0x7f00000000c0)="04ce1e3081d96357c106fd8b38879a09be37045c7d6933f84785f708fa5bd84339d94e4296c9e1df0038a5ef1624a2399d5c9429bb370d074736ce6d54359877b22dff65074c2316bf789a0a199c34dd856baa299304ca0e2c6b59ffadfc915dfe251031eabfe9340eabd35e02e70a7e65f533a3b9e1eb95dafb9fdc809dc43be50f8cd2b00ff6679549c38ca3c2901cca5f5775cf047ad6b71bed61603876861a52dde5ba80a1c62f569518dbe23036cc115b3382943738f42143a535c7156564da753f652d4c0beea984528f7b2c7256ebba375bfe2eb8e63bf8a62fd856f2340b60106aae3788ba3582b1c22ba0206cea2dfe730b02ecf0daf0800e4e", 0xfe}, {&(0x7f00000001c0)="519ad675269b5aa01adaf40d0f29ddb23112c5cb5f80a8a120464e7b779943f17abb956e1a33a3de359b0fd5c7c32098a054c58e58f6f95da68f94cd1365c2c82ab60266277de83b5040a758ad49131d5f98ad304d61b5cf9736f0ae9d46ca9bd3496ba179cb27e2f0804d230f9033f6d6c8f51316693113e894ef86180eb7d481b6c89514964ef278c79d226c62865690068be66c9e62", 0x97}, {&(0x7f0000000300)="a647384103eed1b9a26e2dab94d44537ee8b8efeff5e41a887a692ccb2038db44f81f4281a721dc4dd7a378f7d7f395e0574dfdccb05330124585fb73dffad8734240dc7fa9b5fdff818b46ebc268fc1ed95614fc461c783c265e892f2abd709dfbd2c30d94f9f11678777e5ad9d4a", 0x6f}, {&(0x7f0000000380)="1aa09db7f9b42b36fd04ced99f8305b5927d9a60fe755ab273ce5fa1612774ee0eda1ebe46838f8af4e17f9d4fd0ada10c15a842b43035259d01ff11f8d136cabe5133fe0e50430f150016ec4fb18020d513bf1e4718eb7ec92f0ab1b977d595c22835375088d3d7a5e80badc46f68e888487fe8d36ccf240a8bddf749324c8e8305aabb47553115df84cc229e95294634f25805da38838f6b933390b4223409b061d575e1733d64cc023176a300b190ee398b905d5c66b9b99152b6e7113988ae83dc3299d813f78133187a125935fde2f47ca006ea438df6096eaea595f64ac1c7d0581665bf376de8b8e993deabae4ff599c64b7c1961a71f", 0xfa}], 0x4, 0x0) r1 = syz_open_dev$amidi(&(0x7f0000000600)='/dev/amidi#\x00', 0x100000000, 0x680000) write$sndseq(r0, &(0x7f00000002c0)=[{0x10000000000081, 0x5, 0x7, 0x0, @time={0x0, 0x1c9c380}, {0x100000001}}], 0xffffffffffffffbd) creat(&(0x7f0000000080)='./file0\x00', 0x4d) ioctl$int_out(r0, 0x5462, &(0x7f0000000000)) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r1, 0x54a2) 16:57:12 executing program 6: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0x10001, 0x40000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$unix(r1, &(0x7f0000000040)={&(0x7f0000beb000)=@abs, 0x6e, &(0x7f0000001600)=[{&(0x7f0000000080)="58fad83b04e34958b9e74dd268645fa9214551d8d5ec740d0b2f226121245cd65f25274ab6cc9fc1be80d67eb9ea1d5a5e94b5ec1c53ea50b1299978291dfab92369a8a3838e4739ade08f0651ccfe340d88d999bdbc8266d833e3084f5bc7e65b631a5df7cf55ca4b509f", 0x6b}, {&(0x7f0000000200)="542f029c714f9a946ea99dab206136664d2f5ab7fdbfd550decc689de113d33d541c52725bac5c6a9dc1eb30018b9db0d91796914064749edf7621170045514e45839956be089ed04b4c3aa1cbb9eb5ba0237ae5e0eb589b83e1cbaebe7ff3fbb9979e4ce98c9deb519e0ae7d52bd74ec2f0580a80799b30c64b8dfa7c46b79a40641fe983ce4c4f99ea56938378e2cddcc25f05c8a7909431c74a183fe59fd2ded19cc40c1a5827d6c7f8fbcce568c8844071211807fe3ec780efd9eb08130337e85cc5a897122154e1144b45967d7cb260a890b42a749f3ced12d1ccbb4f", 0xdf}, {&(0x7f0000000300)="e46b955c4688a1017aba3ee78579e801c2c8b8d695f3665f8be6648d064ddb706d2a9709907ab0d9ca9c8d68dccb97f3399e1bf818d8bad2bb3c1de35f0dad1dceced5b853834cec573ac99cbde51c15c3e7fec3e2dbc8ce1d5f8fe1f5db0421c14fcabd384196805dcc069450673b8f61085df128f9b560e9e844728e977daee4a9d64eda8718928a7ca74653234f04b1087c9a725363586be98f31606348b31dd51edbc12a8f7843de86cc9ec08386dda395928cccf262cab9b7a9cd5f2316d8f258b968dc1b7801fe8c605b230b9c04e0bc78dbee7eb309709bb4c0e9c6f9641256bc7085f97bfc3c3e418873c22abc3ff3c381b8900093a092385088100cca39f06c5f2f5291c6339b80e9cbf676153c666d984a6ceb5933a18bb9edde48abe30d09af6bdfdb6c961687ef28713846cd4fbe544747509a881c64e796b6b54e9833d1e4352ba5236d66b65c892aa8d6f2377e5bd6129325051a58a20eb21b4ad170d85da0974a35f59272ea4537cc081db3e41b3010ec4aa91ca61030bb6b91fe79ac8cbd685efd9409a5a9f5e4ac089ca796232b66e4fb285dbb1991786c56246329f6ddf024449ceb1bcf103d604aaf158250600a059a5bdecc1ded05062034619e305d173f9c6c84719528ff4790bed344120460fc44afbd0c5456dda33a50c94915c7401cbef046c68b0facb6526f92cf57a14b4509f6b885f922b4274aa5c2c210d0527b5726240a1b1e65d26bd00298fcf46019dcdf738120bbaac813da4881c6bf2134e354ff87f382711eb9cdfc1508ed3260cb45821f9af25f5a940b75e6d0759b2864e5ceb3e16349165dde4c5d45837118b8f439210529330e136c4f7e07fdd88c4d63ec9fd28b0f74e302a806cbc3ff2331998399bfc5b5a4f69f26445ecc09db88d811f971a823f50aadf692854790239b1a7869b25712b37bde54fa1a7017be1ec4c41aa136a73b5355e74504beac0d84d37de0f7d332feaf146c4ec3e7e067d2a0ef2f33597c670f7e268a97e5bd0028e1df120812d7e4f0670caecc2b97eb78ebf51030a45a8fabb7ea3c9c781fac054e22a62ad4c3ca8c704b54f9e71a8e2390c257467ca992cbe0374f8e03331c350fd0f16a3f353ec5c48a6b74176c6218683fcea52b57aea8d052247045732aa57f09c071ba7bd6300f896d9a01692e9d0a860b925d1c1b9988cff69f61762fc8f61e1f3bf26f14504e4aac8c9815384c547522edfca0494a7adae7c974e831c0efefa68cb1d3bb57f10c5771ab9f6bba482072c131fdfc72455d7a8ba61ca463a43df98f275d718d3d7edbc7b0edb39101d1d4f2ddffe9a6b35db0d12c033dc3391d66295352f10dc42d44e69c09e103164567262e9f3a1b62f9887ed4d32b11ef46ff60efc50e66882ab247ff44ba9431868808ecbfe08098fd30d9320f9213d6a70fa2a810b0b30ee0e11a8d9d6348f169f1b767340d79a2f39bb403edb4e9025ce0454b82cac72c7e67aca542d089b98065196a86c5fd99089c6fd514b111d575942483cf92ff721968ecb061311beb4694d01d71cd46c3dfe10ee6467224568f7f2e468467c15b4adfc7f1ddcd55ec01393ea1c4dbe452e647a0edb1f117c0d695de97c4b32493fba0a6eaa8cb86c076e228fecf8d8854071444a40b6ab03c67ba64218b9208e82c2ef027ce808932571f5cd83ebb50da9ac45f39c9a5a8cb23d7fe26eb1355f53164ada9b951a1b0d9f0f139c735f3b5caf908e5bf3b7a86af052ddbd396da42a6585488b05b0422e8b8a883e4cfbb5c1aaffad823e0d50d9a39df1aa03abfd49318a0f1f12e57d7f1484649e464069a54e5a0c69a2137c5d160c5ea66e322e6f0b782946bbf54d9329039c2b39148edb7164d69a56bb168cc8878f04e772d0947d4c806c08d9d07e6a5387e127a49eaaeb6e10b5d677f3e92706993e7fd3e9117d8c829756a02e7aed5fcd8d85047f8abd8e2fb0e12dc25dd6c7873e08aa06ebd5b5f0d4fca5a578f7bc135466c8376b86ce51a154e4b8f80e79ca4d5009d12c1a216add3a9743748fa17813c251ad7dfcb9066569676a8529311ccec8e099b86275c757116fa1ded11d39e6f368d2fdcfad995db7a40905666a1c5f41f27ff0c3ca4a8507a849bf970362bd845dc38bd32fe702c13ff411b77df05f5720c3937e260e78bb5e1a6e18d16de0346ed1c846444a42eb567743e1a9b983af12834de3a81a9a79e387c2df88f652582461c6e6e8c55bf7cae9bd89280fed0191a72a0ff1692243a9c38f0d47537d1ce0f2b3a2007d798d3634416884d482fc5892acbc9437f6fa558e93049d89da1619f322dccdcb6de5f6c5fc7f3217ea29f7cc560577d25cc97cc5d8bf7d6ff39dd23a80b2d3073be619fd0ebb3fe90c845de9ddfa41c474c3039912451050e711cc47cf3d0885d20f8ff04b776419ce9fe8165b6a6bd6e34ac8378e19034d6a8d1e1efe227150e6789d7d0b2cca8985293ca89d083e58161623ab6737f6471527d732f1451e0b01301b7eb565d91c2bde02d0867ae5accf1b646576078501ec0464ca7fd971b2a8c3380057de0b302f1593b1f81320efef5d0654165305363ce2ea6f32de72041e52224e7825bd363fbffc5ed74c3f63cb1c39f9653811665cd8b7635229ad73972f9473771d0ee157190a3a243db12f806efab548c5cd131ac3560de106b8fdea1a66b2a4af5333f81c4478fe9af60477533389ff000b5d510ea8d34dbaec123907dff98e603e8257767e66b7dd333f0005c6885752332110b122f8d54c0b079afcc6fcc028de4ed0bafaedc54bcf9fec723dfaddab34e1aec30f62c3e99a2cb8011d260e45a04146048409f4b423565d8c1e1664c7401ef05d60a83f5b69dfad0acf2bb9e10233a72ef8f35d12affb3598839ffe56edfcee8d8b70cd4f714b063685e98ea71453dadcae1d2ce5a0c8d4186516e16517f22397f88181a5ac7ea793561bca707f54782f52db330d28f70bb69be1e58b986aba8d837821f72342350b005bb0e33860cd7dac4ae17838163ef54a029c487aff25c5fac2807887f41ad6d64e96f28f40b23d56a3f199215377cd9239822d95b59c1c7e0b6fe760520c424ce113170ff85ef2b5d2d33f140e65d2db6f06c5b3bb9f38692218c85abcbc464a07e0ec36c62d6953dfb5797401f1f07b59f15db2b864eabe2dba83172d85d3483a6a0fc32f0b969f65684bcbf6e634c6e5d58bb5a3ef184f04ccc7bb5f4c67791cd1a4b04ca35e474ea2712fde92b0a3e160ca31e9556376b83055a871fab598cf076260bc8cd693e6eb39165495ce6e040291f47ed0e8ebac4fae36873171857033abfead1b60409599bffdc294db3ecd43b0c7948c4f62542041083a2727355147bea7c448cd6e19e31793f26d9970865345f5147522381c24533ad0e966f5a1d09788aa14b977e2d5a1687751113afca1ac28bc23ac9c9972639d4fa59a1c1a5f4f63d575886b4547af5b3b6e463ba219248d6cd11656080c80b2bb3dfa46527c15a71ad499729d6fc9e7eb1bb70b82ddbdff4189836744d66e676e1c68a31ff95491aac4b953acb8b0978e80b95d373a756d143db479ed20546df50ec63e5546140e0d1a5d8ef6e20ff6cb6502efd07f14d5c10dc6472c8aad88cacb59bd640a4f1912a450513c040ff584e428b0667a4c440f8f9c3967c08555de65a2f46c59a2e34a7354e2d05062f484034f97fa3773caeefa7c187ff0f39faacd63f6e8be55f46eb38542bf66c04c4dd2aab723a835bb9641d43e3b596452aa28e3730f2d7799cff1234f64f1c51c1ef95e7dd706f889ac320d3af9887220000aa73cf56d1100a0eb8677df96ab5aa906418bf195f7aa2e62f9009d4c7ae180467e91ec9551954ada7d6147803496e1b0880ce29af704ccd0cf6bf315e7cdf2b1f1f5a2755cfeb17ee02768edf7b1ef3bae92354d9f0a2dc732b4c394290293c0cd9a705e4a6dcc16e3975d2c4462c3d7da25451b09cf9d45838fa7bf3cbcb311af0ad0bca5daf33a61960c95febf7acb46b3aeb1ccf78dfd527e0bcf1b3d7b683c532a763d6b5fa61ef1a1b38c7c4c033c98c9e81f56d252c269af981bc230fb8c6c69aee7c06e3d31babaf110d2325b615567b2e03f49d22a3d73151f3237036b79be8618e2486ce5bb19746fc8f87886f7759111e67ab8dccf8f03384c4d808eceb1730595951c72a2d4b98644b4eb397480b624a58cf05dda9820aed581c03b92d3b04dbbf2ebc102e3b4e06d4f29b6f4e5229a660a6d1289859abb158058a639dd7a1391198658b231947e5f1f03fcee974eae19225e1b89a9cc8b47678947b8f174a1747fb632880c62ff6470ea0c7fb394dba74ee26cfb93dddf0f90ce2e2c915ac2249436b810ff719717d86a1d31d88ebbe76476a1a67c6b0d6ccbe36e66bd035367bc37510f36bc56a9be34b5739d9fd3519914200c11f611818b023191eeedf61c613fe1b95baf9ee72733db5cdb7e74a8de24845e456879ebad9c08c55fb6cc02e3aa236641731aa4266fb3d1e40ada2861d4a64d8baeda4e2eab6cf35128845c69dfabbd2ff1f7cc5f9d1878f6354df4901134f293c859210228d22222d6ba936902331d41686cecb83c875f4b097bd40dc71a0c5c48179a86329cb6225ccc6a572dac778b5ab6da0eded68d40d5f3cfd326b1523ab3b48e69c640e24bb84f4ef4b8d5eb104527244da905495ef91edfd778b6dfd477548faaff7bf915152a1681bc43b47bc874c0b028cb00c7985f9f056392ab26e73f99d9ca6fcfb7358d7d6644ae0a94741cec986a8593a45c1d812efeec14935fcefa7a8bdf25c1e80daf788cab7d285658d559652786acf8bd8351e4cf9968986c4208d63ebc19814977e33fca80f43417f4a6e44fb7871cae49f036183f256cb0860c52c2de48216629de80c64801082b16416b3436eb607f56bf2c495b453bb428b7dc098227ee05ac21c1dbffe3b49a8b8c637e49d51315f475834fb622609a93f023a645e563fbb440e3723370cc0100031d2a12573443371333fd3b8ac3a6f45a8d9d8800467b98ec55c9960bc0f87969934ac1a8705dcc3f42837e1bbf2aa8f4794bd8f99ca501bba87b9a84c4e493a951e4612baf7b34839445d94f36ddf5195652a87aeb3979155e15d43fa5365e9dd6b9070e554ebfdb81ce47c71fbb8465e023871855c09d375186f87792c44fd486fb92caad8f4c81d5783f4af755f9937781c8d17f1d41ba1a05bf0b0fb034bc2608174ad578adfe84e636fbf1a0e3e8154b0ccaea846a7141354efb7c166ecac1c6507e2b830f4dfe8ce84e1299a61882fd2314d17ce086a0d5950ae422eb5c9338d4f09c96d3d0b62011686d9038178538ddf09115f9aea8e991393d04c103a3f59a40bf9c6d88e7310dd25b0a3fab70007b4adb90ad06bee11d2d728ff681730693cd4e3b0bba21485d5e54e20aa24bc56d985313b6de726fd4d678abd2d57bd896e26570b2d8d5a4d7e29c5f7ad6461806cde809d262301bd123f600dcc3ffe3937e7ebb0cafd6a05097f423a014eec904cf5da44368b17cee8cfe33f93d6b29827037259805fe215b6fcc126f3f407000a7f4c41108c589e407cfc816225e785961310e12b55cb53c963a998a0f2be5cf4cc852def29c8f7aab18de395e6da8ff58d86ba3696d65d8aeba7680ea99f798487bcafb8be97ba54e96f7e30b4009aa1bd264ded5463a4e2d67262bc19b5f52664a147a139b4714558062472c674cbffaaeeb162fb6d80efde9c30113c6823dbba6e96aee5f2f3", 0x1000}, {&(0x7f0000001300)="d615baaefa6ebebba325fd9400a3658e1ab47d28af52e71c2ea6ccd96213c11f8e06e6e10859a80ae57894a1e288235711c9bf68bb1bdfade29b1965b1925a3f39c5287f0686f4b011f2d165f6b9694dafa6b6a6187e3e9ea17a762796cbc118", 0x60}, {&(0x7f0000001380)="d435fa061851d29e395ec3f88ada79738627944132f2538d1308188a610546fbbc113b19bb0232947b55eaed91ad5b4e16c8506f3449aba2370cb20f4d1dc893760c832e4249b782e60c0d4569a669d341971e4c1451975a304f055dd6b62fa4b07e62cb245c7c85cd0f428c6aca4908b6a9d18eb1929242ee8db05355dddabe241d9a29a27def802ff09d2331606644a5c6764079a7f196c576505d38b04488dd2ea26f0594ea627697b477d54afa389eea802cbcd68aac8f0bee5051a7bdd07eb0b6ff5cb08a6cb12fdb789a9a230f7f396fe763ba697f63", 0xd9}, {&(0x7f0000000140)="f61cf3a32104fec16026d973bb2a8d758fb70ae3347d2987ba34aebbe25dc077c991924c18bde7105452224e5c1d8bad6cb10f39b1fd908cd38c49", 0x3b}, {&(0x7f0000001480)="855f5b105f1498a7cb43b002688afd811b6e5597b327fcf3601d92a7f73ca059b77c12fd2df2bb288d1502875620fa75a0a111bb8e9057cae1629ccf231c8d", 0x3f}, {&(0x7f00000014c0)="fddbf6144ce5fcaaf330464f87ab", 0xe}, {&(0x7f0000001500)="1364bc5a98dd2399b77f6c4a709e8d1226ad8208664bab2e9e2f67a1c274bd97bae079b7fe767bb1e3798ff628abdea9f8e848d4be43fb2b80566bce0062272d9cd4da48e01953327ca826f7c244a3200d52086044c92bed9e8422e9e2237700f3b0d127c40979e933a5dd63fef72ba665a121d1a0bf95d6f3056e91526bcc7bd1a42ad4b824b55e6d229d1a946f22a01d8196ef8e209de377974576d7d3b8775e63dc58ac47c9416d39f77181c81b367f9e6e8b4016209305", 0xb9}, {&(0x7f00000015c0)="de71c222e168e87f6870de580f875f90af4b2617e6cc00afd7eded247366a38757092e71beae367c4adc9872cfa5934026f89b70", 0x34}], 0xa, &(0x7f000053c000)=[@rights={0x18, 0x1, 0x1, [r1]}], 0x18}, 0x0) close(r1) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001700)='IPVS\x00') sendmsg$IPVS_CMD_SET_SERVICE(r0, &(0x7f0000001800)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x200200}, 0xc, &(0x7f00000017c0)={&(0x7f0000001740)={0x44, r2, 0x300, 0x70bd29, 0x25dfdbfb, {0x2}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7}, @IPVS_CMD_ATTR_DAEMON={0x20, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0xa}}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth0_to_team\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x401}]}, 0x44}, 0x1}, 0x11) close(0xffffffffffffffff) 16:57:12 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x7ffc, &(0x7f0000000100)="3d0080c8be4190a2dcaf43c72f0f010007da9162172ff773004f6e1ca1a5c82e34579bfe22e75f3b7dc0007705622784311da8c751a15c86cd286eb35d05b6a5060f97322280bcac85f9e34e7dff9a10aab70000832271c964c75901669738280000000000000000000000") r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x800000f) fallocate(r1, 0x3, 0x0, 0x1) 16:57:12 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x1000000, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:57:12 executing program 7: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x2, 0x0) writev(r0, &(0x7f0000003440)=[{&(0x7f0000000200)="681604810bf9fcffe352b28ef7e9f7d4363ee17901a6850e4ae33c2194e48d61da7263f1c233feafbc9f424f80f34c3e59763a766f63f65a8c5ef063370f487fbe302b7a68ad55c34c3afd8e5c0dfee3c3fe720232ffb27b75d8795446b648feb6903c1eeacdd8fd4c4002f2911dc7fb4e408ccdaeba7b87024901d7e6a2aac4ee3611ec9188215005e06f4cdb31c958ae5e13a9e058a0f9c773d668fe6afd6ae2470a417760376ff88272052872baf485c50023934860653afae3d24e721316", 0xc0}], 0x1) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) ioctl$TCSETSF(r0, 0x5404, &(0x7f0000000000)={0xfffffffffffffffe, 0x0, 0x0, 0x3}) r1 = syz_open_pts(r0, 0x7ff) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)) 16:57:12 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000000000000200000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 314.949125] binder: 22379:22386 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 314.957832] binder: 22379:22386 unknown command 4743953 [ 314.973540] binder: 22379:22386 ioctl c0306201 20000000 returned -22 16:57:12 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0xa, 0x20000242, &(0x7f0000001000)=ANY=[@ANYRES32=0x0], &(0x7f0000000100)='GPL\x00'}, 0x48) r0 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0xff, 0x842) ioctl$LOOP_SET_FD(r0, 0x4c00, r0) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f00000000c0)={0x2e, 0x23, 0x2, 0x13, 0x6, 0x7, 0x1, 0x151}) 16:57:12 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:57:12 executing program 6: r0 = inotify_init1(0x0) fcntl$setown(r0, 0x8, 0xffffffffffffffff) fcntl$getownex(r0, 0x10, &(0x7f000045fff8)={0x0, 0x0}) ptrace$setopts(0x4206, r1, 0x0, 0x0) ptrace$setregs(0xf, r1, 0x685b, &(0x7f0000000040)) rt_sigqueueinfo(r1, 0x9, &(0x7f0000000000)={0x0, 0x0, 0xfffffffffffffff9}) 16:57:12 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x100000000000, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000440)={'vlan0\x00', 0xd803}) 16:57:12 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="025cc83d6d345f8f762070") setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f00000000c0)={0x2, {{0xa, 0x4e20, 0x6, @local={0xfe, 0x80, [], 0xaa}, 0x3d63}}, 0x1, 0x4, [{{0xa, 0x4e24, 0x80000001, @loopback={0x0, 0x1}, 0x6}}, {{0xa, 0x4e24, 0x1, @remote={0xfe, 0x80, [], 0xbb}, 0x8}}, {{0xa, 0x4e21, 0x5, @ipv4={[], [0xff, 0xff], @multicast1=0xe0000001}, 0x3}}, {{0xa, 0x4e24, 0xffff, @mcast2={0xff, 0x2, [], 0x1}, 0xfffffffffffffe01}}]}, 0x290) r1 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000380)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0xfffffffffffffffa) keyctl$get_security(0x11, r1, &(0x7f00000003c0)=""/200, 0xc8) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000080)={0x77359400}, 0x10) 16:57:12 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[]}, 0x1}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000184000)={0x2, 0xd, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x0, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in=@multicast1=0xe0000001}}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}}]}, 0x80}, 0x1}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="0213f604f00d2eadc2173818f552c7b51d57f0eb6c85e3d4b408deb98dfee7e23b3749d34d118b2d91da2033cc0fb04ffe18aff18486eb67a7"], 0x10}, 0x1}, 0x0) sendmmsg(r1, &(0x7f0000000180), 0x400000000000117, 0x0) 16:57:12 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c4000000000007a0000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:57:12 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0xff03000000000000, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 315.166619] binder: 22443:22447 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 315.175482] binder: 22443:22447 unknown command 4743953 [ 315.181169] binder: 22443:22447 ioctl c0306201 20000000 returned -22 [ 315.193401] binder: 22443:22447 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 315.202110] binder: 22443:22447 unknown command 4743953 [ 315.208160] binder: 22443:22447 ioctl c0306201 20000000 returned -22 16:57:12 executing program 0: r0 = socket$key(0xf, 0x3, 0x2) r1 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x8, 0x121001) getpeername$inet6(r1, &(0x7f0000000100)={0x0, 0x0, 0x0, @dev}, &(0x7f0000000140)=0x1c) sendmsg$key(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="0212000008000000000000000000000002000b000000000020000000000000000400000000000000000000000000000000000000000000000000000000000000"], 0x40}, 0x1}, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='veth1_to_bond\x00', 0x10) 16:57:12 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)="65787434fd", &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:57:12 executing program 6: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) prctl$intptr(0x0, 0x0) r1 = memfd_create(&(0x7f0000ed5ff2)="73656c662b65746831a470703100", 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000100)={{{@in=@remote, @in6=@loopback}}, {{@in=@local}, 0x0, @in6=@loopback}}, &(0x7f0000000000)=0xe8) mmap(&(0x7f0000000000/0xaa2000)=nil, 0xaa2000, 0x9, 0x88011, r1, 0x0) setsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f00000000c0), 0x4) 16:57:12 executing program 4: r0 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x2, r0) bind$bt_hci(r1, &(0x7f0000000340)={0x1f}, 0xa1) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x80000, 0x0) 16:57:12 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$chown(0x4, r0, 0x0, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0x3, 0x80) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x81, 0xc1) linkat(r1, &(0x7f0000000080)='./file0\x00', r2, &(0x7f0000000200)='./file0\x00', 0x1400) 16:57:12 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000040000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:57:12 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00') r1 = socket(0xa, 0x1, 0x0) fstat(r1, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setgid(r2) socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0, 0x0}, &(0x7f0000000140)=0xd5c7ff40213ed29e) r5 = syz_open_dev$vcsn(&(0x7f00000000c0)='/dev/vcs#\x00', 0x4, 0x101080) ioctl$KVM_SET_TSC_KHZ(r5, 0xaea2, 0xfffffffffffffff7) syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0x800, 0x20800) setgroups(0x1, &(0x7f0000000040)=[r4]) setresuid(0x0, r3, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/sync_sock_size\x00', 0x2, 0x0) [ 315.375366] binder: 22471:22480 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 315.384225] binder: 22471:22480 unknown command 4743953 [ 315.392185] binder: 22471:22480 ioctl c0306201 20000000 returned -22 16:57:12 executing program 7: mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(&(0x7f0000000000)='./file1\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000180)='overlay\x00', 0x0, &(0x7f00000001c0)="6f1005fbf46be1a1e72a4454ee5108635bdec935bd3baec00442bbb30c4c7b81255c") umount2(&(0x7f0000000080)='./file1\x00', 0x9) 16:57:12 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x700000000000000, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:57:12 executing program 6: r0 = syz_open_dev$sndctrl(&(0x7f0000003a40)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0x40405515, &(0x7f0000000040)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "73010000000000000000000000000000000000005231587200f8a8e4000000000000000000000000000000000000003f3613a8000000000700"}) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000180)={0x73, 0x79, 0x7a, 0x0}, &(0x7f00000001c0)="527e271b4389d28138e5645c4c347e1682e83143cb2edddb194101e300dc283105f6e6ba559456e0e9c6be8763a4541b008363c465afb583157cc57af86c96a8fbed7a4b11f83909ae50955902ed4dee48f125451c5e04720b92", 0x5a, 0xfffffffffffffff8) keyctl$revoke(0x3, r1) keyctl$revoke(0x3, r1) r2 = syz_open_dev$vcsn(&(0x7f0000000240)='/dev/vcs#\x00', 0x6, 0x204) getsockopt$inet_dccp_buf(r2, 0x21, 0x80, &(0x7f0000000280)=""/74, &(0x7f0000000300)=0x4a) [ 315.483353] sctp: [Deprecated]: syz-executor6 (pid 22494) Use of int in maxseg socket option. [ 315.483353] Use struct sctp_assoc_value instead [ 315.507458] sctp: [Deprecated]: syz-executor6 (pid 22494) Use of int in maxseg socket option. [ 315.507458] Use struct sctp_assoc_value instead 16:57:12 executing program 4: socket$inet_sctp(0x2, 0x5, 0x84) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x4b0040, 0x0) shutdown(r0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x3) 16:57:12 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4z', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:57:12 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x8, 0x4241) ioctl$EVIOCREVOKE(r1, 0x40044591, &(0x7f0000000080)=0xfff) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = socket$inet6(0xa, 0x3, 0x6) setsockopt$inet6_int(r2, 0x29, 0x1000000000021, &(0x7f00000005c0)=0x1, 0x4) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e24, 0x0, @local={0xfe, 0x80, [], 0xaa}, 0x4}, 0x1c) getpeername$inet6(r2, &(0x7f00000000c0)={0x0, 0x0, 0x0, @mcast1}, &(0x7f0000000100)=0xffffffbe) 16:57:12 executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) io_setup(0x2639cb9c, &(0x7f0000000180)=0x0) io_destroy(r1) perf_event_open(&(0x7f0000000040)={0x2000000005, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x72, &(0x7f00000000c0)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x98) 16:57:12 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x806000000000000, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:57:12 executing program 7: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = accept(r0, 0x0, &(0x7f0000000000)) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffff9c, 0x84, 0x73, &(0x7f0000001600)={0x0, 0x7f, 0x20, 0x80, 0x7f}, &(0x7f0000001640)=0x18) sendmsg$inet_sctp(r1, &(0x7f0000001780)={&(0x7f0000000080)=@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10, &(0x7f0000001540)=[{&(0x7f00000000c0)="f74b5a933bb42835331279be3efc09507a0e5717cdd0b5ff26dff3275b08997378376ccb7ef36a00d43806b6b3e454c8699447", 0x33}, {&(0x7f0000000100)="df12491c4019f09e6319678e7f1399da85b3ff07a7388d7f7e63e56102478d7405a8017ec3b2507d6b3a159e638963c514e291047778331e86e37c7cd6619bf1c8ce418b221deb9ee8a0e81df1526c4cbd26e811670805baa52a2cc32e266a603caf8b3b8578faf78c4f5babb83e82e738108749a90b44156473d4778d37fa5b9157a18aa06618", 0x87}, {&(0x7f00000001c0)="db92", 0x2}, {&(0x7f0000000200)="50c80456fb8921e9877efa2155f2f4a6a0a20185e6b3fb908b89081c159d74e23c4d7cc8ad8e3cdce57692e4457931a51d7752de714695103c5f842f1777b2da69383956d37b947779286e2dd90df98f", 0x50}, {&(0x7f0000000280)="356aa40c94cb92239e2aa297445838c5b60ef33189c77f6921a334bcd4cdf9c6ab94cba0c47866f99ee05f44299e172ed7c0f56968e7282735c0a1635088b88c3e23f2c5994e3b79adf15cf335f188d5a2618b07aecd85ee599c5f7edca72f38", 0x60}, {&(0x7f0000000300)="47f81feaaf9e6c0c0d1135a6497cad3484d0720bf918278888861754ac1e7a7b349054751765b4260b1a970d6ee4279d92baa19681dd1856892db1f6116ee7aedb9a4c0a2fb3628a7ffc1d707aea6b9c9f427bc6c90d355ce7a9ed7583c4327da5977e0d87d69eb908c268c531673d147b9fd7350eb373d66edd524bc9cee0e0cc9e1552c26e519efc99a2eac37467", 0x8f}, {&(0x7f00000003c0)="f62969c4453d3ebd155e9415a0820ca4e407c2095348a1fae8be498ea80f26ee2af7fb722b51b37818294fae408cd724b5695fb0010cd7ce4d4165bd69f485fbae83329dc6e30fc58941", 0x4a}, {&(0x7f0000000440)="a2bd5aea77f6ee64428ea4f399afab1cf441665825d7120d7975b642d7018c0855a55860b1e7a2f5e0f7f30fd8b64872ae2b138f1b3125a16283c0d577a57d32d15bc07ea1118bfc987b41ef16052aee86a42e7a3b388d0296e4170b6d1cdf9ae3e9d09e107d54e7ff48536c28903a5ad782ca40df11c53d4e3a4506fcd27f0c6bb33ade2a6499b267f5d645059a3fe1cf825966b6ff8712427cc9e5cbf08e2f92a4ec9fb625502f0640c231199590ceb107f06716472197d7d2c473", 0xbc}, {&(0x7f0000000500)="dae41e06bfdfd59790826e4719d0a566ae5c1af77d96c6ce8e4004759e94ef8e5eeb902df6dae9", 0x27}, {&(0x7f0000000540)="857b486650edfa669c2b093a6560924ed643e55151fff25edc0f4865cc90bec09221f6fa877763ab19f5f990d67fef6f17d27068b2ec293f0b515ee572ecf06936aba3184e862f3a51bf64998aea79670b17832bafe4a6af0f1e43f7b35494971e3f42e305fe16bcac09925029e6893ab331581da5409fbdb62caa96f3148a7306af88410a415ea5b43d4574d74cde0243409ba8d149d0c0730366cac260cac164aa5b48563ca21cfbba9f370b50355eb2d9f07e5c5c59465e5c4ab6eaba2b16ecc66887e37dd95f73572f36a6414da72d485dcaf0e310a7feb660e28bb32077d5f96151c191e4a1c54fbaa5015b9b609db7cb2fc3bd1bea728f989d1514d35565dfbd7e61fcb4c0c629a4a996b11fc936f951b643a339c4347d0bd5d87bb354bc27e2e1ebf4e9b5d3444d935cf6fa8306d060b310e50b794c9b029e75dd41f8c35f746a507036b7e71b774d0f6ae86395885f1c3078d6de7ade96894ff34a2a6817ef5178f049641803a43ea63686315d024f086c47ded35f6a647dc81fd4ed7c42d64cb754ebbbb2f89302bbcb2798ec7b66cb180cce67fb5a95a626beeed4e23a33aa818792426e9f16f6e6f3856b23e76b30bffcbad5ee567a1ed81cdc31f62e1adf95618747cd028ac5f222482eadd1de73f4005c73435c27cd47249634a6769bc9f3801e6b7e8180a0c29d795ec60f3e684d9310f10c788998cf66f44ec8938d10345dfdfcb9f4e8fe53149be597e1a9a34a528be4526a154460bb014ecf77bc83d0d93308753b6e72ec209c4a2b8fec555512ceced4d9032c68f3867cf14de930597794679343189964436c82fc39fe0859dfcf224714125137caed6ddeddefb00a2bde72098318fce9e142206d4d6940516b4f2674606970ce64f7195354fcd67fd0f3f8c858fa3afcb78febbfedaa8839e093f70d11dd06efab355e439094b551484620275ff41f90a026f9eb6665e38f2737a160b196c94b7b8ba4aa66ca712fd5b866de80a7a40462578f634e4bbf20341f3e7478987dda7c964ede3612e8b553a511b188d0fe192627d975421f6d13c340916ee54c43018c5edd09215895a4f0b00babacaf95e905c4a627b811ea6d8ea45b5804abd2b97f2b88acff698d2023b2fe3b82a1bc85ad622f972c41ac66e18132bed51ef9260d9772448de0ade739b4931d8f7f058704542434bc7cacee746107f62ce02ead3798d162bab75f050da0964becbea803569324662f94335343ef12f01459f1779d35ff474f2f55353b21236ac1f4c567c9e8fde9b3070cbb8a4a3f93cbf770183eb0534b3457fbf96f987b13855eec70d80fcae6a2adc42d2726c0ffbde84313daca8e11dab7ded3d88c4fa505ef3c00d2ade9a6f96e37b90ea818d042fe6fc4d94fd4d2399a03140bf0d136077a5449011482ca45012bf483bba16b462ef7bd08fb0914a8eda0f5a505af3085dc323786f882c4755217915fc59e6226ca88b1c636bad54298a64bf4d6725de3ca9df501aed85a8a735e8d7c97f55b624fe9e11ce209a633f6342c844c00b33f76e0969f6b5d8283f52e40f82ac00ba7284e6b7c521db7c2cdb10aeb711bfcdf2a3442491d30b30c5d01b191f2f30160301e6405a5639b23b3640d874c654e5e87451114e8618e34a584670309f6fd6dee5cb9ee46d94bd3e461834ff2de83ac645bb384c1ac8c493db1dbc891e09025d795b65e45eda7d653b7ef0b9a304417b9d22455fb37dc7b1b094a23fe00b00e75bea1f8eb013da3d0ee08ac067171cb7dfa2753c50fc17cc1d3e3a803fde2130d6a007e6058135efa53733ba3e2015f66bf97e301e670798b7cc82c476660c74f27aec22ba2e98fe682ed4ac5a41f0acacfea09569a092002b8db6a334beaf661a41a8b4f8d0e6d7328b2338d487d2c61691008f5574bc5a109f76d16bbe5ff82776df47d757fda199a1ef004d66cbb3c11532f237ad6c9ac3a40ae46ca20a7b2e3b46dd2ca301d997d25638f2d75a31db5ccc7353c90ddcf19458eb90a3b6d57ae53a9862dee6fe18cbe1b9727857c7376600e127a96c880d2d6e557e90a64da12934c55236744a942bf7b5fdccc4ecedaeb4983ac1d3b09a6fbdf1e8a459e0931705a5543870bd050446b4769c2a4d4dd8789f6d4b545b08b7853ec9a3d683b9539d7a611431878ba437c23168340ff7e420f4847fbc022287b9afca2a0eaa37999627212c128585f55547ced6b50044ff95cabd29c58c7a090966296e71d798ea83add28d3a32416c4cb3c6952654baaa62f0e1ad2109868ac6ed4f98fac231f710b120a00386596affd1d4740c232b9fe657741ead1f1aaf9e38f66fc3744eed88ae9f8bc6e70f72e1621a4adea44a7e563462d55a37b27f9bc59ea90c58cfed2afd0db6f8711fc9e928e6d4ab14dee4dbe0608b0e49d2285e9dca3cfadcadef2b32bca3d63798abd470053c934991d5cb07c092fc4465bd3b16f603dfc6d32df90ad1fd0d0a0162d47456de9cde41a4559bbe4772c9037544e6244d6b0018ecbce6341a899a634db6b317047a1c3ee19fa84335a80ca5383d45cb33c5ad6b6dd88fdf01d4e78123315cb40ba5abcc8cf95994e8ddc31a28353552dfce10ea648e55de8756c46d04c9708d3616417a1e26e499ea4957707bec7c91e7d60cf4b2807872178cd630ca35050d658f56bbb0373f182838bb42dc3f6647e0e8feae17b2a0860d1d053dff4bf88ae70c7062ff72e24f219bf274b6261610b9b0e8f5e3234f0549ac9cc2d5b8705d716f12f9c07c8061ca01090096ab44d746dcc29bbe3ca3386e2c97fbc1289bf495e0cbe1e0d162d0193e99dba39041121fa7b184d8a2f7bac26c9426bbf63dee4035bb23afa15cd3efc9feae6a4e75280da417b37c3cc86aa5358b94e53eb76e7c04927629cdd48fa09286c7c1932553bd421b3563b6f1eeb7704c389cfe3b128020b34c20060351a2c27f474f252a010dfc38b2d2225d8205a5e2d760ecabd17d1d0be962f3eb9122e25f8bf233931453b9cfa5179897f8db71d50bb83e2dd4c5f7cdf125a714e82e29bf5dea79ff3f1c0fc6e051d7686b3aadceb0a8240e3d0ce12dfe33d26fca4b89970e47657556fcbea56af69d556f8963dd5eb179ecbb470e6b8368d404fc2653231799c308094833a11a0a819d2075406a7400787fb8e369f8627215a0c1d57d47478a0a2efbc80a3fb96a9f70eea7004e1ccd05aa8be0b3e22fdb0d05cd050a1f03b28184e6eaa905a84e9cbf03cc50e9b887833549c31282fc9f6cad4368ff17a3e38308e45948b281a15c8a8855d83b229c41a851e706d3e1007b7784eb0bd5f973a3e43ee246f3d1453ad7f05ebcd3d22bc37bf8addc4ded186de09504deb9581c5700e94c8d25f8a64938061acd459d42a54a978e7fe8b134cfdbdda0e8170d38fe0961aa63632bd9b58616cd15bae28f472e0ae4b7cc43e9ab7c4148fdc7f6f5ed76ddfb2ddb828c99b0f7111fe69bd7b7e2ab6d3e38c381db373fb8d0e4594b2e1bd48154031e13d1561c78fc83fd5c9ec06d989eef514149a9b559209346b366b050a1e2181015229bbdeeeabb469372850608387d2f3c5cee928a99850432e326643cd9b9d5432a025f6991dcf4bc32def6460d92d614cefe7914d5617063dc5a7c1695be313942a50b6000ead8dc7f779ed5253aa353043ca3b6ffb3dec2ed53b809989bbc93f82649e18f2281efa19234749d7a9382920eb7ca5d5b3e20a0eb899cb58fba29d0c895ca8063ae96d3b57cfdeef34fb67ad8d8a89185172077f907e9a9a55c6836ae934ded10a40b741089825dbf8331dd1728e93c5cfa17a9582c072d7aae76373d81f72bd538d391bee3fb07073e86682ae3d9609bd8cf7adc46653ce3405c29c402b18ddc9c877902e1cc5f5538c528c98446384a6e675bddec6d5f8f3138a9a4d46327e13b6ab1a3bd31dfd05be284ece73785f902ac08c971b4ad9363bc81bc680657f8367e1fae7d62986d12b9581638a29cb966b7b43c2739f717ad57a1ef73b97f4961f8d3954de61ef83056da148a88b74864e30b7b4fa904dea532c3f2d3a4050c80e46d69447bebb876c9a9b52b540082e51364887ced7a35b9203195cb18a415e2b165fabe9c1fa21f26c7143184e23457219fc81ec5a06094ac30f33eb0d3c42168d8c9d01ecd9ab5c7efcb99af13d68457efa2f2d0863ef4be09dd75d5bd1e88bd83a1f608450a831c66cc3250a083e18fe48afb6110ffbd87ce7e45a12efdee8e1a126ab64dfe280037f764fac89b159a80dabd552f8b2efe4b4f9699f11ad9b59566b2a439a378eca4fafdd23b1ed718e19f9edb0d626ce5938bfe072e11d0ba8ea436bfed61253ef3c17538eaa1436499f42fd175b670f40f649f25368a16058811c4b6194868e6f16748945cc60cc8a934372ffe2f1d52e297f36543fddbe76801737816341af211667d7d29093f741ac1a61e25c10ba0dc091ebd21054f17e26ade8a70404a882eaabaa07a2479bf1bd211545a50eb61cbd284427fcb10c6a93e9d43f053b3a8d8d4ba2e74b2871ebc80d378aa8a2eadee39bd18d1a5b635ea2427904b19b196bcc1a7c330eb4f39a90d3eab980f2463d4fc96c2c45f2ab5456178da6460b628609716e736462e568711fc045baa665ebedb35420b7c9689ab1a6d0b04b2bd0c057428c2f6fb22830dc17de01ed819a01a26f229a763f278c7c58aa5e24bf8d51077655ea306e14b96c50963933dcd4f030672f3158738bc777bb07f26be8ba9cd93bac77fa4f161d3747f24455a71129bc5da60859820be7c666617004a11a23fd9cf796e4699e4a0e9b6211b79f09cbe896cd5656f875f1298344e7b487a53c704bbab7687cd03440994c5921da7fc77926439e9dc1d5d5459c8205c8aa7b576466b4b9ad4ae1c41e8d7a212a58687abbc88cf3af5a6f488010cbf212143d853098dbdabb6c92abe6701a1d60449e33c87da5be913aca52467a95e5db725fb88168189071b70ba7d6427293af90cf72baf57fabb67aef7206730c9af0162561a587a59289fd4863cadfae34a0960c6e97b49d5e18fb8b624f3c9b2eaa1e4807c5c87a2ad88f3d6f3c336ab959fd3b7435628845c8184fb5df17b5761bb3df54667f14b8e2b11c99724c0e00a55acc6e9542dbbe2495a86d89618a8c7be47261d9998058f6ca1025e0b3173796d3fb52e2dd0fd9b3f012888e7a9a39240b8e45e23b25786a8d411433269ba04fc4c79c85629e2358c9d552518cfbe1e0b049963b036b0ffe6a4c6819b79c65f69dd9a5d69bbbf3966cc162db560edd62d97a7ee2929b1c86a69b1c62e2f32703cc21fd171c6aec2facebb858ce181e2209c789de738447052d2c88735cbf3bf3918f1de0c58f14427e219f91aa8278cfea1e5dbe5cdccbd42766b87f3dfeb43ddbf408fc7714c0edec5beaa543e460cfb902d88814e7ac120b961c363af51c21f05c98d131f5bf1c84e39487c9d9b0c4bc8445e5a4d6eda8ad81c1d5a05d701c819fcd08bba0cc824b4cce3f43fd592b751b24b122724a714cc684846762780e16e615d1fb34f6971d578d7d8b123cf6232403c838c83f48c8a97ed925b3cd15f9fbbead126c7decf654b9d03b1906880a60a1d732da98726fe70c9943d05189f2d906f3e20cc4910a5112ce7a27a10710c0d741ce329f5d34b7d0fd3e68c67c6ca46215afe8f214fc97c5a0a7caa7afa8089148d2d3d368ffe12c51a52839f9a1d041af21112209da027124f66187e66fe8f483957e3d5f2342402c0cccacd03764d9254a50", 0x1000}], 0xa, &(0x7f0000001680)=[@authinfo={0x18, 0x84, 0x6, {0x6}}, @init={0x18, 0x84, 0x0, {0x6, 0x10001, 0x2, 0x1}}, @prinfo={0x18, 0x84, 0x5, {0x30, 0x7}}, @init={0x18, 0x84, 0x0, {0x4, 0x4, 0x7fff, 0x8001}}, @dstaddrv6={0x20, 0x84, 0x8, @local={0xfe, 0x80, [], 0xaa}}, @prinfo={0x18, 0x84, 0x5, {0x20, 0x3}}, @dstaddrv4={0x18, 0x84, 0x7, @rand_addr=0x1}, @dstaddrv4={0x18, 0x84, 0x7, @rand_addr=0xfffffffffffffeff}, @sndinfo={0x20, 0x84, 0x2, {0xfffffffffffff801, 0x200, 0xfff, 0x800000000, r2}}, @init={0x18, 0x84, 0x0, {0x1, 0xdf5, 0xe3e1, 0x9}}], 0x100, 0x4044}, 0x1) setsockopt$sock_int(r0, 0x1, 0x9, &(0x7f0000000040), 0x4) 16:57:12 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000d40d02000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 315.631514] binder: 22514:22517 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 315.640396] binder: 22514:22517 unknown command 4743953 [ 315.646566] overlayfs: unrecognized mount option "oûôká¡ç*DTîQc[ÞÉ5½;®ÀB»³ L{%\" or missing value [ 315.661864] binder: 22514:22517 ioctl c0306201 20000000 returned -22 [ 315.669781] overlayfs: unrecognized mount option "oûôká¡ç*DTîQc[ÞÉ5½;®ÀB»³ L{%\" or missing value 16:57:12 executing program 6: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x20240, 0x0) ioctl$sock_SIOCADDDLCI(r1, 0x8980, &(0x7f0000000040)={'bridge_slave_0\x00', 0x1}) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r0, 0xc4c85513, &(0x7f00000000c0)={{0x5, 0x0, 0x0, 0x0, "1a0ab9b1f94c716787e88fae5552770ad6a9b54e0679918e0a88af8aacaea63fd56d1dd99812e16bc06df8b8"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "0b690d49b85ec254b15b023d1e67900f8f559391133c552dd1c76c6e91f68e364a3238b17109db386e75830a143c5755ae184895c461436bad45232f258c32a1"}) 16:57:13 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x0, 0x1, &(0x7f0000001fe8)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00'], &(0x7f0000003ff6)='syzkaller\x00', 0x0, 0xc3, &(0x7f0000009f3d)=""/195}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x0, 0x5f}, [], {0x95}}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195}, 0x48) 16:57:13 executing program 1: r0 = socket$inet6(0xa, 0x6, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x0, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") getsockname$inet(r1, &(0x7f0000000040)={0x0, 0x0, @local}, &(0x7f0000000080)=0x10) r2 = socket(0xb, 0xfffffffffffffffe, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000100), &(0x7f0000000140)=0x14) ioctl$KDSETLED(r1, 0x4b32, 0x7f) ioctl$sock_ifreq(r2, 0x800000000089f2, &(0x7f00000000c0)={'ip6gre0\x00', @ifru_addrs=@in={0x2, 0x0, @rand_addr}}) 16:57:13 executing program 7: r0 = socket$inet6(0xa, 0x10000000006, 0x9) ioctl(r0, 0x8912, &(0x7f0000000100)="025cc83d6d345f8f762070") r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) ioctl$sock_inet_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000000)={'veth1_to_bridge\x00', {0x2, 0x4e22}}) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000140)='/dev/nullb0\x00', 0x20000, 0x0) ioctl$BLKZEROOUT(r2, 0x127f, &(0x7f0000000180)={0x8, 0xaa31}) syslog(0x0, &(0x7f0000000080)=""/81, 0x51) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) rt_sigqueueinfo(r1, 0x13, &(0x7f0000000040)) 16:57:13 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") unshare(0x40000000) r1 = syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0xf6, 0x200000) write$FUSE_NOTIFY_STORE(r1, &(0x7f0000000080)={0x2c, 0x4, 0x0, {0x4, 0x101, 0x4, 0x0, [0x0, 0x0, 0x0, 0x0]}}, 0x2c) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_ifreq(r2, 0x8923, &(0x7f0000000000)={'sit0\x00', @ifru_flags=0x3001}) [ 315.873918] EXT4-fs error: 16 callbacks suppressed [ 315.873933] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 315.876982] binder: 22548:22560 BC_REQUEST_DEATH_NOTIFICATION invalid ref 231997440 [ 315.899877] EXT4-fs: 16 callbacks suppressed [ 315.899889] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue [ 315.912223] binder: 22548:22560 unknown command 4743953 [ 315.918351] Unknown ioctl 35200 16:57:13 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x8848000000000000, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 315.923592] Unknown ioctl 35200 [ 315.932859] binder: 22548:22560 ioctl c0306201 20000000 returned -22 [ 315.948401] binder: 22548:22560 Acquire 1 refcount change on invalid ref 0 ret -22 16:57:13 executing program 6: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) socketpair$inet6_udp(0xa, 0x2, 0x0, &(0x7f0000000000)) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x7fffffff, 0x0, 0x0, 0x6}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 16:57:13 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000100e02000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:57:13 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)="6578743405", &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:57:13 executing program 4: r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) getsockopt$nfc_llcp(r1, 0x118, 0x0, &(0x7f0000001840)=""/210, 0xd2) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000140)={0x0, 0xa, "f6d240c83d84026c5772"}, &(0x7f0000000180)=0x12) [ 315.966475] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 315.986586] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue 16:57:13 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) ioctl$KVM_GET_EMULATED_CPUID(0xffffffffffffffff, 0xc008ae09, &(0x7f0000000080)=""/17) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, &(0x7f00000000c0)={0x0, 0xccee}, 0x8) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(0xffffffffffffffff, 0x40042409, 0x1) perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0xf8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0xfffffffffffffff9}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x15, 0x5, 0x0) setsockopt$sock_int(r1, 0x1, 0x14, &(0x7f0000000040), 0x1c) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000240)="295ee1311f16f477671070") ptrace$setopts(0xffffffffffffffff, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmsg(r1, &(0x7f0000000340)={&(0x7f0000000000)=@rc, 0x2c3, &(0x7f0000000280), 0x0, &(0x7f00000002c0)=""/98, 0x62}, 0x0) ioctl$BLKALIGNOFF(0xffffffffffffffff, 0x127a, &(0x7f00000003c0)) perf_event_open(&(0x7f0000000540)={0x2, 0x70, 0x3e4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000680)={0xffffffffffffffff, &(0x7f0000000400)="a1fcfc881c5dc18551ca259ae0ecea7fde682e35322f722731c67037"}, 0x10) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000000280)={0x0, 0x6}, &(0x7f0000000380)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f00000004c0)={r3, 0x48, &(0x7f0000000440)=[@in6={0xa, 0x4e22, 0x101, @dev={0xfe, 0x80, [], 0xa}, 0x20}, @in6={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}, 0x2}, @in={0x2, 0x4e20, @rand_addr=0x3}]}, &(0x7f0000000500)=0x10) sched_setaffinity(0x0, 0x8, &(0x7f0000000640)=0x94d1) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/dsp\x00', 0x208080, 0x0) recvmmsg(r2, &(0x7f0000005bc0)=[{{&(0x7f0000000b00)=@in6={0x0, 0x0, 0x0, @dev}, 0x80, &(0x7f0000000e00)=[{&(0x7f0000000b80)=""/169, 0xa9}, {&(0x7f0000000c40)=""/183, 0xb7}, {&(0x7f0000000d00)=""/243, 0xf3}], 0x3, &(0x7f0000000e40)=""/85, 0x55, 0x9}, 0x7fffffff}, {{&(0x7f0000000ec0)=@ax25, 0x80, &(0x7f0000001040)=[{&(0x7f0000000f40)=""/222, 0xde}], 0x1, &(0x7f0000001080)=""/247, 0xf7, 0xc000000000000}, 0x20}, {{&(0x7f0000001180)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x80, &(0x7f00000025c0)=[{&(0x7f0000001200)=""/53, 0x35}, {&(0x7f0000002300)=""/171, 0xab}, {&(0x7f00000023c0)=""/252, 0xfc}, {&(0x7f00000024c0)=""/234, 0xea}, {&(0x7f0000001240)=""/26, 0x1a}], 0x5, &(0x7f0000001280)=""/60, 0x3c, 0x2}, 0x80000001}, {{&(0x7f0000002640)=@pptp={0x0, 0x0, {0x0, @rand_addr}}, 0x80, &(0x7f0000002780)=[{&(0x7f00000026c0)=""/74, 0x4a}, {&(0x7f0000002740)=""/7, 0x7}], 0x2, &(0x7f00000027c0)=""/180, 0xb4, 0x9}, 0xffffffffffffae04}, {{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000002880)=""/121, 0x79}, {&(0x7f0000002900)=""/253, 0xfd}, {&(0x7f0000002a00)=""/54, 0x36}, {&(0x7f0000002a40)=""/57, 0x39}, {&(0x7f0000002a80)=""/211, 0xd3}], 0x5, &(0x7f0000002c00)=""/102, 0x66, 0x6d86}, 0x1f}, {{0x0, 0x0, &(0x7f0000002e80)=[{&(0x7f0000002c80)=""/255, 0xff}, {&(0x7f0000002d80)=""/163, 0xa3}, {&(0x7f0000002e40)=""/63, 0x3f}], 0x3, &(0x7f0000002ec0)=""/203, 0xcb, 0x8000}, 0x5}, {{&(0x7f0000002fc0)=@llc={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, 0x80, &(0x7f0000003140)=[{&(0x7f0000003040)=""/7, 0x7}, {&(0x7f0000003080)=""/162, 0xa2}], 0x2, 0x0, 0x0, 0x6}, 0x2}, {{&(0x7f0000003180)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000005840)=[{&(0x7f0000003200)=""/135, 0x87}, {&(0x7f00000032c0)=""/160, 0xa0}, {&(0x7f0000003380)=""/4096, 0x1000}, {&(0x7f0000004380)=""/214, 0xd6}, {&(0x7f0000004480)=""/160, 0xa0}, {&(0x7f0000004540)=""/133, 0x85}, {&(0x7f0000004600)=""/239, 0xef}, {&(0x7f0000004700)=""/139, 0x8b}, {&(0x7f00000047c0)=""/106, 0x6a}, {&(0x7f0000004840)=""/4096, 0x1000}], 0xa, &(0x7f0000005900)=""/156, 0x9c, 0x399}, 0x8}, {{&(0x7f00000059c0)=@ipx, 0x80, &(0x7f0000005b00)=[{&(0x7f0000005a40)=""/173, 0xad}], 0x1, &(0x7f0000005b40)=""/88, 0x58}, 0xffff}], 0x9, 0x10022, &(0x7f0000005e00)={0x77359400}) connect$can_bcm(r4, &(0x7f0000005e40)={0x1d, r5}, 0x10) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000001c0)=0x0) sync() ioctl$sock_SIOCSPGRP(0xffffffffffffffff, 0x8902, &(0x7f0000000200)=r6) sync_file_range(r2, 0x4, 0x11ae, 0x2) getsockopt$inet_sctp_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f00000005c0), &(0x7f0000000600)=0x8) sendto$llc(r0, &(0x7f0000000000), 0x0, 0x0, &(0x7f00000012c0)={0x1a, 0x40000304, 0x0, 0x3, 0xfffffffffffffffc, 0x0, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}, 0x10) fcntl$setstatus(r0, 0x4, 0x800) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x323, 0x1, 0x8, 0x81, 0x1, @random="b11552fdb9b5"}, 0x10) [ 316.109282] IPVS: ftp: loaded support on port[0] = 21 16:57:13 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x8864, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:57:13 executing program 7: r0 = socket(0xa, 0x1, 0x0) r1 = getpid() ptrace$getsig(0x4202, r1, 0x101, &(0x7f0000000000)) r2 = socket$inet6(0xa, 0x1, 0x9) ioctl(r2, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}}, 0x108) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000340)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}, {{0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xaa}}}}, 0x108) r3 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r3, &(0x7f0000000000), 0xfdb0, 0x4008080, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, 0x1c) sendmmsg(r3, &(0x7f00000092c0), 0x4ff, 0x0) [ 316.167523] binder: 22591:22598 BC_REQUEST_DEATH_NOTIFICATION invalid ref 235929600 [ 316.195806] binder: 22591:22598 unknown command 4743953 [ 316.203326] binder: 22591:22598 ioctl c0306201 20000000 returned -22 16:57:13 executing program 4: socketpair(0xb, 0x0, 0xe187, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffff9c, 0x84, 0x75, &(0x7f0000000200)={0x0}, &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000280)={0xf82c, 0x200, 0x5, 0x4, r1}, 0x10) tee(0xffffffffffffffff, 0xffffffffffffffff, 0x63c, 0x0) 16:57:13 executing program 6: socketpair$inet(0x2, 0x6, 0x7, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_sctp_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000000180)={0x416, 0xedd, 0x3, 0x80000001}, 0x8) stat(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)) r1 = syz_open_dev$vcsa(&(0x7f00000001c0)='/dev/vcsa#\x00', 0x8, 0x80000) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000240)={{{@in6=@dev, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@remote}}, &(0x7f0000000340)=0xe8) sendmsg$nl_route(r1, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x82000000}, 0xc, &(0x7f0000000380)={&(0x7f00000004c0)=ANY=[@ANYBLOB="64100000180010002cbd7000fddbdf25800080fafc01ff0f0015000008000100", @ANYRES32=r2, @ANYBLOB="0410080071431eca5e5be70ab62c5c1f1c5f3bbaafdaee29194a4fb8d8252b942de88a842c7ee05e405e7baf27c8be06289ee644a2b1f4d708d0f3538c6f0f423be3564ca01606d881c9fa2b67d81b5dd403069714c07d9512056923cced001b971cdf5d557a9b234ac85ab11c7569d90c2148c7c237ef42bf3e08c558ab4833875b7a8ec9319fe729e9728a413a0a5b527c359d7ae6d8fcbc25eb56682f2213c743d868bfb402bf2ca072bddd8801888b573724c6224cff98a4f12da2a00710c000fc017bd2340c99df6886395d98326e90c9994a95e5f01cdb2e302a806755a4db9d30d4c1ddaf8f87de5af3b0d558e5173308139a56573c1917f994cf14f063f26557e6e1fb614530037c3286e6be31b2cbe39481da1321b83be2f119a1b1d818a9deda92e83690d5d7feadd7d560d554906ddaa6e816e9f033bc4e13fee23655145096906f89cbbf986f1c037ee5ffd1d8508dd202921af83f008fec83dd6221df0cefd4aec80961296d59a5539cd526e38caff34ed660c48ceacd0edee6edb2fd381b05a68b614190095795cd498dbfbc6031ec50f56247ed99593a6343171f625f9b7e0c5631cd36ffa9d934533be74764c6507936d012532ac15c01ac9d586fdd9b8417b972153019018d16b028b40c5af6167b49c0f7ebee14709c10b7c4050070c423745715fb0301be208ee984c8d0faae8921d518e74fd9920aeac5dc007a3bd13117488c9385fbaea85a97d01857a12cbc536628164413e190b2221b47ddb309d83b49e54b124d5843323c10b2620c3a8c1611fd7a988b1497a6777e63b8b7a0ffaa5cfc0098ac38264ced32833a91d66c5291271ae842eea8fe7b6b9e4a93ac9d61ee0103f52cec0ca03d9edc8ee6defec812581a0293843981855fab0f0b8f518f34db73b3b28c150785d3f79fea10dcae5b54951c7866d7082de30b5c7737c4d2be5c725571749737461db6772018131f5b9af102ecaaf5cc701b449cdf6273c4fe2ac370a02a360dcee61f31148bc6d7f87adb89c449c09e0ca343d58b95fda53333812d291ecbef8dec617fe748c0df9a426c643223d2e8d1c1ed8784fc6eb6c248d6c5d8da1a9642fc00c79d87d0c9bc39b9352603bf695a93d29329d6395633cfae50a2ab14fe42ebb5917399faf41677167593b4aee80ed9408624e9e91b9eef576d49616c7cbdab8676520df83bc373f69468c0288a3e528a6a1b8c38b28395a34c6e28add9b0464f33cb6ebfbe1a2ae3f40ece9de4b8e77cb621cf148f9dea56c7d968e50ed516cc85b5f3a63b806897c2c7b16e4b5c99238e305999a86df4c3b11ff74cd6da0634992e7acadecbfe5d0141f552fa592529a64ccfe11d8184084aa74046caf253a7f4902e38d3888b14917e7f1123c0cb1f3b36ba1627198884321e92924d5dc80474c1dc8a5fec20cddb688d62e20fef4cfcfdf39ff2acd041153e67770dd01826b4d8fd323ec915729721d987b8eeb1da9c4bb44143dfed52bac23cb4e81d66edc8a9a41ffa4d1fbec3c03ebccbc347ec2556960e510a117b1734b342986dd6a93a35ae0bbf34853f3100544b3259be25c147832540c756f8f243111bbf5a56a92c96d7e09fda99dab72effdacff5f824023ca3a909a4653d314d5200daf46a4989f0ade5258c1882e2db700f5d8c38ce8425b49d0237800144faeefe5b7ee0d3b4659cac2bcf87dc06a0c7f5c7417850c746ccdbb9e0cef48aed4d958f9835b410844a97f4759b869ccfe0c1cc2a9d63b383e1bd6caffc3ec71d938696f6b76b094b1269727caea4fc98f59bc03169247bac86ae49bc5e763e4f00c5a8ffc6676c151112fa8c9ed32ebf3333e72914b505164bc231698c8513c258e7559f0ee2ee27118c39beba76170483dac18c613c795ea64a522ecf4de8e28b2e49b825c6d46e1675a9937676ad3b079c145a5b5e2e37a465ce080b4a170b1bea8d2e5a85c249184de179818c1ff5037a75522cead202d02e146e88e97c6343fe1dbbaa89989c3698bf81bbdbd0e6fc3b0eb334f16d73dac98415e485cc4348edcd0813af21921df061752d15690522783dae084aef419d4e2fc072d44b2e4da1a60e90ac1c36068bf5e3c4c302588b324d7714ecd5df99d934decc626005b4ef97e2f72318a62a1c3ed446be05798cdfe22f19469b63e4bad6663f60c3f4e5cc75c6650353f5776479471960b834a1fa1ece296cb33cf72e937f95e87a6e06fe263bd10845344e1f4abc7e1e0492d37ba721be4918a93e39a5c242ec94a997d0388990d6fe56e8063673fbaab575446e3d390522c3c70d082279d48cb415b2156c2c800f362c6ae22ee37aa36cf193d3d83e08f6d1778b5b2ccecc3c4e5baaeb97dc3ff5947722cb7b332d4caabb1f0fc265a7d0df2eaa87a3d1fcd210832894a9e55d6f271b7e9afe09541586208f7a468b2dd5f7a4b75eb8b76e1f587a20e1d3935835e1c7213c28c99a2a024a091c979e3293e8c0df0f2f5b20f51155596526b8c09ddc82c5bf664c60af3ed014127ccfb07b48cd432c54bed68ab8f477e75ec303ceab380f108a5d4346008beaac0dee162d4a20d13044483ba44e06ca319253823af1fdd3eba42e0631b75b2fd228c39e848c26f2bbcf47fb463b981869715f8cc8952b12b0b554663f858a445702a2ae0c83840431c395e93af9b53bed6e03a07238d4da0895c04d024be749993e81e1862682ee9b4cbb698d65c4d8e973e721f71ee303c519e744e340d1366b78f919b9533bc175f94a81152e36e968c8e72b7c3ef6a4531b1a47aa0d17203cef05438ba6cb804ca209546c21a10a1ca9a011f01f0ff199d739438d155cf49634007e2a37b2f536abb1b3168d464927d74128cb301f599f90ea37f0db0d9168195baa2e10b74c49d44bd22df286bde21a8f7ed20d66bea4a282d33f8fda6cb496670df20f49873fd0fd328e754e2d90bb9e9a336450abc713090c3efdda3818a8a73f57198ad707c9709166376c4bc7b51fe6b72ab7433090150500bfc778fb998ba5272b7ae6e917f5b42a336a56ba1d68a50202fae97e79ddf5a16e9bb059bc977054ae2f036d872ba9c87152e66fd40f8a27bb74a13858cbd96e1f393f7f0a313139a15d1ca9875cd3d98cd8a26ef508d0170f3c42f8e8f5f5378b73a427a1cd0aef434cffc7cdefa6fbbfc02c8d69701479b711aeaf301dadc15db575e25bb297e367aa6a1e67a47692e9bf488c7373f512a2597d706ad8fd5dd1ac550b8c7f1108f9daa7fc718dbd477404a23b4e77cad14a8f524a532961584d8101046e48657576c5c4765c11a12cb9afbc3f48ee9cefb93186af086a2735d97e6bc42fee3283f3435fdb2234451cdadf493d532a1fcf364c7ec796669b2f846ee498ee66a0bdf536afd6be9c5951603a8a70475b3bb5b61d1764a83496ef22d32a2ec7b48144a738cd43ad3ed26252811ba79c8d5d6024a1240e337393174dad2f707f5311150638a2b1df96fac664b30ed2fdee9b5963d12fa410a315539b146e058dd22fefedc661122b423f42c41d5495871bf2f2e309596b0e4bf73afba6acfa6a9aab1285359ee8ca7ca9b5c66b6f8405ac87b7641f2bc0858c2d494e64ce77bbebee2c93bb151ef2b8fb50ff9e2ec216b837cb5f954192409103719ccbdcf554a89583fa579eaaa480398485685e9cb0a09fb788ae46f040c619d3a1af673161bb81b57b23a6430658b962a24ce3f0c65924da2c25bf59ba7b9856d427291e8826571255f42e99571538a9954313861ac1a52f9861eb463dcc8f689ae7795a6e79eab004e3aed3034367fa40ce9a3e37d3f27e1edf5076eaed96ebec2988e4172df494cd6f68da2e192abece91debf868554d0dc7e333c3c85be25404b9d25c8b218cfc4ba8b4c0db6a6174d8492e7e283739d8b9d1f1daa9b97ed72c78bdcc130e36444c9782e7a9972b2af9ddf05c54308cb4cc5b5a91afbb64b12e215f7e1d986148f068e20c956a33c85905db76cb02279a037e2b6ebfda73f9cff65fcb2bdb4f78b8c22ab02550bbb834b7a0d120169f3386f3afa5c3b63a12ff087c64026328977d03ab96435d9bc2d1f1fd10a5f185361d12e32c21761b33d4949547d83a199decf610dd0854de2e627717c47e97fa49456f89ce1bc8bae6e5ab97098bcee5fdf55a13334d9bb4999209782c595aec42f6fa7dec135c65b3d9faabd7235f287d55e3e21e0300971cb3667dc0f37fd2ae04b36ff40ca49af2cb229cc26264349078c55f1d895d61e5fcbbbe4810468ceeddc1e3480a3a6c9ea78b25a9c64c81bd658e0cd5c7cfde96e8d6e28691e91070569d8aba20db0c060df0e5e58d7580e03ee76953f14c21bff21b512e57c32eae5beab9fc3dea93f51f496ea899ba0103f014a0df92a3f6b5df095ed17a5af9800e5f730f6f99007613046e4a7be14ef29d758047706f1290c9f758c72c7dd97a9a291c045927f2820fc96dbbdf88cac0f77ef21eabe6860516c0c600db54e012e2061a19fd3f6eaaec21cc525dc6c79fc32019d1c1b411017cdf769103873760d2546e1fa4ead5cf80152f83d464a29e7d6b2ad367a9869a821907017970f1eac94b7f89c7887de98f454ef02664a521f0fe58e147873dff24039448ecb56dcabf2d292bd68fd7005d925295d6bb56cb19caf2177e89de69785b6e92e8fe3e6fb26cfcbbaf368ea13f77186555db35e766d4307c5cccb7f523e9f95e4ada7358d362bb31afe3903669c467ec4fd4cf6a4700ab8556af5f6c3e3db796efd392bad5f1ff5a99017b132e8cc561efb09f362791471ca69ab3fa540350b28af8960b4de8073002d51040c21965665f9db6c9d37c35a16e8ce05b97db3038ce0722ce4f12dda1e91fe0460b769be1dc2acda8d50cb63f7aa8e793528cf2fc78ed0a5e9362d5dd97fbc71019e93379043c1eb4747deaa17d40ada7b18d35c58569aacfb160875c5982dd6b3f1750ef4b931eeed0ea2877de95a6d050a719bd9820bdea918abc74ba027e239abb0d2007c2a35314d26076b78b197919d5bebbf0b2fe5db597a70573e43db864242291f2016b8453948affcc46433207ad381bd528893aaad6c83d10e7bf8327c0ac5bb27f7afc2e2280448f01d99ce2280c8822ccc39d3c2a48b5bfc33df6e763e77dd36180f838e2c7c72a779863fa0103674af020e5d3b24b67f7a290c1fb39f8ee281be8c4f2b74c087c2495025c1347bd398e3c12a48d68738bf2720f94f683d9e2cf0b22e2fff26055efd5bf5f5a48163cc5aadbf8481c15c87b1f0a97b0d76eddb7df97c423ba463cba8c810762b06ff6dda6a8dd908233c96fd2bd712f49055e403a923ea37f3342df87f42bf5183c443ba5f0e4eaf415b74d4082f22d0967845fb0711aab6c8e28db13eb03015c10a74f3385b772f215519d5aa98e39698310a3517bb8d06b1ebefa7ebfc16b25ac12f3ec34dfc32e52783a2fd27746ad6e707a5a8a28f3c81fc45ed6e386cc099911103a2a29475e56c46612373f44cdd3337997ed582e31c74f9e2cb6525606c07c01d14365359e76fda918d7db1266694280e797ca042ea824afa7b4abe48833b8ab64bc37ade8ebfc1c6b0ec6c3ff9791f8f873135012cf12db6eb04d4c8d73ad7579e114d24a8b71d102f43c14bc27c6cc0bd26d4f64b2a08c75630df873626773c31d8fdb53cd2b5d0b5eaa6cc91ffdbd978a250331e0c0b9cb6a98a158071c810e79b51c5568432325836ac7d6e45711d47b0dab2a6eceaee0931ff51972448ebe53e3e0890479efeb2dd080010000300000008000b000010000008000100ffffffff08000b000000000008000b008c0000001400160010000d000c006b0004000000000000000000000000000000"], 0x1064}, 0x1, 0x0, 0x0, 0x20000000}, 0xc001) syz_mount_image$hfs(&(0x7f0000000080)='hfs\x00', &(0x7f0000000140)='./file0\x00', 0x0, 0x0, &(0x7f0000000380), 0xfffffffffffffffe, &(0x7f0000000480)) 16:57:13 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000740000000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 316.214235] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 316.253458] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue [ 316.255179] : renamed from sit0 16:57:13 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:57:13 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f0000000240)=[{{&(0x7f0000000080)=@alg, 0x80, &(0x7f0000000200)}, 0x3}], 0x1, 0x0, &(0x7f0000000280)={0x77359400}) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='auxv\x00') preadv(r0, &(0x7f0000001540)=[{&(0x7f0000000180)=""/184, 0x93}, {&(0x7f00000002c0)=""/153, 0x99}, {&(0x7f0000000380)=""/4096, 0x1000}, {&(0x7f0000001380)=""/245, 0x3d2}, {&(0x7f0000001480)=""/171, 0xab}], 0x5, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) [ 316.278547] IPVS: ftp: loaded support on port[0] = 21 [ 316.288090] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 316.303014] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue [ 316.362531] sock: sock_set_timeout: `syz-executor1' (pid 22622) tries to set negative timeout [ 316.417609] sock: sock_set_timeout: `syz-executor1' (pid 22628) tries to set negative timeout 16:57:13 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x3580, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 316.499447] binder: 22632:22643 BC_REQUEST_DEATH_NOTIFICATION invalid ref 7602176 16:57:13 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r0, &(0x7f0000000000)='<', 0x1, 0x7fff, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @local={0xfe, 0x80, [], 0xaa}}, 0x1c) r1 = syz_open_dev$vcsa(&(0x7f00000000c0)='/dev/vcsa#\x00', 0x1, 0x20000) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x2, 0x5, 0xffffffffffffff23, 0x9, 0x203, 0x0, 0x70bd28, 0x25dfdbfe, [@sadb_x_sec_ctx={0x201, 0x18, 0x0, 0x7fffffff, 0x1000, "609bb0b08693506e9279d8c6f4959cdafb4c77a3754d73b3faa1a5482dfa31ac20d9f356e7b39205ee5220538f7d2bfa076df4254813c4ba4c27a447eabe5be2fc80a779f47f94432f4482b73f35c6a99f9454a510babb568a923b4e358fd9948cb5dff7b06cf393297126db1024bb8f13be79443767c1eb1061d19e528440475241ece9268a539a2c2011fc024af103612ef2f0ea8394ecaa3a8a956010c6dcf4b7eb189deb6a567f1c368e7fda01dd65298d98e06fb123ecc13ee7d2215a574dd4d0e5d7a7d01a61b51093627079183e612b71f39e1674555c6d2fbd4c2f4f174c83e47c8e3398ebe71d8d2d47c80bd7b0fa21130923479aaaeec1ed4e922d5d3b00134e3ae32504c7a2ed6448f3bef2c43fadadccc372d24fb3a26fa3e683fa544ed82e16b75b6ef49d97fcc7fe1fd281bb8d8002b995408c48db5e86506cc345f2f692a0868bcce5370b7b4f760d636957bca38ed73d4d8152fbf697754512308d86ab7eebd90b47d76f50596b0c00dbcb8ecb41006f221667173d4e8d45e7211549d8f8643c71d34e9134860b61c3e291e03fec808cee3d336b462ac1e830ab188acb96d341054e8aceeed195a12ddc1b9be011e5e771b32f4f0ee658d17ef0693d08b999ed7a502c1a80b1ce060fa400c5e49f6d2550e0a69809dc1eff0643f7a618c11b9b1d9af71b205e8ad8837439e7b27413a1c95bd861bac0784d7fa50143f4df72591e6eeec7a5454b1caaa28207553566f5b83e0575ebf276f53a108179e747c0ad51128f71e7b53113d341a43c8b1a8cf840ec11c59c6d28822fa55070a45745ae6e354e1789cb16974d58ba474c82855527498d57548df8d6a81419dd4ff4fc69b726474691937271918ad402d41e31e67ab090056a82058ce5f332b3415e47eec24369f795694995b3db475e5d9db3b163151a3950906908e16a5b865fd32fb0d071f573a10dd3617c8451294487ec5dd3409dbf5dc76622570dd4cb07d4a50f58978f4074ca766c8ff734a0a5c9a5a94f4bee7e9ec0f82047fb8d275038399a4662dda9e2fadf7f2ef934e229acadc6d6a830572be73b7f8f6e8cd7d31cca93beffea573bbb9edd770c3de1b3a5035f1b5d55c1e8ff9d99f07a8759ae2550c8aac9d267e6640bb55665827517fdbb150abf414dbd1604485f562521cbbfb377e05d793e0c6479ff3329c76479c79ee0585df63b661bf874d34d6b08812fa88a1cc937f2a0474ceb9ae8c1c7aa1366cfb96ac8b7e978166cc5e06202188b7a9fdb18488ccd68a2d70da180b3b6fbf4877a0a1ec77de5d50cdba5d2d9fee32880969b209689c69dcd713927ff1437117d31226deb0b1753e591090bfda73060f8a5aab0ee19c9d366fe239ba00d0744c825bfafcc8f02105d8ea5410d980a05177c9ddd2305aa22bc03d9dccc13d1c428d77acd24d3a4e2102b46830078fcedb21561761f29c189695cab096ce8b8043b47ee4ff93e948d1ccee04a459b4c937daf4777d673b705ac3df0406cf81c4aa0a95061db44056312f94d0b9a363399d9b001da62ab48ee88bc983ed795de607cd3b9be33ff85b2f8a5356dbb43ec21bd4e47249b81b237a2175655c03ee82461c8213f22e4173c86fb1c61a90e6bc0b8e148dcaf6d1b8beaae6a1ded1ca584ba8becdee5faf5ebd17d5e11240afba962bcc922a792947d236495ed1e5b83384fc923f27424829d46e18b1776f310a1c8a37969fe7e7e88e56f650bdf1bd817dba935b01a701e55b95a30d6ddfe54f6060c8fb74435d898c339d5039faa4cbb692c97d72eb46eb204275e5f3ca043819499cced6f31a7055f957d70c8886559c0f3b221d4e690e3e176307611408ec75dd3d62fc4c4b4001c140280f00f41f5e2c99ec616976bd74da7cb1790a432b6910286fa44d62485910b2e303546e4f97081e159054ae7c87ef6496f11f460721f7cbe10faef9d632905e3172061474b3d1aa3090d9b1e4b281d9eaf04e58fb0ce2a9b892586f0cc92ec7d9178a7ca81ca77239599c67263ea41d38be8acd01c6518042aea4973f51efa45c28beca9db02bfb30589c38b095071d09e6e4e040e5519001593bb706d382ea352c28a5ae05a336c30527695eb4ec5d167246b9678f2f4f1c27d8212f6625adae48cd8f2dc71112a5635290be573690cae0183d3cc52054d2d61f5523c233d4e5e7473b1c0b3b706b8f986848c9768a07a18f8e95dfe6ba4a03a9dbaf7e20411d083198456ed1d82a2bec6d4128ec1560f19fa15587280a7c2ccc0b928da2683982b61685a8e0bd0abcee9b934b1d88e2ea83134970ed1f80083c7d350242900b558c9f89cb90dccb74f8e7cb931095028b26cf5c4fb8492797cc4a0ca89195e0ba820302f5a1f8c77ce2bea02c6e0f818c8ab41a331cc518541e2b4fa20837fab21c70d4df01ed6382970fb6c9b54680106770e662a49e34f863bfb2e20a6c690dc567265d7775822faaaf8f669558f4d602d4b12c1a20f1c9d6d027f99b9e3bf84c9ef5103ded2d7bc736ee473c16bffef888255983b34d2e9c9a62e4a09562b0a85bc239575f7c252e392981dae55c552851579632c210536770f69fbfd748096f110c406341bbe1058f3735113dbefcfd8108b627cd4c7d8965e984c63c5f5ba65b67f850a58d5773a73bd4f3986c0386ee3fdf45af93fdc75ef18ca2e4956b70e8bf58ac0f3cce713abb4c654a012f6e691566f8f3c907b038e99ce33894038f462d88e9a4ba811e89cee725431eeafdbd7c132e019d14df2b07b0ef4102d5faca5b125122657cf28aa33f06af2909f81392ccaae2fd127c7d324717e6b88634dc34c81cd52f1eaa487234cbf56cb766c07409072017ea9ea768ae3e7e708f42bae1689e438a8e20fd1ecc06c45cb6c55e654690809bc2030698ddfb983f7ec986484144c40bd9575d3f79f1aa7c4790e93113c968b8b7dc250cbc7c100174fac656faccf5c737ccc625e2fcd6599eb2d6902b8f8f69941234e56ce2cf768c8c2b4829c8dd309f0e37bd1015812c6788d310884d238b9cac97796fb9e98fa33ea2e96b5fb12f2c6610286816ba9614fa06c8a602f602d6aa10a8db9d825242c7b3d7f73f232fa5650161d5b2443a33b4d4dd559365c1769ca117614f6ed5c50183665cd028be8ba062761549c23b95f9343b3831e13aa1fa379ce5df11f4b5a981df33a96667e5fa481042ec1a71df55812bfd01347cfb58b6f103daacaffeca79b615f1de9cfa993ed3d6bdbffafb435cee0e3db6a798b9709f26f401766937aa2d6734041332d1c9d04e147ba896efbff8ecdf89bc7f891a3f49e66ab841beb746a8895b9863575b9ba20570e61449bbe2612bbecfae17e4cfc17128ce962db7e6de18bcfb30db008c2173a2ce6f14a174dbdd060bdd39712c5da58831c4c34b0c77d7c948a9c5d6295455064ea7f496492c2d601496ad5cafe84f6eb3f535f6572be7cee71855d155ca094c8f4fc3c06a0fb47ba0b91b5e862812019fd08f1ccd2dfb10bd452dc8861b09bb625cb34162ac0c642685daa1ff1909ef3dac8eb88ce7476eafabeca573f23fe031631ebee8d827627e182ee3d4f38b802df125730a0591cbc58b85179e1656e997adac369ce4279ee37c25a0ffb317c085e5b59e7f4f3093339a135cafa5c62d0b7e8cda76c85a31168fa00410e824cd01dd63247805c20e9866c7fb4efb4f43122f0222c04dd8a136271ac009ca1085f038cf3b1480b4a64ce09b36b0c685cddf93e4930e776eb47f0e3763de77b9b31187f55ce2b9afd8df532a68eb1e0821cfc2adf45ec5e0907124ded292a564567b397e5b911621f4a7d15cd34f9cbe98fd76cbc621e6bb5153095d4b3e48898fc90b7b1bea22dcf50aaef0d86e9bb93e6928b3af950a5176ad69ec97384ff4895ea0ffacacb26d3b808c95f30a15c3900437a3475e9fdd5a4559bc857111849222f916f6a627fb5717e32990b98737c5b3d2c5f2d8ad6b6342523c9c88ed852cbea93102936d1ce61a93eeabb6498543568f19e0d6b1206b352dd1a0428eb7cad2a5005c0e102eb22710d7b056fd0296ac575e9f11894a4f09f11db90f19a7ff31dc98c848b21c759bdf65ee96b78a0b714395bd3942375c3ef6513a6da4c80c37173e120a328b71f750c807b1e2e3524a0147fe49c2335c48686d69b2c178b0638e89f4ace81178f3c8806a8498165a7ac4e550ccbcd4e192cfc62c94b0b58d2f2b2eb2a43a93b6822e09d97cb1eb47feedaceff7c738d8c234201d261413faf32c63b0276cd39a10733005eb8d563321533748c8da1271c23de945db497487953a2dfa73465eb4729b2b125f8a5e03e1f6c970f66a939c003331afc8db98d7a642ef9320c3be28a8602ac2a78298e77961ea93be9fc1337bf535ddb4c028c2efe537a6d82e2fd00711c355a2826ef93df163f9243582acda45f4bcb3d27d3097c1da6894a3450fda8f18bbdf56033facee1335ac70510fe1c17055a1ae881fe136d214fc69e57af6525300e033d1d38ab3e1a4da547391f19754e8ffe6bfe53fbd25b0041bc0dbc30063bc64f2149adf75b14a32858957a01e888a34952e16933a0009e1716311d23df676e32a8e951113be3d2a02ff12b4b991d84126650cdff43a8fa99790183becad0b2b3e35e3bda120c286180d44ceef55d2bb5fe3d17c9fbec85eeaceba532f0128d299d2620e61004fd12e97b1bdcfe6695ad91a270f5d12b3a3c35fae4af10ba04b7209f1f059f274ad723a6b8285075302ac1bf788790e97461bcb51c001e84ff388502cfa932c9646a5786539c3a74467371481e244e81a112f8caa8ff3d6be33fb9831035dc4a31600168762071b91a95472b1d8dde0a692c9566b93c06d369f36f1ee9f0b27b8c62cd51a98c802a58f97feb4789b0fffb509069aa2d957abd6027d5c4c9e4c37494e5adacce0c962d60ce14667683dfa0c5efb2527060d1f41ce909f5a28e7494c28dda2182368642bbb36b5bc4f35b87fa574e6638cc143cb3488af0e17e28451dcf3e880a9466fdca3ee99724795ddba9781010d4f59da7ac1ba5ea661f07b8523dc517a194b95e99817018d3d13a48a64e519efc7a9531b46210904bc4d0a7aecac21e26b1e31b46f6cfd2e640a19e1710c5adec29ae2e068df3d5acfb1d761688d9d9fa947c389681fe557288d9fdca569fb0054d5f6dec54af688bbc5ee74b4cb9cddb1a39f89ccc33e73f2f0e566c438cef78cd9b324324bfc23b3719f3663fcc260d9ae21f6c7f9e1c3d6b1ffd6e60cdc3c6c2db537ee912ca5ec84342537a5d0d0a7860b8e5333052e16f6e0ea8e5e2559d59c98c8d93c8e247aadea6a5d6edce6a76baecdd9de81c62c3de3b32193c3f47b3458980d9eb1699df4000ce347767db865c12a7b29b86c23d7f69022b8b6f8e455ab51e13ebe0f2381d85343ff311f95d99e6f98e84d98a66be1ece835ae8f70903ec0682d38254b6a3da7798799d381afea897042f10d4f4be6a21b04d80e9f76496ffa532aae5f268021eec5db4a34955642c43a5bdd098810c23022e0cc90c22a6d6bda1e4657786ebe745717bae6ce30dff8fc5a539b6f79a1d453169de961ef1193cec38876679e57a12fbb53feefec5f3039c475325ac7ab01c5bcd4591991ba56e4e474e06cf8955f5b369fe3b084ec4c7083719df6a563b1e235d4b765ca0726944662e2ca0cf10115b03c657735fd4b9b056c151130a3c0c9029d53de0ad5cfb87d9cede50400884c3c9c0720b3f096b2175c799da919137dfa4fd5644bc3a7d"}]}, 0x1018}, 0x1}, 0x24000811) ioctl$KDSKBMETA(r1, 0x4b63, &(0x7f0000000100)=0x8) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r0, 0x29, 0xd3, &(0x7f0000000040)={{0xa, 0x4e21, 0x7, @mcast1={0xff, 0x1, [], 0x1}, 0x5}, {0xa, 0x4e21, 0x3ff, @mcast2={0xff, 0x2, [], 0x1}, 0xfffffffffffffffc}, 0xc6, [0x2, 0xc12, 0xffffffffffffffd1, 0xe12, 0xfffffffffffffff8, 0x7, 0x57e1, 0x8]}, 0x5c) 16:57:13 executing program 7: r0 = socket$inet6(0xa, 0x80f, 0x200000000000) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r0, 0x84, 0x16, &(0x7f0000000000), 0x4) tee(r0, r0, 0x8bd3, 0x8) setsockopt$inet6_group_source_req(r0, 0x29, 0x2f, &(0x7f0000000040)={0x0, {{0xa, 0x4e22, 0x7, @empty, 0x4}}, {{0xa, 0x4e24, 0xd5bd, @mcast1={0xff, 0x1, [], 0x1}, 0x80000000}}}, 0x108) set_tid_address(&(0x7f0000000180)) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000001c0)={0x0, 0x4, 0xfffffffffffff972, 0x40}) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffff9c, 0x84, 0x0, &(0x7f0000000200)={0x0, 0x0, 0x6, 0xffff}, &(0x7f0000000240)=0x10) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000280)={r1, @in={{0x2, 0x4e24, @local={0xac, 0x14, 0x14, 0xaa}}}, 0x0, 0x6, 0xffffffffffff7fff, 0x7, 0x4}, &(0x7f0000000340)=0x98) io_setup(0x2, &(0x7f0000000380)=0x0) io_pgetevents(r2, 0x6, 0x1, &(0x7f00000003c0)=[{}], &(0x7f0000000400), &(0x7f0000000480)={&(0x7f0000000440)={0xfffffffffffffffc}, 0x8}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000004c0)={'bond_slave_1\x00', 0x0}) ioctl$sock_inet6_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000500)={@empty, 0x37, r3}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000540)={0x77359400}, 0x10) r4 = fcntl$dupfd(r0, 0x406, r0) r5 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000680)='/dev/rfkill\x00', 0x10280, 0x0) io_submit(r2, 0x2, &(0x7f0000000700)=[&(0x7f00000005c0)={0x0, 0x0, 0x0, 0x1, 0x4, r0, &(0x7f0000000580)="9cbaae671014bbd6f3b644be669a9a3ae371f3b8afb27188cc39a6d1efd99e39826bbd23400fb925d99d58fcb1e34dc8a7bf5d618f36634286fa", 0x3a, 0x7, 0x0, 0x1, r4}, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x3, r0, &(0x7f0000000600)="5dda79f26b7d5a0de9892cc1852705cee782d3300721645be81dd89b14c042c3a3269cc3fccfb1cdae8378f5b81046d5d30a4f76ea9e28546f654b0f2ef8480fd665cc884c", 0x45, 0x9, 0x0, 0x0, r5}]) ioctl$LOOP_SET_FD(r5, 0x4c00, r0) ioctl$KDDELIO(r5, 0x4b35, 0x36) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000740)={'rose0\x00', r3}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x2400, 0x2) accept$inet(r5, 0x0, &(0x7f0000000780)) ioctl$VHOST_SET_LOG_BASE(r5, 0x4008af04, &(0x7f0000000800)=&(0x7f00000007c0)) socket$inet(0x2, 0x0, 0x913) setsockopt$inet_sctp_SCTP_NODELAY(r4, 0x84, 0x3, &(0x7f0000000840)=0x4, 0x4) ioctl$KVM_SET_CLOCK(r5, 0x4030ae7b, &(0x7f0000000880)={0x7, 0xffffffffffffff80}) ioctl$BLKTRACESTOP(r5, 0x1275, 0x0) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f00000008c0)={0x80000001, 0x3, 0x3, 0x757843ec, 0xaa7}) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r4, 0x84, 0x8, &(0x7f0000000900), &(0x7f0000000940)=0x4) ioctl$EVIOCRMFF(r4, 0x40044581, &(0x7f0000000980)=0x2) ioctl$PERF_EVENT_IOC_PERIOD(r4, 0x40082404, &(0x7f00000009c0)) 16:57:13 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x1, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0xa3f8) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000400)={&(0x7f0000000240)={0x10}, 0xc, &(0x7f00000003c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="a00007000000badfaab02454", @ANYRES16=r2, @ANYBLOB="20022abd7000fddbdf250e0000003c0001000c0006006c626c630000000008000b007369700008000900610000000c0007001800000000000000080004004e210000080004004e20000008000400ffffffff04000300340003001400020069705f767469300000000000000000001400020062637368300000000000000000000000080007004e24000008000500000400000800060000000800"], 0xa0}, 0x1, 0x0, 0x0, 0x800}, 0x8810) write$sndseq(r0, &(0x7f00000000c0)=[{0x4, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x0, &(0x7f0000000080)}}], 0x1c) r3 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r3, 0xc05c5340, &(0x7f0000dc5f98)) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x7c, r4, 0x300, 0x70bd25, 0x25dfdbfc, {0x10}, [@IPVS_CMD_ATTR_DEST={0x60, 0x2, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x7fff}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x4}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x9}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0xffff}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x9}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x7}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x3}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7f}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040080) [ 316.545203] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 316.569274] binder: 22632:22643 unknown command 4743953 [ 316.575783] binder: 22632:22643 ioctl c0306201 20000000 returned -22 [ 316.586108] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue 16:57:13 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000280)=ANY=[@ANYBLOB="010000080000000000000000000000000000000000000000000000000000000000000000000000000000000000"]) syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x7, 0x20000) [ 316.601224] binder: 22632:22643 Acquire 1 refcount change on invalid ref 0 ret -22 [ 316.621627] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing 16:57:13 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c40000000740d020000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:57:13 executing program 6: r0 = socket(0x0, 0x3, 0x2) connect$rds(r0, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x15}}, 0x10) bind$unix(r0, &(0x7f0000000000)=@abs, 0x6e) [ 316.651189] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue 16:57:13 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:57:14 executing program 4: r0 = memfd_create(&(0x7f0000000080)="5bd295e7a5c45ebd0000", 0x0) write$binfmt_aout(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB="a5dd"], 0x2) write$eventfd(r0, &(0x7f0000000040)=0x2, 0x8) execveat(r0, &(0x7f0000000000)='\x00', &(0x7f00000003c0), &(0x7f00000005c0), 0x1000) 16:57:14 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000004e00)=[{{&(0x7f0000000880)=@ipx, 0x80, &(0x7f0000000b80)=[{&(0x7f0000003040)=""/4096, 0x1000}], 0x1, &(0x7f0000000c40)=""/99, 0x63}}], 0x1, 0x0, &(0x7f0000004fc0)) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000180)='/dev/null\x00', 0x8040, 0x0) getresuid(&(0x7f00000001c0), &(0x7f0000000200)=0x0, &(0x7f0000000240)) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280)={0x0, 0x0, 0x0}, &(0x7f00000002c0)=0xc) mount$fuseblk(&(0x7f0000000080)='/dev/loop0\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='fuseblk\x00', 0x1000, &(0x7f0000000300)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x6000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@allow_other='allow_other', 0x2c}]}}) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x5}, 0x1c) recvmmsg(0xffffffffffffffff, &(0x7f0000000c00)=[{{&(0x7f0000000400)=@l2, 0x80, &(0x7f0000000480), 0x0, &(0x7f0000000000)=""/117, 0x75}, 0x7}], 0x1, 0x0, &(0x7f0000000cc0)) sendmmsg(r0, &(0x7f0000007e00)=[{{0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f00000003c0)}}, {{&(0x7f00000004c0)=@in6={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000000680), 0x3ba, &(0x7f0000002000)=[{0x10}], 0x10}}], 0x2, 0x8000) 16:57:14 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000180)="025cc83d6d345f8f762070") r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2=0xe0000002}, 0x4}}, 0x2e) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000480)=0x8000, 0x7111) write(r2, &(0x7f0000000300), 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x4100, 0x0) 16:57:14 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0xe80, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:57:14 executing program 7: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x12, 0x0, 0x4, 0x9}, 0x2c) bpf$BPF_PROG_ATTACH(0x9, &(0x7f0000000080)={r0, 0xffffffffffffffff, 0x4, 0x4}, 0xfffffffffffffecc) [ 316.798968] binder: 22695:22699 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1946157056 [ 316.823246] binder: 22695:22699 unknown command 4743953 [ 316.829997] binder: 22695:22699 ioctl c0306201 20000000 returned -22 16:57:14 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000000000000020000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 316.900316] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 316.926368] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue [ 316.958571] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing 16:57:14 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000000000)=""/28, 0xe8) r1 = getpid() sched_setaffinity(r1, 0x8, &(0x7f0000000200)=0x9) sysfs$2(0x2, 0x6, &(0x7f0000000240)=""/159) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a4ceaa05d9a00000000000000039b3fd4cec307e8ef3d13eb790ec9c65abaf90d229db692542e5b78f8b29e0a27800f0000000000000009fb42f376589701a4", 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f000019ffe9)={0xc1, @time}) syz_open_dev$sg(&(0x7f0000000080)='/dev/sg#\x00', 0x8001, 0x8000) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r0, 0xc0605345, &(0x7f0000000100)) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r0, 0x40a85323, &(0x7f0000000380)={{}, 'port1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x4}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000efb000)='/dev/sequencer2\x00', 0x0, 0x0) 16:57:14 executing program 7: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) listen(r0, 0x9) keyctl$chown(0x4, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x6, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f0000001240)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}}) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) syz_open_dev$sndpcmc(&(0x7f0000000100)='/dev/snd/pcmC#D#c\x00', 0x1000000000, 0x0) close(r1) r2 = accept4(r0, &(0x7f0000660ff4)=@nl=@unspec, &(0x7f0000000040)=0xf5b19b4c0b1ce647, 0x0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000000c0)='ip6gretap0\x00', 0x10) recvfrom$inet(r2, &(0x7f0000000200)=""/12, 0xc, 0x0, 0x0, 0x0) 16:57:14 executing program 4: ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f00000000c0)=0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x2000000000000, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x6}, r0, 0x0, 0xffffffffffffffff, 0x0) rt_sigsuspend(&(0x7f0000000000)={0x5}, 0x8) r1 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000080)='/dev/urandom\x00', 0x0, 0x0) r2 = creat(&(0x7f0000000040)='./bus\x00', 0x0) r3 = pkey_alloc(0x0, 0x3) pkey_mprotect(&(0x7f0000006000/0x2000)=nil, 0x2000, 0x1, r3) ftruncate(r2, 0x8200) ioctl$TIOCNOTTY(r2, 0x5422) r4 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r4, 0x0) readv(r1, &(0x7f00000007c0)=[{&(0x7f0000002300)=""/4096, 0x1000}], 0x30e) 16:57:14 executing program 6: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x0, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rfkill\x00', 0x400, 0x0) linkat(r0, &(0x7f0000000080)='./bus/file0\x00', r1, &(0x7f0000000140)='./bus/file0\x00', 0x1000) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000400)=@nat={'nat\x00', 0x19, 0x1, 0x1a8, [0x20000240, 0x0, 0x0, 0x20000270, 0x200002a0], 0x0, &(0x7f0000000200), &(0x7f00000007c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff010000000900000010000000000076657468315f746f5f626f6e64000000697036677265746170300000000000007465616d3000000000000000000000006c6f0000000000000000000000000000aaaaaaaaaabb00ffffffff000180c20000030000000000000000b0000000e8000000180100007374617469737469630000000000000000000000000000000000000000000000180000000000000000000000ffffffff000020000600000007000000000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000001b65b637f9420000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000800000000000000fdffffff00000000a38b20cad72f888954fbf7fa76163814d361d7582faa49360af4a2ad1feaf2fa33c876d7566711161e7ad802de01dd2a02a3d180bf0110afcbe0c65f806329d94ed1362772281aec5fc55e48636b2059e76d7b99b8ef1416aed6db0da3d1ea6de1ffce881f4a68fabfc42ee42df335563bdb7efec5ccf262b6189bbeb96ace3ac2a5c999941f2f69cee9038c05008c8c3b432fe7c4b1d1e9999daa4efc5d45b1c27dc617f5f50b770b759db6afd31966ddb6b5212ba551b5f4994a43ed58d93e47a76a6a79a9345579376d5ee3da102ce0bb3b6a2b9bceb4989d3b5a061403072d271ec913acbc201c6f53d175393a3503065ed612853e1bc0d4af16954574dccf66e152ed858be2174556ddcd4fa89c06a94bf6f05e8043a5661403cdf8b1b6e33032accaf6d9cf37b6800dd1ae86ad9fea8d43800e8764d87905d05de4c6a4aa842f094cd4c09c672b33cc17349c7fd7684eed2b74fc1a9941"]}, 0x37a) symlink(&(0x7f000000bffa)='./control\x00', &(0x7f000000affa)='./bus\x00') r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000240)='/dev/audio\x00', 0x121000, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000280)={{{@in=@rand_addr, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@remote}}, &(0x7f0000000380)=0xe8) bind$can_raw(r2, &(0x7f00000003c0)={0x1d, r3}, 0x10) symlink(&(0x7f0000000480)='./bus\x00', &(0x7f00000004c0)='./control\x00') truncate(&(0x7f0000000100)='./bus/file0\x00', 0x0) personality(0x400000c) 16:57:14 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) [ 317.004878] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue [ 317.029693] binder: 22731:22737 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 317.039676] binder: 22731:22737 unknown command 4743953 16:57:14 executing program 0: socket$inet6(0xa, 0x0, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xd1, &(0x7f0000000180), 0x4) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f000016b000)={0x26, 'skcipher\x00', 0x0, 0x0, 'chacha20-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7295df0df8217ad4000000000000000e6", 0x20) unshare(0x40600) r2 = accept$alg(r1, 0x0, 0x0) recvmsg(r2, &(0x7f0000001200)={&(0x7f0000000000)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x3b9, &(0x7f0000000540)=[{&(0x7f0000000080)=""/165}, {&(0x7f0000000140)=""/195}, {&(0x7f0000000240)=""/243}, {&(0x7f0000001240)=""/4096}, {&(0x7f0000000340)=""/64}, {&(0x7f0000000380)=""/48}, {&(0x7f00000003c0)=""/70}, {&(0x7f0000000600)=""/50}, {&(0x7f0000002240)=""/4096}], 0x100000000000024c, 0x0, 0x3b0, 0xffffffffffffffff}, 0x10000) 16:57:14 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x8, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:57:14 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000007a00000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 317.085966] binder: 22731:22737 ioctl c0306201 20000000 returned -22 16:57:14 executing program 7: nanosleep(&(0x7f0000000180)={0x77359400}, &(0x7f00000001c0)) nanosleep(&(0x7f0000000080)={0x0, 0x1c9c380}, &(0x7f00005bfff0)) r0 = socket$bt_rfcomm(0x1f, 0x3, 0x3) mmap(&(0x7f00008e7000/0x4000)=nil, 0x4000, 0x1000004, 0x8030, r0, 0x0) munlockall() dup2(0xffffffffffffffff, 0xffffffffffffffff) 16:57:14 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x4000000, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:57:14 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f00000001c0)={0x84, @loopback=0x7f000001, 0x0, 0x0, 'wrr\x00', 0x3b, 0x1, 0x59}, 0x2c) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f0000000200)=@xdp={0x2c}, 0x80) [ 317.258570] binder: 22758:22768 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 317.267278] binder: 22758:22768 unknown command 4743953 [ 317.286378] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing 16:57:14 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000180)="025cc80a2b345f8f762070") r1 = dup(r0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, r1, 0x0) setsockopt$inet6_MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000000)={0x9, 0x0, 0x101, 0x2, 0x1}, 0xc) socket$rds(0x15, 0x5, 0x0) prctl$intptr(0x4, 0x0) 16:57:14 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000000006c00000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 317.304475] binder: 22758:22768 ioctl c0306201 20000000 returned -22 [ 317.328200] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue 16:57:14 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/connector\x00') ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0x1}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000000140)={r1, 0x1f, 0x68, "bb25757b467d5bf545fa4784ec8db1d4737240eb6d6948a2106dcc0b811846256c1e303c8d0de179be202c70fe8dbcbf754e0b8f1a8ce4696f791306ea9ea5ec3d19a571c4f8009e0eece629e9e20144cd2fc3dfe9f311699326bf94caf53bc6bbb157219c81a853"}, 0x70) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x15c01000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x24, r2, 0x200, 0x70bd27, 0x25dfdbfc, {0x9}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x5}]}, 0x24}, 0x1}, 0x1) ioctl$HDIO_GETGEO(r0, 0x301, &(0x7f0000000300)) ioctl$KDGKBSENT(r0, 0x4b48, &(0x7f0000000340)={0x7ff, 0x6, 0x1}) epoll_pwait(r0, &(0x7f0000000380)=[{}, {}, {}, {}], 0x4, 0x4, &(0x7f00000003c0)={0x5ac}, 0x8) ioctl$KDSKBMODE(r0, 0x4b45, &(0x7f0000000400)) ioctl$KVM_TPR_ACCESS_REPORTING(r0, 0xc028ae92, &(0x7f0000000440)={0x9, 0x6}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0x404c534a, &(0x7f0000000480)={0x51c1, 0x21f92569, 0x3}) r3 = openat$cgroup_subtree(r0, &(0x7f0000000500)='cgroup.subtree_control\x00', 0x2, 0x0) ioctl$KVM_GET_EMULATED_CPUID(r0, 0xc008ae09, &(0x7f0000000540)=""/245) r4 = getpgrp(0x0) fcntl$setown(r3, 0x8, r4) prctl$setptracer(0x59616d61, r4) setsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000640)={r1, 0x0, 0xffffffffde5998f8, 0x7f}, 0x10) setsockopt$inet_msfilter(r3, 0x0, 0x29, &(0x7f0000000680)={@local={0xac, 0x14, 0x14, 0xaa}, @rand_addr, 0x1, 0x4, [@multicast2=0xe0000002, @local={0xac, 0x14, 0x14, 0xaa}, @remote={0xac, 0x14, 0x14, 0xbb}, @broadcast=0xffffffff]}, 0x20) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000006c0)={r1, 0x20}, &(0x7f0000000700)=0x8) r6 = semget$private(0x0, 0x0, 0x410) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair(0x1b, 0x0, 0x2, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) semop(r6, &(0x7f0000000780)=[{0x2, 0x401, 0x800}, {0x2, 0x3f21, 0x800}, {0x0, 0x9, 0x1000}], 0x3) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r7, 0x84, 0x72, &(0x7f00000007c0)={r5, 0x4b2, 0x30}, &(0x7f0000000800)=0xc) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r0, 0x84, 0x4, &(0x7f0000000840)=0x825f, 0x4) getsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000880)={r5, 0xffffffff, 0x7, 0x1ff, 0xffff, 0x100}, &(0x7f00000008c0)=0x14) getsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000900), &(0x7f0000000940)=0x4) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r7, 0x84, 0x7b, &(0x7f0000000980)={r5, 0x7fff}, &(0x7f00000009c0)=0x8) 16:57:14 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) [ 317.370810] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor2: Inode table for bg 0 marked as needing zeroing [ 317.384186] EXT4-fs (sda1): re-mounted. Opts: usrjquota=¬,errors=continue 16:57:14 executing program 1: syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_open_dev$ndb(&(0x7f0000000080)='/dev/nbd#\x00', 0x0, 0x800) [ 317.446186] IPVS: ip_vs_svc_hash(): request for already hashed, called from do_ip_vs_set_ctl+0x1b3a/0x1d80 [ 317.458623] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 16:57:14 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0xd, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:57:14 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000068000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 317.506040] binder: 22791:22798 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 317.515186] binder: 22791:22798 unknown command 4743953 [ 317.530085] binder: 22791:22798 ioctl c0306201 20000000 returned -22 [ 317.691500] binder: 22819:22824 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 317.700227] binder: 22819:22824 unknown command 4743953 [ 317.722219] binder: 22819:22824 ioctl c0306201 20000000 returned -22 16:57:15 executing program 4: r0 = socket(0x1e, 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x80000}, 0x0, 0x0, 0xffffffffffffffff, 0x20000000000000) recvmsg$kcm(r0, &(0x7f00000000c0)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000000080)=[{&(0x7f00000001c0)=""/142, 0x8e}], 0x1, &(0x7f0000000280)=""/79, 0x4f}, 0x160) 16:57:15 executing program 6: r0 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x2, 0x6400) ioctl$KDDELIO(r0, 0x4b35, 0xfffffffffffffff7) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x6, &(0x7f0000000280)="025cc83d6d345f8f762070") clone(0x0, &(0x7f0000000000)="b5d127211c70d794c32cd823f0aba4aa6fbdf512dd61b4186f624f3d21ae47f852e8a85c13e73d311218aea33c", &(0x7f0000001ffc), &(0x7f0000001000), &(0x7f0000001000)) sysinfo(&(0x7f0000000300)=""/182) 16:57:15 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'veth1_to_bond\x00', 0x0}) connect$can_bcm(r0, &(0x7f0000000040)={0x1d, r1}, 0x10) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x400c40, 0x0) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r2, 0x80dc5521, &(0x7f0000000180)=""/240) 16:57:15 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)="65787434fd", &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:57:15 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0x1e}}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x6, &(0x7f0000000200)=ANY=[@ANYBLOB="00cc7d470004000050e3f4efc3a787c0dac8ce1510b2f66c68a5723dcfce737ad8d0e374d6a593d5b4e58933fb81b5725f8000000000000000408d26f13a2c559342afa1bfae91d0827da5a69217f04e4378df8a0b465b885ebb13e4588ef848a680674b63e2a1efdc37da7dd0abe49719c9c627cacfa0fe49bbc5d12a959c057c4172abaaca5336826b46464e4492153b8103bb42e28896ef37eb498b91bff2b3da664f121159542c353fbcae3b2d8b8f0046d7e3fb81ac3e8ca51a6b07abedf8c6440477b2a53e57c1966b993f51df2316c44cf6f553a877b0d0f3af41a22e63cd0518be3a006d77e3a91dd8910c409fe97d07ef2b9c0f7a6e1e92a86745ffa47b"], 0x8) 16:57:15 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c4000000000020d7400000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 318.202902] binder: 22836:22844 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 318.211597] binder: 22836:22844 unknown command 4743953 [ 318.217074] binder: 22836:22844 ioctl c0306201 20000000 returned -22 [ 318.250735] binder: 22836:22844 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 318.260203] binder: 22836:22844 unknown command 4743953 [ 318.286380] binder: 22836:22844 ioctl c0306201 20000000 returned -22 16:57:15 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000180)="295ee1311f16f477671070") socket$bt_rfcomm(0x1f, 0x3, 0x3) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xaa}, 0x4}, 0x1c) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f000014f000)={&(0x7f00003c7ff4)={0x10}, 0xc, &(0x7f00000bfff0)={&(0x7f0000006440)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}, 0x1}, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xaa}, 0x100000001}, 0x1c) 16:57:15 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x86ddffff00000000, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:57:15 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000880)='rdma.current\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000008c0)={0x0, 0x8001, 0x401, 0x0, 0x31, r0, 0x29}, 0x2c) r1 = socket(0x1e, 0x805, 0x0) mount$9p_virtio(&(0x7f0000000940)='rdma.current\x00', &(0x7f0000000980)='./file0\x00', &(0x7f00000009c0)='9p\x00', 0x80000, &(0x7f0000000a00)={'trans=virtio,', {[{@cache_none='cache=none', 0x2c}, {@cache_fscache='cache=fscache', 0x2c}, {@privport='privport', 0x2c}]}}) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000740)=@req3={0xff, 0x8}, 0x1c) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)="6370757365742e6566e665637458388bf36370757300", 0x0, 0x0) fstat(r1, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = getgid() getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000000c0)={{{@in=@multicast2, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@multicast2}}, &(0x7f00000001c0)=0xe8) r6 = getegid() lstat(&(0x7f0000000700)='./file0\x00', &(0x7f0000000e00)={0x0, 0x0, 0x0, 0x0, 0x0}) r8 = getegid() getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast1, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@local}}, &(0x7f00000003c0)=0xe8) getgroups(0x2, &(0x7f0000000400)=[0xffffffffffffffff, 0xee01]) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000440)={{{@in=@local, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@local}}, &(0x7f0000000540)=0xe8) stat(&(0x7f0000000580)='./file0\x00', &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r13 = geteuid() getgroups(0x5, &(0x7f0000000640)=[0xffffffffffffffff, 0xee00, 0xee01, 0xee00, 0x0]) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000780)={{{@in=@rand_addr, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@loopback}}, &(0x7f0000000680)=0xe8) getgroups(0x8, &(0x7f00000006c0)=[0xee00, 0xee01, 0xee00, 0xee00, 0xffffffffffffffff, 0xee00, 0xffffffffffffffff, 0xee01]) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000200)={0x0, 0x3, 0x30}, &(0x7f0000000240)=0xc) setsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000280)={r17, 0xce}, 0x8) ioctl$VT_SETMODE(r0, 0x5602, &(0x7f0000000900)={0x800, 0x401, 0x0, 0xfffffffffffffffa, 0x7ff}) write$FUSE_DIRENTPLUS(r2, &(0x7f0000000e80)=ANY=[@ANYBLOB="70040000feffffff05000000000000000500000000000000010000000000000009000000000000000200000000000000030000000000000005000000000000000400000000000000060000000000000009000000000000007f00000000000000470b00000000000001000000ab0f00000800000000000000ca000000", @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="0000000000010000000000000000000000000000f00100000000000009000000000000007d47504c262c656d3100000000000000000000000000000003000000000000007f000000000000000700000000000000000200000100000001000000000000000400000000000000faffffffffffffff0101000000000000040000000000000000000000000000000700000009000000050000000100000001000000", @ANYRES32=r5, @ANYRES32=r6, @ANYBLOB="0100000008000000000000000400000000000000090000000000000008000000020000002d2a28776c616e31060000000000000000000000000000000800000000000000070000000000000005000000ff7f000000800000000000008948ffffffffffff380800000000000004000000000000000100000000000000010000000100000008000000b83a00000600000001000000f8020000", @ANYRES32=r7, @ANYRES32=r8, @ANYBLOB="00010000ff03000000000000040000000000000000000000010000000000000009000000020000000000000003000000000000000100008000000000000200000000000003000000ff0700000500000000000000000000800000000003000000000000000600000000000000010000000000000001000000010000000800000004000000fc4c00000400000001000000", @ANYRES32=r9, @ANYRES32=r10, @ANYBLOB="b7000000ffffff7f00000000020000000000000001000000000000000800000001800000285e766d6e65743003000000000000000200000000000000ff00000000000000f7ffffffffffffff060000000900000002000000000000007f0000000000000008000000000000000600000000000000ff03000000000000680000000000000001040000770e0000040000000200000001000000", @ANYRES32=r11, @ANYRES32=r12, @ANYBLOB="080000000900000000000000060000000000000007000d000000000008000000090000005c7b6367726f757004e0ffffbfea00000100000000000000ffffffffffffffff0008000000000000050000000500000000000000000000000000000000000000b5100000000000000200000000002800ffffff7f00000000da00000000000000010000000200000084970000cf09000002000000", @ANYRES32=r13, @ANYRES32=r14, @ANYBLOB="0200000008000000000000000200000000000000000001000000000000000000ff030000040000000000000003000000000000000400000000000000ffffffffffffffff08000000030000000200000000000000d50f000000000000060000000000000006000000000000008100000000000000050000000000000003000000000000c020000000d000000000000100", @ANYRES32=r15, @ANYRES32=r16, @ANYBLOB="3f000000ff000000000000000001001300000040000b010000b2000000656d3173656c696e75785c0000000000b4556dac0009f59c77267b202e1fb7b83a44c7c09e036e599aa03e21b4d40d790e47df956fd6797799f42c50059a7a1af5352dac87a03514eec300869d4ccabbf03f4d1973c6ea06c98ea29800e6a69656af925bc78c95612f7f"], 0x470) sendmsg(r1, &(0x7f0000030000)={&(0x7f00004f5000)=@generic={0x10000000001e, "0100000900000000000000000226cc573c080000003724c71e14dd6a739effea1b48006be61ffe0000e103000000f8000004003f010039d8f986ff01000300000004af50d50700000000000000e3ad316a1983000000001d00e0dfcb24281e27800000100076c3979ac40000bd15020078a1dfd300881a8365b1b16d7436"}, 0x80, &(0x7f0000000480), 0x0, &(0x7f00006e9c68)}, 0x0) 16:57:15 executing program 0: socket$inet6(0xa, 0x7, 0x2) mount(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='reiserfs\x00', 0xa800, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snapshot\x00', 0x101000, 0x0) getsockopt$EBT_SO_GET_INIT_INFO(r0, 0x0, 0x82, &(0x7f0000000180)={'nat\x00'}, &(0x7f0000000100)=0xfffffffffffffe00) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000500)=@broute={'broute\x00', 0x20, 0x1, 0x220, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200002c0], 0x7, &(0x7f0000000080), &(0x7f0000000580)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000000006e2a30456b886bc2165b41fe6900000079616d3000000000000000000000000079616d3000000000000000000000000076657468315f742f5f626f6e640000000180c20000000000000000000180c20000000000000000000000b0000000600100009001000071756f74610000000000000000000000000000000000000000000000000000001800000000000000000000000000000000000000000000000000000000000000646e61740000000000000000000000000000000000000000000000000000000010000000000000000180c20000000000ffffffff000000006e666c6f67000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000017d122d4e27ebdf3b9dc569e338e2c551c2fc4a19597ba4c501c8b1f16fb7809c40aee86d9a0ef7981f4af1506f4fe16383d2afb577ed2bb6dd99f024b3f54ba000000004155444954000000000000000000000000000000000000000000000000000000080000000000000000000000000000003ab39b0db8c895ea1cde4f30d2a9bb6ca8718816b433a6071382aca9841809e9a844a6546026dbcc77c25750b829c7c3b4f7b39dacabbcbacae861656d7d1becdcf13d4f35c127e7dea49b253438a3f8ada7f221626cfc3d"]}, 0x2f0) 16:57:15 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:57:15 executing program 6: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000340)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RREADDIR(r1, &(0x7f0000000480)={0x2a, 0x29, 0x1, {0x0, [{{}, 0x0, 0x0, 0x7, './file0'}]}}, 0x2a) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RWALK(r1, &(0x7f0000000500)=ANY=[@ANYBLOB="091900006f010037ea"], 0x9) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000900)='9p\x00', 0x0, &(0x7f0000000840)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@access_uid={'access', 0x3d}, 0x2c}]}}) utimes(&(0x7f0000000180)='./file0\x00', &(0x7f0000000380)) 16:57:15 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000200000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:57:15 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) r2 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x3, 0x6200) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) mq_timedsend(r2, &(0x7f0000000040)="457a4a08329dc4b75d4c2dfa17c445eedbbfa1d5488a8c9bc58a281c367f3d0bdb2e0cee45ea1d5e0f2af06bcf58d4da945af9320475b345b2014e4d16c10c42797eb962b5fbda2cb82f52b91fe6ea453a2d99e9e8ed906407cc988b887777b6b00bd2a92dda39c65fff648ca9b74e0e673b07c4cfc79e70051342c0c92f8e41c802516f40f68f4227e99003abb8729bf61f57a4d211d9a570713efbca2a2b5a7a37c5b3d61c88f4ed359c9f20f40427747f55b2604d507f58b00b1a93f4c5e22c247d53f4633134524a47f8a5a8e2c47cbfc43196bf628368a1", 0xda, 0x9, &(0x7f0000000180)={r3, r4+10000000}) ioctl$TIOCSETD(r1, 0x5437, &(0x7f0000fd0ffc)) dup3(r1, r0, 0x0) 16:57:15 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x100000000000000, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:57:15 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000180)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000240)=ANY=[@ANYRES32=0x0, @ANYBLOB="9b0000010000f6bf1b4a7a375c52a8889b3543f07998da3875331e72f61e7982689bcf4afae8076d95f78acb36f3e3d4315ef56dd8fd7379c2dbdb73e7b77a3a762727dce5e0"], &(0x7f0000000080)=0xa) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f0000000100)={0x3fffffff8000, 0x0, 0x5}, 0x10) r3 = creat(&(0x7f0000000040)='./file0\x00', 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xfff6) fallocate(r3, 0x8, 0x0, 0x8000) r4 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) dup2(r0, r2) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r3, 0x84, 0x6d, &(0x7f00000002c0)={0x0, 0x6b, "d614241be14636a3fc16950ac427bf30bf1856899447a1df52fe100ac9a336e3d3821fac31d58e97e69e793397c493ef67a94b0eac4efbfcc027421d062ef02f149179f83ac46c997c5ef88d8f3425c4987ed9b721a5ef762def9a20ec2a2f188e402c9578406bc009f191"}, &(0x7f0000000000)=0x73) setsockopt$inet_sctp6_SCTP_RTOINFO(r4, 0x84, 0x0, &(0x7f0000000340)={r5, 0x8, 0x100000000, 0x100}, 0x10) setsockopt$inet_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000200)={0x9}, 0x4) [ 318.459367] kernel msg: ebtables bug: please report to author: Wrong len argument [ 318.489421] binder: 22883:22894 BC_REQUEST_DEATH_NOTIFICATION invalid ref 33554432 [ 318.498540] binder: 22883:22894 unknown command 4743953 16:57:15 executing program 0: prctl$intptr(0x30, 0x0) lremovexattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@known='system.sockprotoname\x00') r0 = syz_open_dev$mouse(&(0x7f0000000080)='/dev/input/mouse#\x00', 0x80, 0x8000) ioctl$VT_DISALLOCATE(r0, 0x5608) 16:57:15 executing program 4: syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0xe004, 0x1, &(0x7f0000000380)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401000200027000f8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000000080), &(0x7f00000000c0)=0x4) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r0, 0x80047210, &(0x7f0000000140)={0xfffffffffffffffc, 0xffffffffffffffff, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x6}, 'bcsh0\x00'}) 16:57:15 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c40000000d40d020000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) 16:57:15 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) [ 318.504247] binder: 22883:22894 ioctl c0306201 20000000 returned -22 16:57:15 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x2000, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r1, 0xc02c5341, &(0x7f00000001c0)) r2 = socket(0x11, 0x3, 0x0) bind$packet(r2, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r2, 0x107, 0x5, &(0x7f0000001000), 0xc5) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r3, 0x0) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000180)={0x0, 0x0, 0x9ffc}, 0x4) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}, 0x4}, 0x1c) sendmmsg(r5, &(0x7f0000007e00), 0x4000000000002f6, 0x0) sendto$inet6(r4, &(0x7f0000000280), 0xfffffdf7, 0x20000004, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) shutdown(r4, 0x1) 16:57:15 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") remap_file_pages(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$team(&(0x7f0000000000)='team\x00') prctl$setmm(0x23, 0x7, &(0x7f0000ffc000/0x4000)=nil) 16:57:15 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x7ff, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x300000000000000, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 16:57:15 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f0000000340)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) mknodat(r0, &(0x7f0000000100)='./file0\x00', 0x2, 0x1f) r1 = open$dir(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) mknodat(r1, &(0x7f0000000140)='./file1\x00', 0x0, 0xfffffffe) unlinkat(r1, &(0x7f00000007c0)='./file0\x00', 0x0) 16:57:15 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c400000000300000000000000000e630c40000000000000000000000000116348"], 0x0, 0x0, &(0x7f0000000080)}) [ 318.663219] binder: 22918:22921 BC_REQUEST_DEATH_NOTIFICATION invalid ref -738197504 [ 318.675103] binder: 22918:22921 unknown command 4743953 [ 318.680734] QAT: Invalid ioctl [ 318.688171] binder: 22918:22921 ioctl c0306201 20000000 returned -22 16:57:16 executing program 2: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x30, &(0x7f00000003c0)=ANY=[@ANYBLOB="7573726a71756f74613dac"]) 16:57:16 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x0, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000d300000000028000007a0a00ffffffff006301"], &(0x7f0000000000)="47504c00bd304702525f484f89db96dd6ca64da40ff023122e60f6", 0x0, 0xce, &(0x7f0000001b80)=""/206}, 0x48) r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x800, 0x0) ioctl$TUNDETACHFILTER(r0, 0x401054d6, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000000c0)={0x0, @local}, &(0x7f0000000180)=0xc) ioctl$PERF_EVENT_IOC_ID(r0, 0x80082407, &(0x7f00000001c0)) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f00000003c0)={@remote={0xfe, 0x80, [], 0xbb}, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}, 0x5, 0x6, 0x8, 0x100, 0x5, 0x10000, r1}) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0xd, 0x5, &(0x7f0000000040)=@framed={{0x18}, [@jmp={0x5}], {0x95}}, &(0x7f0000000200)='syzkaller\x00', 0x80000001, 0x228, &(0x7f0000000300)=""/187}, 0x48) [ 318.841373] binder: 22947:22949 BC_REQUEST_DEATH_NOTIFICATION invalid ref 50331648 [ 318.861703] binder: 22947:22949 unknown command 4743953 [ 318.867441] binder: 22947:22949 ioctl c0306201 20000000 returned -22 [ 318.884286] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 318.886587] binder: 22947:22949 BC_REQUEST_DEATH_NOTIFICATION invalid ref 50331648 [ 318.902503] binder: 22947:22949 unknown command 4743953 [ 318.908163] binder: 22947:22949 ioctl c0306201 20000000 returned -22 [ 318.938121] tmpfs: No value for mount option '/proc/sys/net/ipv4/vs/drop_packet' [ 319.470253] QAT: Invalid ioctl [ 574.432450] INFO: task syz-executor6:22975 blocked for more than 140 seconds. [ 574.439894] Not tainted 4.18.0-rc4-next-20180713+ #7 [ 574.445523] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 574.453484] syz-executor6 D25872 22975 12554 0x00000004 [ 574.459197] Call Trace: [ 574.461860] __schedule+0x87c/0x1ed0 [ 574.465588] ? __sched_text_start+0x8/0x8 [ 574.469742] ? trace_hardirqs_on+0x10/0x10 [ 574.474004] ? plist_check_head+0x150/0x150 [ 574.478332] ? trace_hardirqs_on+0x10/0x10 [ 574.482573] ? __schedule+0x1ed0/0x1ed0 [ 574.486567] schedule+0xfb/0x450 [ 574.489940] ? lock_downgrade+0x8f0/0x8f0 [ 574.494084] ? __schedule+0x1ed0/0x1ed0 [ 574.498060] ? kasan_check_read+0x11/0x20 [ 574.502216] ? do_raw_spin_unlock+0xa7/0x2f0 [ 574.506644] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 574.511224] ? kasan_check_write+0x14/0x20 [ 574.515458] ? do_raw_spin_lock+0xc1/0x200 [ 574.519705] __rwsem_down_write_failed_common+0x95d/0x1630 [ 574.525332] ? rwsem_spin_on_owner+0xa40/0xa40 [ 574.529908] ? lock_release+0xa30/0xa30 [ 574.533880] ? trace_hardirqs_on+0x10/0x10 [ 574.538107] ? trace_hardirqs_on+0x10/0x10 [ 574.542357] ? kernel_text_address+0x79/0xf0 [ 574.546770] ? __kernel_text_address+0xd/0x40 [ 574.551268] ? unwind_get_return_address+0x61/0xa0 [ 574.557590] ? __save_stack_trace+0x8d/0xf0 [ 574.561915] ? save_stack+0xa9/0xd0 [ 574.565532] ? save_stack+0x43/0xd0 [ 574.569154] ? __kasan_slab_free+0x11a/0x170 [ 574.573550] ? kasan_slab_free+0xe/0x10 [ 574.577537] ? kmem_cache_free+0x86/0x2d0 [ 574.581684] ? putname+0xf2/0x130 [ 574.585138] ? filename_lookup+0x397/0x510 [ 574.589374] ? user_path_at_empty+0x40/0x50 [ 574.593695] ? do_utimes+0x1d0/0x380 [ 574.597395] ? do_futimesat+0x249/0x350 [ 574.601365] ? __x64_sys_utimes+0x59/0x80 [ 574.605514] ? do_syscall_64+0x1b9/0x820 [ 574.609683] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 574.615143] ? do_raw_spin_unlock+0xa7/0x2f0 [ 574.619549] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 574.624161] ? kasan_check_write+0x14/0x20 [ 574.628429] ? do_raw_spin_lock+0xc1/0x200 [ 574.632681] ? lock_acquire+0x1e4/0x540 [ 574.636744] ? utimes_common.isra.1+0x45c/0x8e0 [ 574.641424] ? mnt_want_write+0x3f/0xc0 [ 574.645580] ? lock_release+0xa30/0xa30 [ 574.649568] ? check_same_owner+0x340/0x340 [ 574.653905] rwsem_down_write_failed+0xe/0x10 [ 574.658391] ? rwsem_down_write_failed+0xe/0x10 [ 574.663059] call_rwsem_down_write_failed+0x17/0x30 [ 574.668180] down_write+0xaa/0x130 [ 574.671724] ? utimes_common.isra.1+0x45c/0x8e0 [ 574.676385] ? down_read+0x1d0/0x1d0 [ 574.680103] ? __sb_start_write+0x17f/0x300 [ 574.684418] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 574.689953] utimes_common.isra.1+0x45c/0x8e0 [ 574.694451] ? __ia32_sys_sync_file_range2+0xf0/0xf0 [ 574.699550] ? lock_acquire+0x1e4/0x540 [ 574.703516] ? __might_fault+0x12b/0x1e0 [ 574.707580] do_utimes+0x1f7/0x380 [ 574.711120] ? utimes_common.isra.1+0x8e0/0x8e0 [ 574.715814] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 574.721353] ? _copy_from_user+0xdf/0x150 [ 574.725497] do_futimesat+0x249/0x350 [ 574.729297] ? __ia32_sys_utime+0x290/0x290 [ 574.733618] ? do_futex+0x27d0/0x27d0 [ 574.737412] ? syscall_slow_exit_work+0x500/0x500 [ 574.742349] ? ksys_ioctl+0x81/0xd0 [ 574.746077] __x64_sys_utimes+0x59/0x80 [ 574.750049] do_syscall_64+0x1b9/0x820 [ 574.753929] ? finish_task_switch+0x1d3/0x870 [ 574.758420] ? syscall_return_slowpath+0x5e0/0x5e0 [ 574.763690] ? syscall_return_slowpath+0x31d/0x5e0 [ 574.768631] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 574.773643] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 574.778489] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 574.783769] RIP: 0033:0x455ab9 [ 574.787213] Code: e0 1f 48 89 04 24 e8 b6 6f fd ff e8 81 6a fd ff e8 5c 68 fd ff 48 8d 05 92 9a 48 00 48 89 04 24 48 c7 44 24 08 1d 00 00 00 e8 <13> 5e fd ff 0f 0b e8 8c 44 00 00 e9 07 f0 ff ff cc cc cc cc cc cc [ 574.806361] RSP: 002b:00007fdcbf62ec68 EFLAGS: 00000246 ORIG_RAX: 00000000000000eb [ 574.815883] RAX: ffffffffffffffda RBX: 00007fdcbf62f6d4 RCX: 0000000000455ab9 [ 574.823154] RDX: 0000000000000000 RSI: 0000000020000380 RDI: 0000000020000180 [ 574.830417] RBP: 000000000072bff0 R08: 0000000000000000 R09: 0000000000000000 [ 574.837694] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 574.844964] R13: 00000000004c2735 R14: 00000000004d4410 R15: 0000000000000002 [ 574.852232] INFO: lockdep is turned off. [ 574.856279] NMI backtrace for cpu 1 [ 574.859914] CPU: 1 PID: 901 Comm: khungtaskd Not tainted 4.18.0-rc4-next-20180713+ #7 [ 574.867857] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 574.877187] Call Trace: [ 574.879761] dump_stack+0x1c9/0x2b4 [ 574.883373] ? dump_stack_print_info.cold.2+0x52/0x52 [ 574.888542] ? vprintk_default+0x28/0x30 [ 574.892584] ? lapic_can_unplug_cpu.cold.28+0x3f/0x3f [ 574.897753] nmi_cpu_backtrace.cold.3+0x48/0x88 [ 574.902407] ? lapic_can_unplug_cpu.cold.28+0x3f/0x3f [ 574.907574] nmi_trigger_cpumask_backtrace+0x151/0x192 [ 574.912832] arch_trigger_cpumask_backtrace+0x14/0x20 [ 574.917998] watchdog+0xb81/0x10f0 [ 574.921528] ? reset_hung_task_detector+0xd0/0xd0 [ 574.926349] ? find_held_lock+0x36/0x1c0 [ 574.930394] ? kasan_check_read+0x11/0x20 [ 574.934530] ? do_raw_spin_unlock+0xa7/0x2f0 [ 574.938926] ? _raw_spin_unlock_irqrestore+0x74/0xc0 [ 574.944007] ? __kthread_parkme+0x58/0x1b0 [ 574.948218] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 574.953214] ? trace_hardirqs_on+0xd/0x10 [ 574.957349] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 574.962862] ? __kthread_parkme+0x106/0x1b0 [ 574.967161] kthread+0x345/0x410 [ 574.970514] ? reset_hung_task_detector+0xd0/0xd0 [ 574.975347] ? kthread_bind+0x40/0x40 [ 574.979126] ret_from_fork+0x3a/0x50 [ 574.982860] Sending NMI from CPU 1 to CPUs 0: [ 574.987398] NMI backtrace for cpu 0 skipped: idling at native_safe_halt+0x6/0x10 [ 574.988362] Kernel panic - not syncing: hung_task: blocked tasks [ 575.001099] CPU: 1 PID: 901 Comm: khungtaskd Not tainted 4.18.0-rc4-next-20180713+ #7 [ 575.009045] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 575.018385] Call Trace: [ 575.020956] dump_stack+0x1c9/0x2b4 [ 575.024561] ? dump_stack_print_info.cold.2+0x52/0x52 [ 575.029731] ? printk_safe_log_store+0x2f0/0x2f0 [ 575.034468] panic+0x238/0x4e7 [ 575.037636] ? add_taint.cold.5+0x16/0x16 [ 575.041763] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 575.047283] ? nmi_trigger_cpumask_backtrace+0x13a/0x192 [ 575.052720] ? printk_safe_flush+0xd7/0x130 [ 575.057018] watchdog+0xb92/0x10f0 [ 575.060547] ? reset_hung_task_detector+0xd0/0xd0 [ 575.065368] ? find_held_lock+0x36/0x1c0 [ 575.069412] ? kasan_check_read+0x11/0x20 [ 575.073546] ? do_raw_spin_unlock+0xa7/0x2f0 [ 575.078022] ? _raw_spin_unlock_irqrestore+0x74/0xc0 [ 575.083102] ? __kthread_parkme+0x58/0x1b0 [ 575.087315] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 575.092311] ? trace_hardirqs_on+0xd/0x10 [ 575.096438] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 575.101955] ? __kthread_parkme+0x106/0x1b0 [ 575.106256] kthread+0x345/0x410 [ 575.110175] ? reset_hung_task_detector+0xd0/0xd0 [ 575.114996] ? kthread_bind+0x40/0x40 [ 575.118775] ret_from_fork+0x3a/0x50 [ 575.122911] Dumping ftrace buffer: [ 575.126601] (ftrace buffer empty) [ 575.130288] Kernel Offset: disabled [ 575.133894] Rebooting in 86400 seconds..