[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 56.292046][ T26] audit: type=1800 audit(1572907699.378:25): pid=8682 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 56.337029][ T26] audit: type=1800 audit(1572907699.378:26): pid=8682 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 56.376880][ T26] audit: type=1800 audit(1572907699.378:27): pid=8682 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.23' (ECDSA) to the list of known hosts. 2019/11/04 22:48:30 fuzzer started 2019/11/04 22:48:32 dialing manager at 10.128.0.26:42879 2019/11/04 22:48:32 syscalls: 2566 2019/11/04 22:48:32 code coverage: enabled 2019/11/04 22:48:32 comparison tracing: enabled 2019/11/04 22:48:32 extra coverage: extra coverage is not supported by the kernel 2019/11/04 22:48:32 setuid sandbox: enabled 2019/11/04 22:48:32 namespace sandbox: enabled 2019/11/04 22:48:32 Android sandbox: /sys/fs/selinux/policy does not exist 2019/11/04 22:48:32 fault injection: enabled 2019/11/04 22:48:32 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/11/04 22:48:32 net packet injection: enabled 2019/11/04 22:48:32 net device setup: enabled 2019/11/04 22:48:32 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2019/11/04 22:48:32 devlink PCI setup: PCI device 0000:00:10.0 is not available 22:50:30 executing program 0: 22:50:30 executing program 1: syzkaller login: [ 187.707971][ T8850] IPVS: ftp: loaded support on port[0] = 21 22:50:30 executing program 2: [ 187.832154][ T8852] IPVS: ftp: loaded support on port[0] = 21 [ 187.879865][ T8850] chnl_net:caif_netlink_parms(): no params data found [ 187.984651][ T8855] IPVS: ftp: loaded support on port[0] = 21 [ 188.015755][ T8850] bridge0: port 1(bridge_slave_0) entered blocking state [ 188.031396][ T8850] bridge0: port 1(bridge_slave_0) entered disabled state [ 188.040407][ T8850] device bridge_slave_0 entered promiscuous mode [ 188.080681][ T8850] bridge0: port 2(bridge_slave_1) entered blocking state [ 188.090232][ T8850] bridge0: port 2(bridge_slave_1) entered disabled state [ 188.098712][ T8850] device bridge_slave_1 entered promiscuous mode 22:50:31 executing program 3: [ 188.168859][ T8850] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 188.189215][ T8852] chnl_net:caif_netlink_parms(): no params data found [ 188.216368][ T8850] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 188.303709][ T8852] bridge0: port 1(bridge_slave_0) entered blocking state [ 188.326887][ T8852] bridge0: port 1(bridge_slave_0) entered disabled state [ 188.335115][ T8852] device bridge_slave_0 entered promiscuous mode [ 188.348651][ T8850] team0: Port device team_slave_0 added [ 188.377069][ T8852] bridge0: port 2(bridge_slave_1) entered blocking state [ 188.384151][ T8852] bridge0: port 2(bridge_slave_1) entered disabled state [ 188.402403][ T8852] device bridge_slave_1 entered promiscuous mode [ 188.435337][ T8858] IPVS: ftp: loaded support on port[0] = 21 [ 188.445100][ T8850] team0: Port device team_slave_1 added 22:50:31 executing program 4: [ 188.486838][ T8852] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 188.550626][ T8852] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 188.606615][ T8855] chnl_net:caif_netlink_parms(): no params data found [ 188.680310][ T8850] device hsr_slave_0 entered promiscuous mode 22:50:31 executing program 5: [ 188.768097][ T8850] device hsr_slave_1 entered promiscuous mode [ 188.811595][ T8852] team0: Port device team_slave_0 added [ 188.832852][ T8852] team0: Port device team_slave_1 added [ 188.853550][ T8863] IPVS: ftp: loaded support on port[0] = 21 [ 188.866060][ T8865] IPVS: ftp: loaded support on port[0] = 21 [ 188.912914][ T8855] bridge0: port 1(bridge_slave_0) entered blocking state [ 188.920119][ T8855] bridge0: port 1(bridge_slave_0) entered disabled state [ 188.928364][ T8855] device bridge_slave_0 entered promiscuous mode [ 188.941534][ T8855] bridge0: port 2(bridge_slave_1) entered blocking state [ 188.948689][ T8855] bridge0: port 2(bridge_slave_1) entered disabled state [ 188.956337][ T8855] device bridge_slave_1 entered promiscuous mode [ 189.018824][ T8852] device hsr_slave_0 entered promiscuous mode [ 189.087216][ T8852] device hsr_slave_1 entered promiscuous mode [ 189.156974][ T8852] debugfs: Directory 'hsr0' with parent '/' already present! [ 189.198455][ T8855] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 189.209083][ T8855] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 189.272592][ T8855] team0: Port device team_slave_0 added [ 189.282928][ T8855] team0: Port device team_slave_1 added [ 189.379182][ T8855] device hsr_slave_0 entered promiscuous mode [ 189.427266][ T8855] device hsr_slave_1 entered promiscuous mode [ 189.466964][ T8855] debugfs: Directory 'hsr0' with parent '/' already present! [ 189.556487][ T8865] chnl_net:caif_netlink_parms(): no params data found [ 189.575983][ T8858] chnl_net:caif_netlink_parms(): no params data found [ 189.649353][ T8858] bridge0: port 1(bridge_slave_0) entered blocking state [ 189.656504][ T8858] bridge0: port 1(bridge_slave_0) entered disabled state [ 189.664208][ T8858] device bridge_slave_0 entered promiscuous mode [ 189.682101][ T8865] bridge0: port 1(bridge_slave_0) entered blocking state [ 189.689255][ T8865] bridge0: port 1(bridge_slave_0) entered disabled state [ 189.699970][ T8865] device bridge_slave_0 entered promiscuous mode [ 189.729987][ T8858] bridge0: port 2(bridge_slave_1) entered blocking state [ 189.737336][ T8858] bridge0: port 2(bridge_slave_1) entered disabled state [ 189.745354][ T8858] device bridge_slave_1 entered promiscuous mode [ 189.768107][ T8858] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 189.786689][ T8850] 8021q: adding VLAN 0 to HW filter on device bond0 [ 189.794099][ T8865] bridge0: port 2(bridge_slave_1) entered blocking state [ 189.801899][ T8865] bridge0: port 2(bridge_slave_1) entered disabled state [ 189.810385][ T8865] device bridge_slave_1 entered promiscuous mode [ 189.830168][ T8858] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 189.846228][ T8850] 8021q: adding VLAN 0 to HW filter on device team0 [ 189.854660][ T8863] chnl_net:caif_netlink_parms(): no params data found [ 189.876554][ T8865] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 189.892662][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 189.901212][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 189.924340][ T8858] team0: Port device team_slave_0 added [ 189.940425][ T8865] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 189.964879][ T8858] team0: Port device team_slave_1 added [ 189.982950][ T3101] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 189.992026][ T3101] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 190.000797][ T3101] bridge0: port 1(bridge_slave_0) entered blocking state [ 190.008051][ T3101] bridge0: port 1(bridge_slave_0) entered forwarding state [ 190.016185][ T3101] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 190.025877][ T3101] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 190.034346][ T3101] bridge0: port 2(bridge_slave_1) entered blocking state [ 190.041439][ T3101] bridge0: port 2(bridge_slave_1) entered forwarding state [ 190.049239][ T3101] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 190.058570][ T3101] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 190.119362][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 190.128458][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 190.137676][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 190.146023][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 190.162687][ T8865] team0: Port device team_slave_0 added [ 190.168843][ T8863] bridge0: port 1(bridge_slave_0) entered blocking state [ 190.175885][ T8863] bridge0: port 1(bridge_slave_0) entered disabled state [ 190.184047][ T8863] device bridge_slave_0 entered promiscuous mode [ 190.191914][ T8863] bridge0: port 2(bridge_slave_1) entered blocking state [ 190.200089][ T8863] bridge0: port 2(bridge_slave_1) entered disabled state [ 190.208276][ T8863] device bridge_slave_1 entered promiscuous mode [ 190.290272][ T8858] device hsr_slave_0 entered promiscuous mode [ 190.347418][ T8858] device hsr_slave_1 entered promiscuous mode [ 190.416962][ T8858] debugfs: Directory 'hsr0' with parent '/' already present! [ 190.425955][ T8865] team0: Port device team_slave_1 added [ 190.434845][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 190.443790][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 190.459187][ T8852] 8021q: adding VLAN 0 to HW filter on device bond0 [ 190.475394][ T8863] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 190.486046][ T8863] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 190.518845][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 190.527880][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 190.536090][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 190.544511][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 190.555869][ T8850] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 190.609885][ T8865] device hsr_slave_0 entered promiscuous mode [ 190.647378][ T8865] device hsr_slave_1 entered promiscuous mode [ 190.696907][ T8865] debugfs: Directory 'hsr0' with parent '/' already present! [ 190.713935][ T8852] 8021q: adding VLAN 0 to HW filter on device team0 [ 190.736528][ T8863] team0: Port device team_slave_0 added [ 190.752635][ T3101] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 190.761038][ T3101] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 190.776662][ T8855] 8021q: adding VLAN 0 to HW filter on device bond0 [ 190.807369][ T8863] team0: Port device team_slave_1 added [ 190.843589][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 190.851722][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 190.859214][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 190.867701][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 190.875950][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 190.883029][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 190.890699][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 190.900482][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 190.908977][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 190.916009][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 190.926835][ T8850] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 190.953895][ T8855] 8021q: adding VLAN 0 to HW filter on device team0 [ 190.979715][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 190.989103][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 190.998174][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 191.005933][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 191.014642][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 191.024181][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 191.032733][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 191.042008][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 191.058775][ T8858] 8021q: adding VLAN 0 to HW filter on device bond0 [ 191.120126][ T8863] device hsr_slave_0 entered promiscuous mode [ 191.147106][ T8863] device hsr_slave_1 entered promiscuous mode [ 191.196916][ T8863] debugfs: Directory 'hsr0' with parent '/' already present! [ 191.234890][ T8858] 8021q: adding VLAN 0 to HW filter on device team0 [ 191.252061][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 191.261043][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 191.270184][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 191.279486][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 191.288689][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 191.297904][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 191.306635][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 191.314462][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 191.322584][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 191.331804][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 191.340425][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 191.347512][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 191.355173][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 191.363891][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 191.372130][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 191.380586][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 191.392901][ T8852] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 191.404904][ T8852] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 191.442396][ T3101] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 191.454909][ T3101] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 191.477779][ T3101] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready 22:50:34 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_ASSIGN_DEV_IRQ(0xffffffffffffffff, 0x4040ae70, &(0x7f0000000080)={0xefb}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000100)={'nlmon\t\x00\x7f\xed\xb1[\xe5\xa3\xcd\xb6\x00'}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @remote}, 0x10) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @ioapic={0x729d0213259a169e}}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000001c0)={[0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x4cb]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 191.506308][ T8855] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 191.517473][ T8855] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 191.562273][ T8879] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 191.566823][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 191.618724][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 191.619833][ T8879] kvm: pic: non byte read [ 191.627437][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 191.631961][ T8879] kvm: pic: non byte write [ 191.644682][ T8879] kvm: pic: level sensitive irq not supported [ 191.644798][ T8879] kvm: pic: non byte read [ 191.647358][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 191.651473][ T8879] kvm: pic: non byte write [ 191.655912][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 191.666494][ T8879] kvm: pic: level sensitive irq not supported [ 191.666587][ T8879] kvm: pic: non byte read [ 191.674442][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 191.676009][ T8879] kvm: pic: non byte write [ 191.682764][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 191.688113][ T8879] kvm: pic: level sensitive irq not supported [ 191.688206][ T8879] kvm: pic: non byte read [ 191.700430][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 191.708053][ T8879] kvm: pic: non byte write [ 191.718522][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 191.725527][ T8879] kvm: pic: level sensitive irq not supported [ 191.725618][ T8879] kvm: pic: non byte read [ 191.738148][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 191.744860][ T8879] kvm: pic: non byte write [ 191.748804][ T8860] bridge0: port 1(bridge_slave_0) entered blocking state [ 191.757146][ T8879] kvm: pic: level sensitive irq not supported [ 191.757239][ T8879] kvm: pic: non byte read [ 191.760837][ T8860] bridge0: port 1(bridge_slave_0) entered forwarding state [ 191.768385][ T8879] kvm: pic: non byte write [ 191.782009][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 191.798415][ T8879] kvm: pic: level sensitive irq not supported [ 191.798513][ T8879] kvm: pic: non byte read [ 191.804766][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 191.809822][ T8879] kvm: pic: non byte write [ 191.817541][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 191.822371][ T8879] kvm: pic: level sensitive irq not supported [ 191.822464][ T8879] kvm: pic: non byte read [ 191.839926][ T8879] kvm: pic: non byte write [ 191.844667][ T8879] kvm: pic: level sensitive irq not supported [ 191.844770][ T8879] kvm: pic: non byte read [ 191.858854][ T8852] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 191.862760][ T8879] kvm: pic: non byte write [ 191.870818][ T8879] kvm: pic: level sensitive irq not supported [ 191.870913][ T8879] kvm: pic: non byte read [ 191.882940][ T8879] kvm: pic: non byte write [ 191.883046][ T8879] kvm: pic: level sensitive irq not supported [ 191.895041][ T8879] kvm: pic: single mode not supported [ 191.930989][ T3101] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 191.939347][ T3101] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 191.947083][ T3101] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 191.956154][ T3101] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 191.965866][ T3101] bridge0: port 2(bridge_slave_1) entered blocking state [ 191.973016][ T3101] bridge0: port 2(bridge_slave_1) entered forwarding state [ 191.996543][ T3101] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 192.051922][ T8865] 8021q: adding VLAN 0 to HW filter on device bond0 [ 192.067017][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 192.076538][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 192.084710][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 192.093981][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready 22:50:35 executing program 0: socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000001c0)={'lo\x00\x00\x00\x00\x00\x00\xed\xff\xff\xff\xff\xff\xff\xff'}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'lo\x00\x00\x00\x00\x04\x00\x00\x00\x00\x06\x00', 0xfd}) [ 192.108552][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 192.143011][ T8855] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 192.167203][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 192.175073][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 192.193367][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 192.203395][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 192.211643][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 192.313504][ T8865] 8021q: adding VLAN 0 to HW filter on device team0 [ 192.341429][ T8858] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 192.386833][ T8858] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network 22:50:35 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f00000000c0)="0800b5055e0bcfe87b0071") r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b10") r1 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r1, &(0x7f0000000140)={0xa, 0x0, 0x0, @remote, 0x6}, 0x1c) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000006440)=ANY=[@ANYBLOB="b8000000190001000000000000000000ff010000000000000000000000000001ac1414bb00000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0], 0x2}}, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x31, &(0x7f00000000c0)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) 22:50:35 executing program 0: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$unix(0x1, 0x1, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000040)={'syz_tun\x00', {0x2, 0x0, @rand_addr=0x3}}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2c00000014000905000000000000000002000000", @ANYRES32=r2, @ANYBLOB="14000200ee8000000000000000009e4000aa0000"], 0x2c}}, 0x0) [ 192.585770][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 192.602865][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 192.627703][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 192.636141][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 192.677346][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 192.685891][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 192.707191][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 192.714294][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 192.728708][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 192.737443][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 192.745914][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 192.752998][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 192.760865][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready 22:50:35 executing program 2: socket$packet(0x11, 0x3, 0x300) r0 = socket$netlink(0x10, 0x3, 0x4) write(r0, &(0x7f0000000140)="2700000014000747030e0700120f0a0011000100f517363ba84f55dc0ce513b2f36f3a9aadfe17", 0x27) 22:50:35 executing program 1: creat(0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x42, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3, 0x3}, 0x22, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x20000004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x9, 0x200}) ioctl$BLKTRACESTART(r0, 0x1274, 0x0) ioctl$BLKTRACESTOP(r0, 0x1275, 0x0) pwrite64(r0, &(0x7f00000000c0)="18b57bf7e26f8e37b6fac1e3df9d9eae067f606855b03abe9b9614fac8f6a2679f1b7f42887e109c3b9b18041f43f7ca6243987657c2b506c87529c8d4aac620836821b6c4acfbfd1233ef5d28edc97d6be413e02dc1d41a022d79999df1b2186f11ab85d1cd07e58206785e7382a06a962dcec321108f7ab9a003701309c9efc32e849a930b872c92835156f70f8f854c5f7ff4", 0x94, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) memfd_create(&(0x7f00000001c0)='^\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) 22:50:36 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0300a1695e1dcfe87b1071") r1 = socket$inet(0xa, 0x801, 0x84) listen(r1, 0x83) dup2(r0, r1) [ 192.982850][ T8916] relay: one or more items not logged [item size (56) > sub-buffer size (9)] [ 192.992970][ T8904] netlink: 'syz-executor.0': attribute type 2 has an invalid length. [ 193.030548][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 193.040843][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 193.049603][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 193.059125][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 193.068786][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 193.077705][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 193.086263][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 193.096394][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 193.105052][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 193.113997][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 193.122584][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 193.131857][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 193.149329][ T8863] 8021q: adding VLAN 0 to HW filter on device bond0 [ 193.165215][ T8858] 8021q: adding VLAN 0 to HW filter on device batadv0 22:50:36 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000008c0)={0x14, 0x4, 0xa, 0x319}, 0x14}}, 0x0) [ 193.180221][ T8865] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 193.194857][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 193.210553][ T8929] relay: one or more items not logged [item size (56) > sub-buffer size (9)] [ 193.219828][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 193.231151][ T8926] netlink: 'syz-executor.0': attribute type 2 has an invalid length. [ 193.246259][ T8863] 8021q: adding VLAN 0 to HW filter on device team0 22:50:36 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000240)={0x6, 0x4, 0x4, 0x20000000000007, 0x0, 0xffffffffffffffff, 0x0, [], 0x0, 0xffffffffffffffff, 0x2}, 0x3c) [ 193.284314][ T3101] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 193.302394][ T3101] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 193.365424][ T8865] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 193.397341][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 193.411890][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 193.430263][ T8860] bridge0: port 1(bridge_slave_0) entered blocking state [ 193.437435][ T8860] bridge0: port 1(bridge_slave_0) entered forwarding state [ 193.459741][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 193.468657][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 193.477322][ T8860] bridge0: port 2(bridge_slave_1) entered blocking state [ 193.484464][ T8860] bridge0: port 2(bridge_slave_1) entered forwarding state [ 193.492753][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 193.504373][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 193.522150][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 193.530231][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 193.563235][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 193.572015][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 193.593188][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 193.617295][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 193.625262][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 193.634637][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 193.643844][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready 22:50:36 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r0, 0x0, 0x211, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @empty}, 0x10) sendmmsg(r0, &(0x7f0000008e40)=[{{0x0, 0x0, &(0x7f0000000b00)=[{&(0x7f00000002c0)="1fb166411634ea51a387c3fb52ea298928d99e2970d23d693df1bb79389b9db2732cb6ee9bc49085e0fd4a3c4cf849d5a3daf595439f1da48cbfc9099b49bf78e635139f4cd12d0704c52ec896916198356ed96553d76af90ec8e4704c83b3383a0816c6f1c5cc5a129d33695dd3807b7464f3a5bcedc8555e4421c6c19c24fe19048ec577d20f2c6909e6c44f2ef7d3639b", 0x92}, {&(0x7f0000000240)="2657147f1c9cfe13a801dce6b3bada02ce", 0x11}, {&(0x7f0000002340)="4347d4a7012f4b103a012cefdf922aae11282291fbe211581a3831ed2a20918922bc9f31e469bba1fb2792dffe3f60661b5097c312cf93c903b8e5db81063d2edf3738836e6f7a4999c52641a4c312d7b7437f48e371ad21d2023dedcc22a89428063840a0f8bc195aa830d976f95de59e44bad84ca1c827680856b6296f44ecf16f7a10d70dff56bc0083fb4e42ec736779b996bce101dde0562ae77028c413f73db3ae5dc04383fee0af467de834b62fd1f5272583b6ee1eb42630ffddbeb86f296fb305ab039c9772e6be646128a419b6909a814a30f09ec3dc9666d24089fd5369cea703c9f364f251f7a9db4690fe9dd3cee7dd6b4f67308e15580ef4037ec00bbcb8345eda7e643db4fc5d8389d08ed215671f81ba325ebfd61efb938533ee5e893a14d5974a77b2983614390dc9b7475bf73eee2b2ee6179e532cbfdaa5b24906b796a988209ef16ffd623cc183552191cea6856ad9c73123aa805bc679d7a6977e8cca0641fcac30292209c980772be2246cc39a0b3aad8da6bec8c0a9a90bd163861721a02576072ba48727796947b27a98f5981cf325ad32b233caa7c5fd846fee37a191d3c059ca316611d12572f8a0f0e0f4e93ff6e430cf8cbb7a2a23e051afac908c4725f96e691bb074e8620b51b81f3053860dab4ee94226ef560389e456ee0ae533077cb30b5fff5307eeb28d20eafe07043f2325b1df0cbfc73365308013da28cd846680511dbde8ee0c8f6ff16f67f144550381576f21bd3aeca596e393e5add71aac9e7359d8a6f9b0faad392dda260fef85a8637d42f38d067652cba28a7afff83ef668abdb76a3c6f208947d5c43faa1bff341e2800957fc23c119b7bf6b06b611b6d52e6def9c69a1798fe4e53e72ead750baab2c851fa9104cdf0dbfc19d1aabcc0625e410416d1da0f64f1ad98501f80e69d3665eb1ecb622f5e28e5d4335c9704589ea0d260ee0f51d0f09a3cfc08c7c73c58f18096512f15c093b9d1a186dde8eb42b0035036f811ad61598e2fe4f68b2550c1feef93918500fdc30d7815ced3b5da99fa8ecbf6be534cf61101b77a4781e573d06b64c73d1a3e8dfb74abc0b59680eddb4ef58e9e76e318f4ffd84433f0a8ce758a2123b728e06d9d803b965a9fb89d84dd46df0c6d331a9896e807fdefd572b10c858fe772c91cc78079860eff47cdfc65ced53be1a09bb0915504cea6b2a9c815f7e26676efcc081ae9d1d77cbb30edb6d644242d4e91d2bdcd50c495b615b4d26a4b64f272e5cf10b21eb89c874e3cd7ba04e3b0b3ca5d93c6ed78ce1cb975a4725b44a7f6fb9cbf5fe5a4b2a57bc8043ba5da75fbc568f66e049cb0b03c2b4bd8c6cc02351064fffe9ae863c450743ec897eb4f714754aa8be2ca74e5dd50b0666f6993b763a0fe92af4efdace7567a073d20ee82ccf5684b30e2105046f9d2d5caea286c6a2226ae5a90b89f07caffe573c54c68d27d59b7b8b9815e239019441089577fa79b5486bed5fef7e754963f3ca5aa3e18ce78351a3a8cfebdfdcd7b9c4ded1b965b005218bdede505f1ac35678e87534950c9b2c4a40fcb344132c8d6d669943d6406f95a26aa75319a811cf6f95ce604016852ff48c9888edfb800447d62881c138d87b486622025b0c48d4dde4294e3e4c76b48569ccbb02e943ce6cf0c5853b9e1733d68368576e5d4d4fb931a6c2695a8be8403ccb33aeb8a404d41467cbc20da01cb57739fba02b55371c51a562c4f1264fa45ab2c265b05338698c73b9b290f675c5528c5f9f4229a75d45b315fc3c07f893c7563880621dc269b59d466f051ff4f8980c132b7d7e2279beac2a9563aee7586e9aa1f9e2c2efb3458f63a740437a0940c315183d71165bdfaa10dc7704b11e436b0e6d6e837b43da37d4b80e43718d00526f94cc9c439ef8ad33ca8128aa99aa361c56166737271bd055ebe0c9a785b24fda68336c1574dc982893d4c4b3d5adf68eabbbba4c41fe9ca73843cfead9f01571d6c26870cb1a08d20a2fb8585a45bd4d122464464b0a76f6c645e5d7a479e5ac825ed7968d87fa818f50ef641d42ae05d9cedb74b6282d674318f8a8600bf0d90f1c1ce647a8fe85f79fe2ad6610d99548c6cf0c87437f0253d01212d96cce968fe151a27474c81992effecd01a61d23bae667ddf1ddb46de0f13b6243be1f12b9c31d7b6ac971f3d5d6e569c0049ccec7e80aebe29d10b37a944d5d6e95b4a1e5e66b40a4ab5a05ae4ffe6f21589e99211ea467af9755e51fc6a2f8a0f912e1760de2568a2c06072a3cc152929204c10dc1284ae624be50553467d1b5239ab2cc556da38beea8f82b865b553f9a9589dbfd7574aaebd611dddb40b112c42c6cd80faf85a6e5df298fbc957393a9dbf54dad7b2d4f9cd46d821051443739961c68d57adc2fc13e0c0361712f17a12d2abfaeeb45fd26cad1c1fee691cec596c7adea9d4b0985896e7dc948ed34f993ddd48f2064bd6f2ac0bdd01a2a13881235a1919aadf0b191be4eca85977ba628d17fd3afbd933afa03b7aa22d5516afe8b800736210f979f1ec76bda7b9f0ef2ceca5dc7f28fd195340076f29be1f9ff3cf91d20263c87ffd4a5a1e4f1b720581a52391fd5cd17640d95a4c4c4c1adb73ddb4ac602ac63ac522127be35c0f632924494d04c0c2773750c4a31baeb9ea62f3f8be3a209934f54b4041cbf4050c594948e4521e91a5150386e01649503b0adc64d14d05354fbb389e28c5ff47ed399db5b8bf35fddb99837d22e2273e5196fc1e9f11925fdd09eeeabbaebee6d55ec33d00ca2f700162aeccc09f7e2677b955e2cc36021964f5da685b2bb3fc55441826836df49a62dc1b24cb322dd496a69a03d00eb7ec54135ef75287470d0d6255905d7e5b766a7580333a129116152aa30576a3c458ebb8954a60f4017ff6fd85a5c7bed493dfee337c0133a878fe801eae7440e9b8d568cd3e22359acbb8e4803c829a76abc8953a5b7b3bd5e86b7e8fca3db934a9530f7fc9472c66bdfd172234328b7df61d08c435c8a01f3df09eb55610f3a157d1a494bf2b3f2bf876c6d184977c53f1946c9e901628a55f5f1ab7b00cfe9cc442000a037dd22bd339dd1cc6bb4c367a9391b7a2bda2d58066049a7beb1151f65e5e3d5f924c0b578a62630ea34d73ee44d25d2557d700e891f2142a0739790a0f841b04821499277f05792d3a06d4bf8a72d39e737c57f6b322c5132eeddc429d0bc7e48bf47cbb93fb8171b6a4f885333c44541ba5fad06ed3ffad3e107a6f673abba7563b8ca3e8b12581c9d6763105f7d883b38de05adc71dc3f7a88572d2ac7cac7fae48331a6dbd910b4b017ec54d135ded0d36e2bff02fd99d751a58fc7ad81d2a4f2e63865737bbab616fcd4599e8a21f69c3316a6b52795a65384f7f7f98f81dd82910e5add3491d549e0cabb21bbf3e8d95ecbec4668a3970b34d3feeeb6acdf31aabae1044e49ad59c013151b6a465fc9fd07570791c926d602713fb5b4339609b248a99a4dd780abd3c93dbf12d07b30f5f5ba8e6b2148c3d6a8d38012aef15bec0d41eb4af88c15db2e2f131afb2acb64d4325b7a4a6a3f4c146ac310fc6462b4353040d87dc254dbb7dc2088eac6b332ce42900a10835904c58f1226f002ca9cc03f3200f0776d907bd205f77c36c452046d3e93e1b7cbefeb36d06023af677a459ef4a86fad7f22c9f945fc860a18c929e840dfa91f7cac6c0fa3d8986627d07b8e44935b1832d8100547d0bbf53618fb630878e25e8a6fd89ceee8fb15f81c3a142c5aef548af764e63b7590c585fb9f8e798bb8d2cef2c623785fee2973a507a07c72fb4e0db70d79293a31d8b51a062960ce7c02d203131284e4a162b677ea2e794bc45494cc1f8a03fb7cd3a547a2d76ee06edb2203b57dc27e3e1f97297ccc9c13029d9cc56b15722038c796bb4b27f99b47e718ea1d2e291688dd46ae9ea14f122586a0b9efb61265ceaf49f32a49caccc39f245b3a0619701b36d21acd30b5aebd6e074759a7ec478ed703b32ec2435c1839e067900fed1a7980cfebd109e66bddf89c7b7a5e0a7ed3aff76e3d685407c74d79b1cfc5c13a788a86d45d1569c2865e17f1dfa84407f44e51084f4f8df1d16b82a24f4ab0ef36f781e9f1bc889a32b8d4cb65c065729c890652e8abe05bd577aba8222ca103607548c7a27b578a3078fabb47a7695730b1879f941aae065a5cf39d7eaafb0bdf34befd8f89952b8482ffb65cb1acb6db4da5dd1e9f460ee227d99cc4190995c8ff74b3a2801bf0c5a8cbecbee739b657177e5315c3254faa0dd270b459cc1eff6a7241ac4f664348a1b72bff28886f6642ca5df5a6331838fb9911f9a56a45fbd85182acb497a24d7f72fd88e928f9eb5c3cd7d54b9bd6e78134a01ae9ca8b38dab311051a0d4bd82e051e86b31ad83544e5941e2c7430c60d44b0e63d7ef6e336543c9e7e40d1da1c29319de04eac013bcd4526ed2f8a55ef62ed80e1cf440abedb213771507e693efbfe7445422d25fb49865730407a420ea8bff246309911f4034be1dd445ff9449a65a17819371d893e72afe34b00a9bd1566baeb8001bd6891f32dd8be091e8d2503a2b68bb6f1154dba508802877a0ef2c8433b9a97dcd359dfe14afa25536d1f3e82ff8e9a5b5efb14321c0bd4d394ab8210374717efdabc76038236209db7b4dfe9ed840de7b474787b0d1de2461aa4ca4e841d39d22ccab47c6ee2076cddc7b89bfd90e729a110046a0ba5067d6f73387b4b5767197285a994615eae748446afb59d09f352cf95fe390eb55532f118123cafc9a3b58be384356d3e99c766c72466f8a33d962d398e76694b0470fe675347b75069e2d3468a85dc8bdce85d26bc956d294e1b1e6209f38add68a849a69c0e516fcbbde5e72a803d9c1e72ee7a231dfcc50439196230a445e50b9d73065a2b62a291c1946d8b8819b5d16eb1bef50f0ef374401e60d142abca8f64a12f645e53a5b2ae72ff4f66e91245304eda6898b8be2710d326427bd1a6df9d0f15415b23f2ff0fa4169d8f89964c4dde4fe339798e87d9677a4090b198907d8145337ad4f96332a6a1f4021028927545c0f17beb4af88777f9e953b27dd42f366a8bc1a58369e69e54c284760c6abf495c321fa501be7e87d59b7cc9b108ac46f50af981abf95dc511324daf41fe06ea2d074ac51f3ff68fe9e92a688567955088b0d9d14eaf15f7bfd6331e1b8873f3ebe04c60a13bb61fbb1bd621b3736e2cfd41965ff86228de3f771400c6b596ad682d5f19399510a37a0547046e622bb79f50608cf3a84a9d45f0aef527bf27b6a4a43a7a1eb3cd8ed98478b7a40bb0c1af3fe6ce530e331b3fa852932a23ce609fa3b9a080cbbde7f9567fb7636443e90eccaec941d01b142f182fc02190143764c6b9746b00884e16c680ca9a3ff963450adec98b3be07b6aa8294ebaa71d9294f7fa068bfa788061028c0497a2a1680e143d067317dbd147eb245de7d1414e74fd7b504feeb8d1a296de805ae00f5acb6c6966cce1993b0dd92da2ea4eb06126eee88d8f93bdd24d9c4f5b819818abb46b9b680ee16cc13456480c6fe2456d0924ae6ab8685035fc19e1e81498f7f72c573ba3c7babe3bc95f7d34c027f7a4dcb2de90534b31becc6875d95609a6aecfa4dd28ccef210437bf72759e25d8e2ebf65903ca99d5742bcc69fa0998bd8f19fc5b9ad3f18704196f6104949", 0xfe0}, {&(0x7f00000004c0)="c1cc963dd8ae97d44c35e14dbcf132a8190396c162c94e5c9aee0369bf8f1a8584419c23ddb4a515cbd43f3ce2f484d06f34b9fb93a7d77cfc7ebae59d7f17bc096cceb3d93faf223c3bccb2d84d0668fd0217e4f5f82df6f222064cc98ce4f3e04e5f7ee9659038b9e9ab64367d00594a1c3e1e0c24a5fd64fac77fdf6dde9ad3056d650865966aa9818b5d09f28bfe8dada31c49f06b4f8709ffe52c3d244294c0c3d52463283c736192e3d6c7eecafd6347a99a10042f10a17b7c76ce3d3b61a69ec58b36f0aed5217f7ed338661a3b5d7a7b2d081855a6eea75728d8c997", 0xe0}, {&(0x7f0000000640)="cd69a11422fef812477f2c9561914849572254c5c1c3933f9d5a27fe5925bb72ebe7ce22baa598df27e019de21e7ca9bd1c18283f7df3c875d3f375c7decc1a581fd3bb7e7a425684425cba90d83f126cd060f689f9af506e179c8fe7f0c093dc6b671276ce4f8f5f129dc0f0487f601ebb48b81a1a5383ee6b41bc452d39448c8ec79da995effcbaa4c5fc035a1cce7133cf01c3aba4dd455d60fa64fd8ea85fdc6942ab525254341aaf6eebfdea36d9ee2c67a141dee6009721ddadad642b1a108d70b94bc70", 0xc7}], 0x5, &(0x7f0000000bc0)=[{0xd8, 0x10d, 0x1, "d32d9de4181e1715739f95f39f8af626c9326d81a0a0be8d38cd000fd6fee37c8a8b6895ec7a7e8b7a91bbcae5673253dfddf02df87f52556f466c683dcb2e5a5a3c63d722c4edfcd6960a944894def8b404f36869e95c011e3b02471762509d71386af739bade9fc9971dad16b6927170854736f4628ce3847611017fa97548acd7df80a7f964bda39165fa91a06612e1d59f4efcba8cb91ed7f4bf640f3d266b13649ad6a41969ed8f09a3141db94c23f837702601d7588b7b23d898976bae17"}, {0x20, 0x112, 0x0, "230dd4731ae1190ef0"}, {0xa8, 0x119, 0x5, "cb97d4ff19a86d251673e1a12d7ff15f240537f767f89fb28a2e0de8ca46d13606d4fe3b879d978d29c9c5927f6e6fb2232cb4f680b817110aff66688dca4cfbdf07da1e708fa4a27bded003033cb344dfb928c05398bfc04449941ab5094b8afe2d68f6f2dfd753f8c0698a1f904e2f34a0b4137a37c3ee4c0c631dbcc8775134eadf9a3b6d9d2e003addb3a42582ad9f2f"}, {0x100, 0xc, 0xfffffffb, "e735fdfcaf419f9bbb48de629b1aaab865fb9176f6ee512904feed8221fba91b7685342c5076f9fbf2bc416b317f88ed4312bd118baf51d9ec6313a4a3b25e4418961d18ce8104f91d60a46677bc4dd6bd3df06515dfdca103110fc349efe2ded501d434dbdab0b6355bc85869951925fdb73c900a0274dfe6aa76ec16262201d3c1cc83c4e7e29e40beb361ced8a561d4dacd711a9e690d101445cb77400a7551f8f46d9361085b2e99b702b736fa733f8da63f2c72c426f863235889359162461d2fe452cc9e5d2943b700ec55310dd86c8ba51973367637e452225dd285cd32924c368ee10002a8"}, {0x110, 0x119, 0x8, "d6fb014ab3b288a20d3908c40b6542a090a003eb8b65642cfa0863ce87693a8a6c421caadc67eaa2389efff1cc7d53f8670c008399bee3f7a18615631305d387526853be115e425ab2a39c77c1a722b287a9a85d678f7ed58329eae953a6a47aa28edf8284a392a8503d563cf5d021fa94f77bd96e416a23f099e93ddf9861baf20bd09914c57381336cce2ff0c91621291f13a689fd9ff69ae44d974903ab1957ffe8bf7a36ab6ccb0b2a7bff9ac84c0b59a50873301de9b8e5595919669c0ca8c50cb87146632b83998b35131badb2bcb30e14f1a5eac3475ec02cf95ae5cfba135fb468a3fb79bdd4eb91b8ab6ffab46edf06b5e4a696764e12"}], 0x3b0}}, {{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000001000)='a', 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000003cc0)=[{&(0x7f0000001180)="b0", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f00000042c0)=[{&(0x7f0000001280)="f2", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000005e40)=[{&(0x7f0000005840)="1c", 0x1}], 0x1}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f00000076c0)=[{0x10, 0x1}], 0x10}}], 0x6, 0x52) [ 193.667738][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 193.678091][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 193.686560][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 193.697508][ T8863] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 193.754448][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 193.782610][ T8860] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 193.835151][ T8863] 8021q: adding VLAN 0 to HW filter on device batadv0 22:50:37 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) 22:50:37 executing program 0: ioctl(0xffffffffffffffff, 0x0, &(0x7f00000000c0)="0800b5055e0bcfe87b0071") r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b10") r1 = socket$inet(0x2, 0x2000000000003, 0x2) setsockopt$inet_int(r1, 0x1f00000000000000, 0xd2, &(0x7f0000000000), 0x3c) socket$inet(0x2, 0x3, 0x2) socket$netlink(0x10, 0x3, 0x0) 22:50:37 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000500)={0x14, 0x4, 0x1, 0x319}, 0x14}}, 0x0) 22:50:37 executing program 2: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpu.stat\x00\xb80xffffffffffffffff}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r1, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) 22:50:37 executing program 5: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x0, 0x0) r1 = gettid() r2 = gettid() kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, r0, &(0x7f00000002c0)) 22:50:37 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000003740)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0xc, 0x2, [@IFLA_BOND_ARP_IP_TARGET={0x8, 0x9, [@rand_addr]}]}}}]}, 0x3c}}, 0x0) 22:50:37 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000005c0)=ANY=[@ANYBLOB="140000000108190300"/20], 0x14}}, 0x0) [ 194.150459][ T8968] relay: one or more items not logged [item size (56) > sub-buffer size (9)] 22:50:37 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000003740)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0xc, 0x2, [@IFLA_BOND_ARP_IP_TARGET={0x8, 0x13, [@rand_addr=0x2]}]}}}]}, 0x3c}}, 0x0) 22:50:37 executing program 4: 22:50:37 executing program 3: 22:50:37 executing program 4: 22:50:37 executing program 5: 22:50:37 executing program 2: 22:50:37 executing program 1: 22:50:37 executing program 3: 22:50:37 executing program 1: 22:50:37 executing program 5: 22:50:37 executing program 5: 22:50:37 executing program 2: 22:50:37 executing program 0: 22:50:37 executing program 3: 22:50:37 executing program 4: 22:50:37 executing program 1: 22:50:37 executing program 2: 22:50:37 executing program 0: 22:50:37 executing program 5: 22:50:38 executing program 4: 22:50:38 executing program 3: 22:50:38 executing program 1: 22:50:38 executing program 2: 22:50:38 executing program 0: 22:50:38 executing program 5: 22:50:38 executing program 3: 22:50:38 executing program 4: 22:50:38 executing program 1: 22:50:38 executing program 5: 22:50:38 executing program 2: 22:50:38 executing program 0: 22:50:38 executing program 1: 22:50:38 executing program 5: 22:50:38 executing program 3: 22:50:38 executing program 4: 22:50:38 executing program 2: 22:50:38 executing program 0: 22:50:38 executing program 1: 22:50:38 executing program 3: 22:50:38 executing program 5: 22:50:38 executing program 4: 22:50:38 executing program 0: 22:50:38 executing program 2: 22:50:38 executing program 5: 22:50:38 executing program 1: 22:50:38 executing program 3: 22:50:39 executing program 4: 22:50:39 executing program 0: 22:50:39 executing program 2: 22:50:39 executing program 1: 22:50:39 executing program 5: 22:50:39 executing program 3: 22:50:39 executing program 4: 22:50:39 executing program 0: 22:50:39 executing program 2: 22:50:39 executing program 1: 22:50:39 executing program 4: 22:50:39 executing program 5: 22:50:39 executing program 0: 22:50:39 executing program 2: 22:50:39 executing program 3: 22:50:39 executing program 1: 22:50:39 executing program 4: 22:50:39 executing program 5: 22:50:39 executing program 0: 22:50:39 executing program 2: 22:50:39 executing program 3: 22:50:39 executing program 1: 22:50:39 executing program 4: 22:50:39 executing program 5: 22:50:39 executing program 0: 22:50:39 executing program 2: 22:50:39 executing program 4: 22:50:39 executing program 1: 22:50:39 executing program 5: 22:50:39 executing program 3: 22:50:40 executing program 0: 22:50:40 executing program 2: 22:50:40 executing program 3: 22:50:40 executing program 4: 22:50:40 executing program 5: 22:50:40 executing program 1: 22:50:40 executing program 0: 22:50:40 executing program 2: 22:50:40 executing program 3: 22:50:40 executing program 4: 22:50:40 executing program 5: 22:50:40 executing program 1: 22:50:40 executing program 0: 22:50:40 executing program 2: 22:50:40 executing program 3: 22:50:40 executing program 4: 22:50:40 executing program 5: 22:50:40 executing program 2: 22:50:40 executing program 0: 22:50:40 executing program 1: 22:50:40 executing program 3: 22:50:40 executing program 4: 22:50:40 executing program 5: 22:50:40 executing program 2: 22:50:40 executing program 0: 22:50:40 executing program 1: 22:50:40 executing program 3: 22:50:41 executing program 4: 22:50:41 executing program 5: 22:50:41 executing program 0: 22:50:41 executing program 3: 22:50:41 executing program 2: 22:50:41 executing program 1: 22:50:41 executing program 4: 22:50:41 executing program 2: 22:50:41 executing program 3: 22:50:41 executing program 5: 22:50:41 executing program 1: 22:50:41 executing program 0: 22:50:41 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) getsockopt$llc_int(r0, 0x10c, 0x0, &(0x7f0000000000), &(0x7f0000000040)=0x4) 22:50:41 executing program 4: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') sendfile(r2, r3, 0x0, 0x50000000000443) 22:50:41 executing program 1: 22:50:41 executing program 0: 22:50:41 executing program 5: 22:50:41 executing program 2: 22:50:41 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6ead74ed8a60ab563e98b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621d6234555c08dc540473786cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b59c41705b96a6711d4679079d00"/137], 0x15) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = dup(r1) write$FUSE_BMAP(r3, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r3, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) 22:50:41 executing program 1: setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000440)={@in6={{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x0, 0x0, "ba7e305b22384b108388d9c36c33d1aac65804755ca97d0cd1b2412971046b90ce1ebd5e0d73b3bc146917d762360009e2ba8f50a5e71990db0af1cb609cfcf83cb080729bcdeffbe600f9937223e174"}, 0xd8) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000340)={@in6={{0xa, 0x0, 0x0, @remote}}, 0x0, 0x0, 0x0, "aee3e02177a8b390566bc2dd09f1a3762d791ee4f4b438301ef0512cdb0500608905a2b845dc84fb52db92b78b7765b975935988dc185e581f893ac2396270f993a39d4502f90359bd12e421e02d30ee"}, 0xd8) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x7ff}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x800000000001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000000), 0x200) ftruncate(r0, 0x800799c) mmap(&(0x7f0000200000/0x400000)=nil, 0x400000, 0x1, 0x2011, r0, 0x0) 22:50:41 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0x80000000b9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r1 = getpid() openat$zero(0xffffffffffffff9c, &(0x7f0000000140)='/dev/zero\x00', 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0}, 0x0) fsetxattr$security_selinux(0xffffffffffffffff, &(0x7f00000000c0)='security.selinux\x00', 0x0, 0x0, 0x0) tkill(r1, 0x9) r2 = socket$packet(0x11, 0x3, 0x300) open_by_handle_at(0xffffffffffffffff, 0x0, 0x0) r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff) inotify_add_watch(r3, 0x0, 0x91000430) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x8) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f000095bffc)={0x0, 0x0, 0xfffffffffffffffc}, 0x4) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x1d7) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002011400010000000000", @ANYRES32=0x0, @ANYBLOB="000000a800c76f4503775e3a23a7073abc7e54d66704d2654729"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=@ipv4_newaddr={0x20, 0x14, 0x401, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, r8}, [@IFA_LOCAL={0x8, 0x2, @broadcast}]}, 0x20}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=@ipv4_newaddr={0x20, 0x11, 0x401, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, r8}, [@IFA_LOCAL={0x8}]}, 0x20}}, 0x0) r9 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r10) setsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000180)={{{@in=@multicast2, @in=@loopback, 0x4e22, 0x8000, 0x4e23, 0x8, 0x2, 0xb0, 0x20, 0x51, r8, r10}, {0x7, 0x18b, 0xff, 0x0, 0x0, 0x7ff, 0x51c, 0x200}, {0x8000, 0x0, 0x0, 0xf668}, 0x80000001, 0x6e6bb2, 0x1, 0x0, 0x3, 0x3}, {{@in=@empty, 0x4d3, 0x33}, 0x0, @in6=@empty, 0x3501, 0x7, 0x2, 0x5, 0x8000, 0x72, 0x213}}, 0xe8) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000100)={0x28, 0x0, 0x2711, @hyper}, 0x10) r11 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(0xffffffffffffffff, r11, 0x0, 0xedc0) 22:50:41 executing program 0: r0 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000280)='/dev/video35\x00', 0x2, 0x0) syz_emit_ethernet(0x1, &(0x7f0000000340)=ANY=[@ANYBLOB="aaaa223c35c8d1ba02ef71"], 0x0) gettid() sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000000100)={0x0, 0xffffffff, 0x2, {0x2, @sliced={0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20]}}}) ioctl$VIDIOC_CREATE_BUFS(r0, 0xc058565d, &(0x7f0000000300)={0x0, 0x2, 0x0, {0x0, @pix={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20000000}}}) 22:50:41 executing program 2: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) listen(r0, 0x0) 22:50:41 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6ead74ed8a60ab563e98b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621d6234555c08dc540473786cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b59c41705b96a6711d4679079d00"/137], 0x15) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = dup(r1) write$FUSE_BMAP(r3, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r3, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) [ 198.815547][ C0] hrtimer: interrupt took 63574 ns 22:50:41 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() r1 = socket(0xa, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000000c0)=@nat={'nat\x00', 0x19, 0x2, 0x163, [0x20000280, 0x0, 0x0, 0x200002b0, 0x200002e0], 0x11, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000010100000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000030000000000000000007663616e30000000000000000000000062726964676530000000000000000000736974300000000000000000000000007465616d300000000000000000000000aaaaaaaaaaaa000000000000aaaaaaeaaabb0000000000000000d8010000d801000010020000636f6d6d656e7400000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000003f00"/355]}, 0x1db) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1a) wait4(0x0, 0x0, 0x0, 0x0) 22:50:42 executing program 4: setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000340)={@in6={{0xa, 0x0, 0x0, @remote}}, 0x0, 0x0, 0x0, "aee3e02177a8b390566bc2dd09f1a3762d791ee4f4b438301ef0512cdb0500608905a2b845dc84fb52db92b78b7765b975935988dc185e581f893ac2396270f993a39d4502f90359bd12e421e02d30ee"}, 0xd8) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x7ff}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) close(0xffffffffffffffff) setsockopt$inet6_tcp_int(r0, 0x6, 0x17, 0x0, 0x0) creat(0x0, 0x0) creat(0x0, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0xc9000, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) wait4(0x0, 0x0, 0x0, 0x0) tkill(0x0, 0x1f) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @loopback}, 0x10) sendfile(r2, r1, 0x0, 0x7ffff000) 22:50:42 executing program 0: setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000340)={@in6={{0xa, 0x0, 0x0, @remote}}, 0x0, 0x0, 0x0, "aee3e02177a8b390566bc2dd09f1a3762d791ee4f4b438301ef0512cdb0500608905a2b845dc84fb52db92b78b7765b975935988dc185e581f893ac2396270f993a39d4502f90359bd12e421e02d30ee"}, 0xd8) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x7ff}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000000), 0x200) ftruncate(r0, 0x800799c) mmap(&(0x7f0000200000/0x400000)=nil, 0x400000, 0x1, 0x2011, r0, 0x0) 22:50:42 executing program 2: setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000440)={@in6={{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x0, 0x0, "ba7e305b22384b108388d9c36c33d1aac65804755ca97d0cd1b2412971046b90ce1ebd5e0d73b3bc146917d762360009e2ba8f50a5e71990db0af1cb609cfcf83cb080729bcdeffbe600f9937223e174"}, 0xd8) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000340)={@in6={{0xa, 0x0, 0x0, @remote}}, 0x0, 0x0, 0x0, "aee3e02177a8b390566bc2dd09f1a3762d791ee4f4b438301ef0512cdb0500608905a2b845dc84fb52db92b78b7765b975935988dc185e581f893ac2396270f993a39d4502f90359bd12e421e02d30ee"}, 0xd8) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x7ff}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000000), 0x200) ftruncate(r0, 0x800799c) mmap(&(0x7f0000200000/0x400000)=nil, 0x400000, 0x1, 0x2011, r0, 0x0) 22:50:42 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6ead74ed8a60ab563e98b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621d6234555c08dc540473786cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b59c41705b96a6711d4679079d00"/137], 0x15) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = dup(r1) write$FUSE_BMAP(r3, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r3, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) 22:50:42 executing program 5: setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000000), 0x200) ftruncate(r0, 0x800799c) mmap(&(0x7f0000200000/0x400000)=nil, 0x400000, 0x1, 0x2011, r0, 0x0) 22:50:42 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0x80000000b9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r1 = getpid() openat$zero(0xffffffffffffff9c, &(0x7f0000000140)='/dev/zero\x00', 0x408200, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0}, 0x0) fsetxattr$security_selinux(0xffffffffffffffff, &(0x7f00000000c0)='security.selinux\x00', 0x0, 0x0, 0x0) tkill(r1, 0x9) open_by_handle_at(0xffffffffffffffff, 0x0, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x8) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f000095bffc)={0x0, 0x0, 0xfffffffffffffffc}, 0x4) connect$inet6(r0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x1d7) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r7, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002011400010000000000", @ANYRES32=0x0, @ANYBLOB="000000a800c76f4503775e3a23a7073abc7e54d66704d2654729"], 0x48}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=@ipv4_newaddr={0x20, 0x14, 0x401, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, r7}, [@IFA_LOCAL={0x8, 0x2, @broadcast}]}, 0x20}}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2000000014000104000000000700000002000000", @ANYRES32=r7, @ANYBLOB="0800020000000006"], 0x20}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=@ipv4_newaddr={0x20, 0x11, 0x401, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, r7}, [@IFA_LOCAL={0x8}]}, 0x20}}, 0x0) r8 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r9) setsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000180)={{{@in=@multicast2, @in=@loopback, 0x4e22, 0x8000, 0x4e23, 0x8, 0x2, 0xb0, 0x20, 0x51, r7, r9}, {0x7, 0x18b, 0xff, 0x0, 0x969, 0x7ff, 0x51c, 0x200}, {0x8000, 0x8000, 0xffffffffffff7fff, 0xf668}, 0x80000001, 0x6e6bb2, 0x1, 0x5171dc18361c6e3f, 0x3, 0x3}, {{@in=@empty, 0x4d3, 0x33}, 0xa, @in6=@empty, 0x3501, 0x7, 0x2, 0x5, 0x8000, 0x72, 0x213}}, 0xe8) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000100)={0x28, 0x0, 0x2711, @hyper}, 0x10) r10 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r0, r10, 0x0, 0xedc0) 22:50:42 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6ead74ed8a60ab563e98b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621d6234555c08dc540473786cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b59c41705b96a6711d4679079d00"/137], 0x15) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = dup(r1) write$FUSE_BMAP(r3, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r3, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) 22:50:42 executing program 0: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) socket$inet(0x2, 0x3, 0x29) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000001440)={0x0, 0x0, 0xfffffffffffffffe}, 0x4) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = fcntl$dupfd(r4, 0x0, r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) splice(r0, 0x0, r2, 0x0, 0x90005, 0x0) 22:50:42 executing program 2: syz_emit_ethernet(0x0, 0x0, 0x0) symlink(0x0, 0x0) rmdir(&(0x7f0000000140)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x9}}]}}) rt_sigsuspend(&(0x7f0000000340)={0x1}, 0x8) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x3, 0x0, 0x100000000) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, r2, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<'}}, {@uid_lt={'uid<', r2}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0x8c, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e23}}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x0, 0x0}}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x0, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0x8c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) getpeername$inet6(r3, 0x0, 0x0) socket(0x3, 0x803, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000003c0)) 22:50:42 executing program 5: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x2812, r0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$SG_GET_PACK_ID(0xffffffffffffffff, 0x227c, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @loopback}, 0x10) sendfile(r2, r1, 0x0, 0x7ffff000) [ 199.788894][ T26] kauditd_printk_skb: 3 callbacks suppressed [ 199.788909][ T26] audit: type=1804 audit(1572907842.878:31): pid=9303 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir711172776/syzkaller.oNJTOV/26/bus" dev="sda1" ino=16584 res=1 [ 199.797043][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 199.825186][ C1] protocol 88fb is buggy, dev hsr_slave_1 22:50:43 executing program 4: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x0, 0xc) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x2812, r0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @loopback}, 0x10) sendfile(r2, r1, 0x0, 0x7ffff000) 22:50:43 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6ead74ed8a60ab563e98b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621d6234555c08dc540473786cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b59c41705b96a6711d4679079d00"/137], 0x15) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup(r0) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) [ 200.116847][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 200.122735][ C1] protocol 88fb is buggy, dev hsr_slave_1 22:50:43 executing program 1: setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000440)={@in6={{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x0, 0x0, "ba7e305b22384b108388d9c36c33d1aac65804755ca97d0cd1b2412971046b90ce1ebd5e0d73b3bc146917d762360009e2ba8f50a5e71990db0af1cb609cfcf83cb080729bcdeffbe600f9937223e174"}, 0xd8) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x7ff}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000000), 0x200) ftruncate(r0, 0x800799c) mmap(&(0x7f0000200000/0x400000)=nil, 0x400000, 0x1, 0x2011, r0, 0x0) [ 200.192521][ T26] audit: type=1804 audit(1572907843.278:32): pid=9314 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir738920326/syzkaller.i3vXuI/23/bus" dev="sda1" ino=16589 res=1 22:50:43 executing program 1: setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000440)={@in6={{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x0, 0x0, "ba7e305b22384b108388d9c36c33d1aac65804755ca97d0cd1b2412971046b90ce1ebd5e0d73b3bc146917d762360009e2ba8f50a5e71990db0af1cb609cfcf83cb080729bcdeffbe600f9937223e174"}, 0xd8) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000340)={@in6={{0xa, 0x0, 0x0, @remote}}, 0x0, 0x0, 0x0, "aee3e02177a8b390566bc2dd09f1a3762d791ee4f4b438301ef0512cdb0500608905a2b845dc84fb52db92b78b7765b975935988dc185e581f893ac2396270f993a39d4502f90359bd12e421e02d30ee"}, 0xd8) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x7ff}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000000), 0x200) ftruncate(r0, 0x800799c) mmap(&(0x7f0000200000/0x400000)=nil, 0x400000, 0x1, 0x2011, r0, 0x0) [ 200.356818][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 200.362674][ C0] protocol 88fb is buggy, dev hsr_slave_1 22:50:43 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6ead74ed8a60ab563e98b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621d6234555c08dc540473786cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b59c41705b96a6711d4679079d00"/137], 0x15) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup(r0) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) 22:50:43 executing program 0: socket$packet(0x11, 0x0, 0x300) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_LOOKUP_ELEM(0x4, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_open_pts(0xffffffffffffffff, 0x18080) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="060000000000080029a458891b0f018f54d2dd880ac9"], 0x0, 0x16}, 0x20) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x1f004}) ioctl$KVM_RUN(r2, 0xae80, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) chroot(0x0) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000080), 0x4) socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) 22:50:43 executing program 1: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000380)=ANY=[], 0x84f0) r2 = socket(0x11, 0x800000003, 0x0) mmap(&(0x7f00004c0000/0x3000)=nil, 0x3000, 0x0, 0x12, r2, 0x0) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r1, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) 22:50:43 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6ead74ed8a60ab563e98b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621d6234555c08dc540473786cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b59c41705b96a6711d4679079d00"/137], 0x15) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup(r0) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) [ 200.991533][ T26] audit: type=1804 audit(1572907844.078:33): pid=9318 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir738920326/syzkaller.i3vXuI/23/bus" dev="sda1" ino=16589 res=1 22:50:44 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6ead74ed8a60ab563e98b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621d6234555c08dc540473786cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b59c41705b96a6711d4679079d00"/137], 0x15) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = dup(r1) write$FUSE_BMAP(r3, &(0x7f0000000100)={0x18}, 0x18) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) 22:50:44 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r0, 0x0, 0x2a80, 0x0, 0x0, 0x800e00506) recvfrom$inet(r0, 0x0, 0x1789836bed901fc7, 0x0, 0x0, 0x800e0050e) shutdown(r0, 0x0) [ 201.140835][ T26] audit: type=1804 audit(1572907844.178:34): pid=9314 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir738920326/syzkaller.i3vXuI/23/bus" dev="sda1" ino=16589 res=1 22:50:44 executing program 0: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@link_local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @broadcast=0xe0000001}, @udp={0x2, 0x4e20, 0x8}}}}}, 0x0) 22:50:44 executing program 5: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x2812, r0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$SG_GET_PACK_ID(0xffffffffffffffff, 0x227c, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @loopback}, 0x10) sendfile(r2, r1, 0x0, 0x7ffff000) [ 201.612116][ T26] audit: type=1804 audit(1572907844.698:35): pid=9366 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir711172776/syzkaller.oNJTOV/27/bus" dev="sda1" ino=16562 res=1 22:50:45 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x40) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000040)="5500000018007fafb72d1cb2a4a280930206000000a843096c26234d2500080008010000000000000000a3c728f19a2a5b3cda484408f55ce8127615c4d3f4e4a3395aa3b20c68be42496b7b381160bf0c121bc022", 0x55}], 0x1}, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) r3 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0x552, 0x200) ioctl$RTC_WKALM_RD(r3, 0x80287010, &(0x7f00000000c0)) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000002c0)='lp\x00', 0x2ca) recvfrom$inet6(r1, &(0x7f0000001840)=""/31, 0x5b405ce3, 0x100, &(0x7f0000001880)={0xa, 0x0, 0x0, @rand_addr="00000000000100"}, 0xffffff97) setsockopt$inet6_tcp_TLS_RX(0xffffffffffffffff, 0x6, 0x2, 0x0, 0x0) sendto$inet6(r1, &(0x7f0000000000)="87", 0x1, 0x0, 0x0, 0x0) r4 = accept4(r0, 0x0, 0x0, 0x0) sendto$inet6(r4, &(0x7f00000000c0), 0xfffffdda, 0x0, 0x0, 0x0) 22:50:45 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6ead74ed8a60ab563e98b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621d6234555c08dc540473786cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b59c41705b96a6711d4679079d00"/137], 0x15) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = dup(r1) write$FUSE_BMAP(r3, &(0x7f0000000100)={0x18}, 0x18) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) 22:50:45 executing program 0: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0xc9000, 0xc) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x2812, r0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$SG_GET_PACK_ID(0xffffffffffffffff, 0x227c, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @loopback}, 0x10) memfd_create(0x0, 0x200) sendfile(r2, r1, 0x0, 0x7ffff000) 22:50:45 executing program 2: setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000440)={@in6={{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x0, 0x0, "ba7e305b22384b108388d9c36c33d1aac65804755ca97d0cd1b2412971046b90ce1ebd5e0d73b3bc146917d762360009e2ba8f50a5e71990db0af1cb609cfcf83cb080729bcdeffbe600f9937223e174"}, 0xd8) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0xc9000, 0xc) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x2812, r0, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @loopback}, 0x10) sendfile(r2, r1, 0x0, 0x7ffff000) 22:50:45 executing program 1: mlock(&(0x7f0000fee000/0x12000)=nil, 0x12000) msync(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2) [ 202.061175][ T9378] netlink: 17 bytes leftover after parsing attributes in process `syz-executor.4'. [ 202.067461][ T26] audit: type=1804 audit(1572907845.148:36): pid=9377 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir356086090/syzkaller.eC3UsA/30/bus" dev="sda1" ino=16608 res=1 [ 202.103558][ C1] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 22:50:45 executing program 1: syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000200)="25bca274769e620aa734fa0095e0612687463915e38802a9d8aea872943afd874e2f98b479a7316270146d5c3fbd313ba8863cd7dcc6760253ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) [ 202.302764][ T26] audit: type=1804 audit(1572907845.188:37): pid=9379 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir519931136/syzkaller.Wd68r2/31/bus" dev="sda1" ino=16607 res=1 22:50:45 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6ead74ed8a60ab563e98b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621d6234555c08dc540473786cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b59c41705b96a6711d4679079d00"/137], 0x15) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = dup(r1) write$FUSE_BMAP(r3, &(0x7f0000000100)={0x18}, 0x18) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) [ 202.377898][ T9384] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 202.485904][ T9384] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 22:50:45 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x50, 0x0) r2 = creat(&(0x7f0000000040)='./file0/bus\x00', 0x6857b21ff1155d90) fcntl$lock(r2, 0x7, &(0x7f0000000140)={0x1}) r3 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) write$P9_RREADLINK(r4, &(0x7f0000000180)=ANY=[@ANYBLOB="ff5b7213b6012f66b000000000e00200ffe0c400d7e81ad47102"], 0x1a) sendfile(r4, r4, &(0x7f0000000240), 0x7fff) 22:50:45 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6ead74ed8a60ab563e98b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621d6234555c08dc540473786cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b59c41705b96a6711d4679079d00"/137], 0x15) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = dup(r1) write$FUSE_NOTIFY_RETRIEVE(r3, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) [ 202.858759][ T9378] netlink: 17 bytes leftover after parsing attributes in process `syz-executor.4'. [ 202.907936][ C1] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 203.009001][ T26] audit: type=1804 audit(1572907846.098:38): pid=9400 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir780716283/syzkaller.EGfQKM/32/file0/bus" dev="ramfs" ino=29509 res=1 22:50:46 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x40) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000040)="5500000018007fafb72d1cb2a4a280930206000000a843096c26234d2500080008010000000000000000a3c728f19a2a5b3cda484408f55ce8127615c4d3f4e4a3395aa3b20c68be42496b7b381160bf0c121bc022", 0x55}], 0x1}, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) r3 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0x552, 0x200) ioctl$RTC_WKALM_RD(r3, 0x80287010, &(0x7f00000000c0)) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000002c0)='lp\x00', 0x2ca) recvfrom$inet6(r1, &(0x7f0000001840)=""/31, 0x5b405ce3, 0x100, &(0x7f0000001880)={0xa, 0x0, 0x0, @rand_addr="00000000000100"}, 0xffffff97) setsockopt$inet6_tcp_TLS_RX(0xffffffffffffffff, 0x6, 0x2, 0x0, 0x0) sendto$inet6(r1, &(0x7f0000000000)="87", 0x1, 0x0, 0x0, 0x0) r4 = accept4(r0, 0x0, 0x0, 0x0) sendto$inet6(r4, &(0x7f00000000c0), 0xfffffdda, 0x0, 0x0, 0x0) [ 203.174319][ T26] audit: type=1804 audit(1572907846.118:39): pid=9395 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir519931136/syzkaller.Wd68r2/31/bus" dev="sda1" ino=16607 res=1 22:50:46 executing program 1: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000200)="25bca274769e620aa734fa0095e0612687463915e38802a9d8aea872943afd874e2f98b479a7316270146d5c3fbd313ba8863cd7dcc6760253ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x414004}}]}) [ 203.274573][ T9416] netlink: 17 bytes leftover after parsing attributes in process `syz-executor.4'. [ 203.367968][ C1] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 203.406483][ T26] audit: type=1804 audit(1572907846.128:40): pid=9395 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir519931136/syzkaller.Wd68r2/31/bus" dev="sda1" ino=16607 res=1 [ 203.556961][ T9422] EXT4-fs (loop1): EXT4-fs: inode_readahead_blks must be 0 or a power of 2 smaller than 2^31 22:50:46 executing program 5: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0xc9000, 0xc) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x2812, r0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$SG_GET_PACK_ID(0xffffffffffffffff, 0x227c, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @loopback}, 0x10) memfd_create(0x0, 0x200) sendfile(r2, r1, 0x0, 0x7ffff000) 22:50:46 executing program 0: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = open(&(0x7f00000001c0)='./bus\x00', 0xc9000, 0xc) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x2812, r0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$SG_GET_PACK_ID(0xffffffffffffffff, 0x227c, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @loopback}, 0x10) memfd_create(0x0, 0x200) sendfile(r2, r1, 0x0, 0x7ffff000) 22:50:46 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6ead74ed8a60ab563e98b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621d6234555c08dc540473786cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b59c41705b96a6711d4679079d00"/137], 0x15) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = dup(r1) write$FUSE_NOTIFY_RETRIEVE(r3, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) 22:50:46 executing program 1: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000200)="25bca274769e620aa734fa0095e0612687463915e38802a9d8aea872943afd874e2f98b479a7316270146d5c3fbd313ba8863cd7dcc6760253ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x414004}}]}) [ 203.878731][ T9435] EXT4-fs (loop1): EXT4-fs: inode_readahead_blks must be 0 or a power of 2 smaller than 2^31 22:50:47 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000200)="25bca274769e620aa734fa0095e0612687463915e38802a9d8aea872943afd874e2f98b479a7316270146d5c3fbd313ba8863cd7dcc6760253ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 22:50:47 executing program 1: syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_procfs(0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$packet(0x11, 0x20000000000003, 0x300) socket(0x9, 0x1, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet(0x10, 0x3, 0x0) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000180)=[{0x6}]}, 0x10) sendmsg(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000880)="24000000120007031dfffd946fa2830020200a0009000300001d85680c1ba3a20400ff7e280000001100ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) gettid() 22:50:47 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6ead74ed8a60ab563e98b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621d6234555c08dc540473786cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b59c41705b96a6711d4679079d00"/137], 0x15) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = dup(r1) write$FUSE_NOTIFY_RETRIEVE(r3, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) 22:50:47 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x40) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000040)="5500000018007fafb72d1cb2a4a280930206000000a843096c26234d2500080008010000000000000000a3c728f19a2a5b3cda484408f55ce8127615c4d3f4e4a3395aa3b20c68be42496b7b381160bf0c121bc022", 0x55}], 0x1}, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) r3 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0x552, 0x200) ioctl$RTC_WKALM_RD(r3, 0x80287010, &(0x7f00000000c0)) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000002c0)='lp\x00', 0x2ca) recvfrom$inet6(r1, &(0x7f0000001840)=""/31, 0x5b405ce3, 0x100, &(0x7f0000001880)={0xa, 0x0, 0x0, @rand_addr="00000000000100"}, 0xffffff97) setsockopt$inet6_tcp_TLS_RX(0xffffffffffffffff, 0x6, 0x2, 0x0, 0x0) sendto$inet6(r1, &(0x7f0000000000)="87", 0x1, 0x0, 0x0, 0x0) r4 = accept4(r0, 0x0, 0x0, 0x0) sendto$inet6(r4, &(0x7f00000000c0), 0xfffffdda, 0x0, 0x0, 0x0) [ 204.516832][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 204.565505][ T9447] EXT4-fs (loop2): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 204.600246][ T9458] netlink: 17 bytes leftover after parsing attributes in process `syz-executor.4'. [ 204.627974][ T9453] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 22:50:47 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000001380)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) fallocate(r1, 0x20, 0x0, 0xfffffeff000) fallocate(r1, 0x0, 0x0, 0x10000101) getsockname$packet(r0, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000002c0)=0x14) pipe2(&(0x7f0000000300)={0xffffffffffffffff}, 0x80000) write$nbd(r2, &(0x7f0000000480)={0x67446698, 0x1, 0x3, 0x3, 0x2, "7c31d2352f358502e5c85b782ac121e9b1328f1080e0cb0b7d0d055192d4dd7c2cdafeb1de6805b9b462e6c30bfa5ade554fd516807df8f46f31d77afd0098394baceef0e6c454edc3809a42127d18a5a9900ce59e59824ec06577af1a2159"}, 0x6f) r3 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) geteuid() ioctl$EXT4_IOC_SWAP_BOOT(r3, 0x6611) r4 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) fallocate(r4, 0x20, 0x0, 0xfffffeff000) getsockopt$ARPT_SO_GET_REVISION_TARGET(r4, 0x0, 0x63, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000040)=0x1e) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000280)) 22:50:47 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000001380)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) fallocate(r1, 0x20, 0x0, 0xfffffeff000) fallocate(r1, 0x0, 0x0, 0x10000101) getsockname$packet(r0, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000002c0)=0x14) pipe2(0x0, 0x0) write$nbd(0xffffffffffffffff, &(0x7f0000000480)={0x67446698, 0x1, 0x3, 0x3, 0x2, "7c31d2352f358502e5c85b782ac121e9b1328f1080e0cb0b7d0d055192d4dd7c2cdafeb1de6805b9b462e6c30bfa5ade554fd516807df8f46f31d77afd0098394baceef0e6c454edc3809a42127d18a5a9900ce59e59824ec06577af1a2159"}, 0x6f) r2 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r2, 0x0) geteuid() getsockopt$ARPT_SO_GET_REVISION_TARGET(r1, 0x0, 0x63, &(0x7f0000000000)={'ipvs\x00'}, 0x0) ioctl$sock_TIOCOUTQ(r1, 0x5411, &(0x7f0000000040)) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) 22:50:48 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6ead74ed8a60ab563e98b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621d6234555c08dc540473786cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b59c41705b96a6711d4679079d00"/137], 0x15) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$FUSE_BMAP(0xffffffffffffffff, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) 22:50:48 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000001380)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) fallocate(r1, 0x20, 0x0, 0xfffffeff000) fallocate(r1, 0x0, 0x0, 0x10000101) getsockname$packet(r0, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000002c0)=0x14) pipe2(&(0x7f0000000300)={0xffffffffffffffff}, 0x80000) write$nbd(r2, &(0x7f0000000480)={0x67446698, 0x1, 0x3, 0x3, 0x2, "7c31d2352f358502e5c85b782ac121e9b1328f1080e0cb0b7d0d055192d4dd7c2cdafeb1de6805b9b462e6c30bfa5ade554fd516807df8f46f31d77afd0098394baceef0e6c454edc3809a42127d18a5a9900ce59e59824ec06577af1a2159"}, 0x6f) r3 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) geteuid() ioctl$EXT4_IOC_SWAP_BOOT(r3, 0x6611) r4 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) fallocate(r4, 0x20, 0x0, 0xfffffeff000) getsockopt$ARPT_SO_GET_REVISION_TARGET(r4, 0x0, 0x63, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000040)=0x1e) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000280)) 22:50:48 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) r1 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) pwritev(r1, &(0x7f0000001380)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) fallocate(r1, 0x20, 0x0, 0xfffffeff000) fallocate(r1, 0x0, 0x0, 0x10000101) getsockname$packet(r0, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000002c0)=0x14) r2 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) geteuid() ioctl$EXT4_IOC_SWAP_BOOT(r2, 0x6611) r3 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x0) fallocate(r3, 0x20, 0x0, 0xfffffeff000) getsockopt$ARPT_SO_GET_REVISION_TARGET(r3, 0x0, 0x63, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000280)) 22:50:48 executing program 0: r0 = perf_event_open(&(0x7f0000000a00)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000002800)='/dev/ashmem\x00', 0x0, 0x0) dup2(r0, r1) 22:50:48 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6ead74ed8a60ab563e98b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621d6234555c08dc540473786cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b59c41705b96a6711d4679079d00"/137], 0x15) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$FUSE_BMAP(0xffffffffffffffff, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) 22:50:48 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0x19, &(0x7f0000000000)=0xc00000000000008, 0x4) syz_emit_ethernet(0x76, &(0x7f00000002c0)={@broadcast, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "4c000f", 0x40, 0x3a, 0x0, @empty, @mcast2, {[], @icmpv6=@dest_unreach={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "d5cae2", 0x0, 0x0, 0x0, @empty, @mcast2, [@hopopts={0x3a}], "0200000000000000"}}}}}}}, 0x0) 22:50:48 executing program 2: perf_event_open(&(0x7f0000000a00)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0x19, &(0x7f0000000000)=0xc00000000000008, 0x4) syz_emit_ethernet(0x76, &(0x7f00000002c0)={@broadcast, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "4c000f", 0x40, 0x3a, 0x0, @empty, @mcast2, {[], @icmpv6=@dest_unreach={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "d5cae2", 0x0, 0x0, 0x0, @empty, @mcast2, [@hopopts={0x3a}], "0200000000000000"}}}}}}}, 0x0) ioctl$SG_GET_PACK_ID(0xffffffffffffffff, 0x227c, 0x0) 22:50:48 executing program 5: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) getsockopt$llc_int(r0, 0x10c, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) 22:50:48 executing program 4: r0 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/net/tun\x00', 0x0, 0x0) r3 = fcntl$dupfd(r1, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) syz_kvm_setup_cpu$x86(r0, 0xffffffffffffffff, &(0x7f0000fe5000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 22:50:48 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/userio\x00', 0x2000000000000006, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_aout(r0, 0x0, 0x0) 22:50:49 executing program 5: socketpair$unix(0x1, 0x40000000000001, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f0000000000)='hfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000017c0)={[{@uid={'uid'}}]}) 22:50:49 executing program 4: setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000380)=ANY=[@ANYBLOB="d6f79333d9"], 0x0) syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x1, &(0x7f0000000080)=[{&(0x7f0000000180)="cefaad1bb83c000040dc", 0xff0f}], 0x2, 0x0) 22:50:49 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6ead74ed8a60ab563e98b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621d6234555c08dc540473786cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b59c41705b96a6711d4679079d00"/137], 0x15) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$FUSE_BMAP(0xffffffffffffffff, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) 22:50:49 executing program 0: mknod$loop(&(0x7f0000000080)='./file0\x00', 0x0, 0xffffffffffffffff) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='ceph\x00', 0x0, 0x0) [ 206.097568][ T9513] misc userio: Invalid payload size [ 206.158542][ T9523] misc userio: Invalid payload size 22:50:49 executing program 2: r0 = epoll_create1(0x0) r1 = perf_event_open(&(0x7f0000000000)={0x1000000002, 0x70, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000080)) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f00000000c0)) 22:50:49 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/userio\x00', 0x2000000000000006, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_aout(r0, 0x0, 0x0) [ 206.199791][ T9514] hfs: can't find a HFS filesystem on dev loop5 [ 206.217855][ T9521] BFS-fs: bfs_fill_super(): loop4 is unclean, continuing [ 206.261551][ T9521] BFS-fs: bfs_fill_super(): Inode 0x00000002 corrupted on loop4 22:50:49 executing program 0: r0 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000280)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_CREATE_BUFS(r0, 0xc058565d, &(0x7f0000000300)={0x0, 0x2}) 22:50:49 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6ead74ed8a60ab563e98b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621d6234555c08dc540473786cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b59c41705b96a6711d4679079d00"/137], 0x15) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) 22:50:49 executing program 5: open(&(0x7f0000000000)='./file0\x00', 0x8002, 0x106) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) open(0x0, 0x0, 0x4) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, 0x0, 0x0, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0x0, {0x0, 0x0, 0x0, 0x0, 0x6}}, 0xe) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, &(0x7f0000001700)) syz_open_dev$usbfs(&(0x7f0000000180)='/dev/bus/usb/00#/00#\x00', 0x200, 0x1) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) r4 = socket$alg(0x26, 0x5, 0x0) accept4(r4, 0x0, 0x0, 0x0) setpgid(r0, 0x0) [ 206.402413][ T9538] misc userio: Invalid payload size 22:50:49 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/userio\x00', 0x2000000000000006, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_aout(r0, 0x0, 0x0) 22:50:49 executing program 4: setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000380)=ANY=[@ANYBLOB="d6f79333d9"], 0x0) syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x1, &(0x7f0000000080)=[{&(0x7f0000000180)="cefaad1bb83c000040dc", 0xff0f}], 0x2, 0x0) 22:50:49 executing program 2: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r0 = getpid() tkill(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r3, &(0x7f0000000200)={0x28, 0x0, 0x0, @hyper}, 0x10) 22:50:49 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TUNSETVNETHDRSZ(0xffffffffffffffff, 0x400454d8, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) 22:50:49 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6ead74ed8a60ab563e98b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621d6234555c08dc540473786cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b59c41705b96a6711d4679079d00"/137], 0x15) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) [ 206.668239][ T9555] misc userio: Invalid payload size 22:50:49 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/userio\x00', 0x2000000000000006, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_aout(r0, 0x0, 0x0) 22:50:49 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TUNSETVNETHDRSZ(0xffffffffffffffff, 0x400454d8, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) 22:50:49 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x0) ioctl(r0, 0xac, 0x0) [ 206.850577][ T9564] BFS-fs: bfs_fill_super(): loop4 is unclean, continuing [ 206.888925][ T9574] misc userio: Invalid payload size 22:50:50 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/userio\x00', 0x2000000000000006, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r1, 0x0, r1) write$binfmt_aout(r0, 0x0, 0x0) [ 206.911612][ T9564] BFS-fs: bfs_fill_super(): Inode 0x00000002 corrupted on loop4 22:50:50 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TUNSETVNETHDRSZ(0xffffffffffffffff, 0x400454d8, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) 22:50:50 executing program 5: setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000440)={@in6={{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x0, 0x0, "ba7e305b22384b108388d9c36c33d1aac65804755ca97d0cd1b2412971046b90ce1ebd5e0d73b3bc146917d762360009e2ba8f50a5e71990db0af1cb609cfcf83cb080729bcdeffbe600f9937223e174"}, 0xd8) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x7ff}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x800000000001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000000), 0x200) ftruncate(r0, 0x800799c) mmap(&(0x7f0000200000/0x400000)=nil, 0x400000, 0x1, 0x2011, r0, 0x0) 22:50:50 executing program 4: setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000380)=ANY=[@ANYBLOB="d6f79333d9"], 0x0) syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x1, &(0x7f0000000080)=[{&(0x7f0000000180)="cefaad1bb83c000040dc", 0xff0f}], 0x2, 0x0) 22:50:50 executing program 2: socket$inet6(0xa, 0x0, 0x0) setsockopt$SO_TIMESTAMP(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) syz_open_dev$vcsa(0x0, 0x4bac3159, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$FUSE_NOTIFY_POLL(0xffffffffffffffff, 0x0, 0x0) unshare(0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r1) socket$inet6(0xa, 0x0, 0x4) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) socket$inet6(0xa, 0x0, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0x3c, 0x0, 0x0) process_vm_writev(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = fcntl$dupfd(r2, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) getsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, 0x0, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0x3c, 0x0, 0x0) r5 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$sock_linger(r5, 0x1, 0x3c, 0x0, 0x0) sendmmsg(r5, 0x0, 0x0, 0x24000004) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0x3c, 0x0, 0x0) r6 = socket$inet6(0xa, 0x800000000000002, 0x0) fstat(r6, 0x0) process_vm_writev(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000400)={0xffffffffffffffff, 0x0, 0x0}, 0x10) quotactl(0x0, &(0x7f0000000040)='./file0\x00', 0x0, &(0x7f0000000480)) ioctl$sock_SIOCGIFBR(0xffffffffffffffff, 0x8940, &(0x7f0000000040)=@generic) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) socket$inet6(0xa, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x24000004) socket$inet6(0xa, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) socket$inet6(0xa, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) fstat(0xffffffffffffffff, &(0x7f0000000380)) quotactl(0x0, 0x0, 0x0, &(0x7f0000000480)) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000006f40)={&(0x7f0000000080)=@kern={0x10, 0x0, 0x0, 0x40000010}, 0xc, 0x0}, 0x0) setresgid(0x0, 0x0, 0x0) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r7, 0x40045431, &(0x7f0000000000)) r8 = syz_open_pts(r7, 0x0) ioctl$TIOCSETD(r8, 0x5423, &(0x7f0000000200)=0x2) [ 207.097640][ T9587] misc userio: Invalid payload size 22:50:50 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/userio\x00', 0x2000000000000006, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r1, 0x0, r1) write$binfmt_aout(r0, 0x0, 0x0) 22:50:50 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6ead74ed8a60ab563e98b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621d6234555c08dc540473786cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b59c41705b96a6711d4679079d00"/137], 0x15) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) 22:50:50 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_emit_ethernet(0x66, &(0x7f0000000180)={@broadcast, @random="21d443f3d3ce", [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30, 0xffffff3a, 0x0, @remote, @local, {[], @icmpv6=@time_exceed={0xffffff80, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, '\x00', 0x0, 0x0, 0x0, @empty, @local}}}}}}}, 0x0) 22:50:50 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TIOCGPTLCK(0xffffffffffffffff, 0x80045439, 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) write$P9_RVERSION(r1, &(0x7f0000000340)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e00"], 0x15) mmap$perf(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x8, 0x10, 0xffffffffffffffff, 0x0) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_CREATE_OPEN(r2, &(0x7f0000000400)={0xa0}, 0xa0) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='9p\x00', 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2]) r3 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) io_submit(0x0, 0x0, 0x0) read(r0, &(0x7f00000004c0)=""/229, 0xe5) getdents64(r3, 0x0, 0x0) [ 207.295390][ T9604] misc userio: Invalid payload size [ 207.335806][ T9602] BFS-fs: bfs_fill_super(): loop4 is unclean, continuing [ 207.343594][ T9602] BFS-fs: bfs_fill_super(): Inode 0x00000002 corrupted on loop4 22:50:50 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/userio\x00', 0x2000000000000006, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r1, 0x0, r1) write$binfmt_aout(r0, 0x0, 0x0) 22:50:50 executing program 4: setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000380)=ANY=[@ANYBLOB="d6f79333d9"], 0x0) syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x1, &(0x7f0000000080)=[{&(0x7f0000000180)="cefaad1bb83c000040dc", 0xff0f}], 0x2, 0x0) 22:50:50 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0x80000000b9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r1 = getpid() openat$zero(0xffffffffffffff9c, &(0x7f0000000140)='/dev/zero\x00', 0x408200, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0}, 0x0) tkill(r1, 0x9) socket$packet(0x11, 0x3, 0x300) open_by_handle_at(0xffffffffffffffff, 0x0, 0x0) r2 = dup2(0xffffffffffffffff, 0xffffffffffffffff) inotify_add_watch(r2, 0x0, 0x91000430) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x8) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x1d7) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002011400010000000000", @ANYRES32=0x0, @ANYBLOB="000000a800c76f4503775e3a23a7073abc7e54d66704d2654729"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=@ipv4_newaddr={0x20, 0x14, 0x401, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, r8}, [@IFA_LOCAL={0x8, 0x2, @broadcast}]}, 0x20}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2000000014000104000000000700000002000000", @ANYRES32=r8, @ANYBLOB="0800020000000006"], 0x20}}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=@ipv4_newaddr={0x20, 0x11, 0x401, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, r8}, [@IFA_LOCAL={0x8}]}, 0x20}}, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) setuid(0x0) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000100)={0x28, 0x0, 0x2711, @hyper}, 0x10) r9 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r0, r9, 0x0, 0xedc0) 22:50:50 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6ead74ed8a60ab563e98b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621d6234555c08dc540473786cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b59c41705b96a6711d4679079d00"/137], 0x15) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) [ 207.620241][ T9638] misc userio: Invalid payload size 22:50:50 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/userio\x00', 0x2000000000000006, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) write$binfmt_aout(r0, 0x0, 0x0) 22:50:50 executing program 2: setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000340)={@in6={{0xa, 0x0, 0x0, @remote}}, 0x0, 0x0, 0x0, "aee3e02177a8b390566bc2dd09f1a3762d791ee4f4b438301ef0512cdb0500608905a2b845dc84fb52db92b78b7765b975935988dc185e581f893ac2396270f993a39d4502f90359bd12e421e02d30ee"}, 0xd8) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000000), 0x200) ftruncate(r0, 0x800799c) mmap(&(0x7f0000200000/0x400000)=nil, 0x400000, 0x1, 0x2011, r0, 0x0) [ 207.832043][ T9649] BFS-fs: bfs_fill_super(): loop4 is unclean, continuing [ 207.864286][ T9649] BFS-fs: bfs_fill_super(): Inode 0x00000002 corrupted on loop4 22:50:51 executing program 2: symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) rt_sigsuspend(0x0, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) ioprio_set$uid(0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f000044f000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) stat(0x0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, 0x0, 0x100000000) mount$overlay(0x0, 0x0, &(0x7f0000000380)='overlay\x00', 0x20, &(0x7f00000005c0)={[], [{@uid_gt={'uid>'}}, {@uid_lt={'uid<', r1}}]}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0xb4, 0x20, 0x800, 0x70bd2a, 0x0, {0xa, 0x80, 0x14, 0x4, 0x7f, 0x0, 0x0, 0x4, 0x2}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24}}, @FRA_DST={0x14, 0x1, @empty}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @dev}, @FRA_DST={0x14, 0x1, @ipv4={[], [], @multicast2}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @remote}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x0) [ 207.912266][ T9656] misc userio: Invalid payload size 22:50:51 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/userio\x00', 0x2000000000000006, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) write$binfmt_aout(r0, 0x0, 0x0) 22:50:51 executing program 4: setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x1, &(0x7f0000000080)=[{&(0x7f0000000180)="cefaad1bb83c000040dc", 0xff0f}], 0x2, 0x0) 22:50:51 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6ead74ed8a60ab563e98b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621d6234555c08dc540473786cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b59c41705b96a6711d4679079d00"/137], 0x15) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) [ 208.215214][ T9668] misc userio: Invalid payload size [ 208.346549][ T9671] BFS-fs: bfs_fill_super(): loop4 is unclean, continuing 22:50:51 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/userio\x00', 0x2000000000000006, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) write$binfmt_aout(r0, 0x0, 0x0) [ 208.618430][ T9681] misc userio: Invalid payload size 22:50:53 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TIOCGPTLCK(0xffffffffffffffff, 0x80045439, 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) write$P9_RVERSION(r1, &(0x7f0000000340)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e00"], 0x15) mmap$perf(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x8, 0x10, 0xffffffffffffffff, 0x0) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_CREATE_OPEN(r2, &(0x7f0000000400)={0xa0}, 0xa0) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='9p\x00', 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2]) r3 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) io_submit(0x0, 0x0, 0x0) read(r0, &(0x7f00000004c0)=""/229, 0xe5) getdents64(r3, 0x0, 0x0) 22:50:53 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/userio\x00', 0x2000000000000006, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_aout(r0, 0x0, 0x0) 22:50:53 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6ead74ed8a60ab563e98b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621d6234555c08dc540473786cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b59c41705b96a6711d4679079d00"/137], 0x15) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) 22:50:53 executing program 4: setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x1, &(0x7f0000000080)=[{&(0x7f0000000180)="cefaad1bb83c000040dc", 0xff0f}], 0x2, 0x0) 22:50:53 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(0x0, 0x0, r1) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) r4 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(0x0, r5, 0x0) 22:50:53 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5300fe01b2a4a280930a600000ffa84302910000003900090035000c00060000001900160005000000000000dc1338d54400009b84136ef75afb83de4411000500c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) 22:50:53 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = dup(r1) write$FUSE_BMAP(r3, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r3, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) 22:50:53 executing program 5: poll(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r1 = creat(&(0x7f0000001380)='./file0\x00', 0x0) r2 = creat(&(0x7f0000000040)='./file0\x00', 0x0) ftruncate(r2, 0x2081ff) r3 = creat(&(0x7f0000000080)='./bus\x00', 0x0) io_setup(0x8, &(0x7f0000000180)=0x0) fcntl$setstatus(r3, 0x4, 0x46600) io_submit(r4, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x3, 0x1, 0x0, r3, &(0x7f0000000000), 0x10000}]) getsockname$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000200)={0x1d242, r1}) [ 210.132878][ T9696] BFS-fs: bfs_fill_super(): loop4 is unclean, continuing [ 210.160409][ T9698] misc userio: Invalid payload size 22:50:53 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000004c0), 0x1000) 22:50:53 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/userio\x00', 0x2000000000000006, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_aout(r0, 0x0, 0x0) 22:50:53 executing program 4: setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x1, &(0x7f0000000080)=[{&(0x7f0000000180)="cefaad1bb83c000040dc", 0xff0f}], 0x2, 0x0) 22:50:53 executing program 2: poll(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r1 = creat(&(0x7f0000001380)='./file0\x00', 0x0) r2 = creat(&(0x7f0000000040)='./file0\x00', 0x0) ftruncate(r2, 0x2081ff) r3 = creat(&(0x7f0000000080)='./bus\x00', 0x0) io_setup(0x8, &(0x7f0000000180)=0x0) fcntl$setstatus(r3, 0x4, 0x46600) io_submit(r4, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x3, 0x1, 0x0, r3, &(0x7f0000000000), 0x10000}]) getsockname$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, &(0x7f0000000100)=0x1c) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000200)={0x1d242, r1}) [ 210.432816][ T9716] BFS-fs: bfs_fill_super(): loop4 is unclean, continuing [ 210.483020][ T9720] misc userio: Invalid payload size 22:50:55 executing program 0: 22:50:55 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/userio\x00', 0x2000000000000006, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_aout(r0, 0x0, 0x0) 22:50:55 executing program 5: 22:50:55 executing program 4: setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000380)=ANY=[@ANYBLOB="d6f79333d9"], 0x0) syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x1, &(0x7f0000000080)=[{&(0x7f0000000180)="cefaad1bb83c000040dc", 0xff0f}], 0x2, 0x0) 22:50:55 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = dup(r1) write$FUSE_BMAP(r3, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r3, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) 22:50:55 executing program 2: 22:50:55 executing program 2: clone(0x3102001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x2102811df9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x40000000013, &(0x7f0000000280)=0x100000001, 0x4) clone(0x1fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0xfdf2) setsockopt$inet_mreq(r1, 0x0, 0x23, 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETPERSIST(r2, 0x400454cb, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) connect$inet6(r3, &(0x7f0000000080), 0x1c) r4 = dup2(r3, r3) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000440), 0x131f64) recvfrom$packet(r4, 0x0, 0x7, 0x0, 0x0, 0x0) [ 212.358748][ T9743] misc userio: Invalid payload size 22:50:55 executing program 5: mknod(&(0x7f0000000080)='./file0\x00', 0x1042, 0x0) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r0 = getpid() r1 = gettid() ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r1, 0x0, 0x0) r2 = getpid() openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x1, 0x0) tgkill(r0, r2, 0x3d) open$dir(&(0x7f0000000240)='./file0\x00', 0x0, 0xbe1e8cedd5c01450) 22:50:55 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = dup(r1) write$FUSE_BMAP(r3, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r3, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) [ 212.404505][ T9740] BFS-fs: bfs_fill_super(): loop4 is unclean, continuing [ 212.420068][ T9740] BFS-fs: bfs_fill_super(): Inode 0x00000002 corrupted on loop4 22:50:55 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_aout(0xffffffffffffffff, 0x0, 0x0) 22:50:55 executing program 4: getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000380)=ANY=[@ANYBLOB="d6f79333d9"], 0x0) syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x1, &(0x7f0000000080)=[{&(0x7f0000000180)="cefaad1bb83c000040dc", 0xff0f}], 0x2, 0x0) 22:50:55 executing program 5: r0 = creat(&(0x7f0000000080)='./file0\x00', 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = creat(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x10a) dup2(r1, r2) execve(&(0x7f00000000c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) clone(0x3102001ff1, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) write$cgroup_type(r0, &(0x7f00000009c0)='threaded\x00', 0xd4b9bc3) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) link(&(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='./file1\x00') r3 = epoll_create1(0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) dup3(r4, r3, 0x0) mkdirat(r3, &(0x7f0000000140)='./file0\x00', 0x0) [ 212.752894][ T9766] BFS-fs: bfs_fill_super(): loop4 is unclean, continuing [ 212.789910][ T9766] BFS-fs: bfs_fill_super(): Inode 0x00000002 corrupted on loop4 22:50:55 executing program 0: 22:50:55 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6ead74ed8a60ab563e98b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621d6234555c08dc540473786cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b59c41705b96a6711d4679079d00"/137], 0x15) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = dup(0xffffffffffffffff) write$FUSE_BMAP(r1, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r1, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)={'trans=fd,', {'rfdno'}, 0x2c, {'wfdno'}}) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) 22:50:55 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_aout(0xffffffffffffffff, 0x0, 0x0) 22:50:56 executing program 5: 22:50:56 executing program 4: getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, 0x0, 0x0) syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x1, &(0x7f0000000080)=[{&(0x7f0000000180)="cefaad1bb83c000040dc", 0xff0f}], 0x2, 0x0) [ 212.941946][ T9781] 9pnet: Insufficient options for proto=fd 22:50:56 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_aout(0xffffffffffffffff, 0x0, 0x0) 22:50:56 executing program 2: 22:50:56 executing program 0: 22:50:56 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6ead74ed8a60ab563e98b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621d6234555c08dc540473786cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b59c41705b96a6711d4679079d00"/137], 0x15) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = dup(0xffffffffffffffff) write$FUSE_BMAP(r1, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r1, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)={'trans=fd,', {'rfdno'}, 0x2c, {'wfdno'}}) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) 22:50:56 executing program 5: [ 213.130433][ T9793] BFS-fs: bfs_fill_super(): loop4 is unclean, continuing 22:50:56 executing program 5: 22:50:56 executing program 5: 22:50:56 executing program 0: 22:50:56 executing program 5: 22:50:56 executing program 1: r0 = openat$userio(0xffffffffffffff9c, 0x0, 0x2000000000000006, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_aout(r0, 0x0, 0x0) [ 213.318868][ T9805] 9pnet: Insufficient options for proto=fd 22:50:56 executing program 2: 22:50:56 executing program 4: getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, 0x0, 0x0) syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x1, &(0x7f0000000080)=[{&(0x7f0000000180)="cefaad1bb83c000040dc", 0xff0f}], 0x2, 0x0) 22:50:56 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6ead74ed8a60ab563e98b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621d6234555c08dc540473786cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b59c41705b96a6711d4679079d00"/137], 0x15) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = dup(0xffffffffffffffff) write$FUSE_BMAP(r1, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r1, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)={'trans=fd,', {'rfdno'}, 0x2c, {'wfdno'}}) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) 22:50:56 executing program 5: 22:50:56 executing program 0: 22:50:56 executing program 1: r0 = openat$userio(0xffffffffffffff9c, 0x0, 0x2000000000000006, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_aout(r0, 0x0, 0x0) 22:50:56 executing program 2: [ 213.597952][ T9824] 9pnet: Insufficient options for proto=fd [ 213.676894][ T9826] BFS-fs: bfs_fill_super(): loop4 is unclean, continuing 22:50:56 executing program 2: 22:50:56 executing program 0: 22:50:56 executing program 5: 22:50:56 executing program 3: pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6ead74ed8a60ab563e98b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621d6234555c08dc540473786cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b59c41705b96a6711d4679079d00"/137], 0x15) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = dup(r1) write$FUSE_BMAP(r3, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r3, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) 22:50:56 executing program 1: r0 = openat$userio(0xffffffffffffff9c, 0x0, 0x2000000000000006, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_aout(r0, 0x0, 0x0) 22:50:57 executing program 4: getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, 0x0, 0x0) syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x1, &(0x7f0000000080)=[{&(0x7f0000000180)="cefaad1bb83c000040dc", 0xff0f}], 0x2, 0x0) 22:50:57 executing program 2: 22:50:57 executing program 0: 22:50:57 executing program 5: 22:50:57 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/userio\x00', 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_aout(r0, 0x0, 0x0) 22:50:57 executing program 3: pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6ead74ed8a60ab563e98b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621d6234555c08dc540473786cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b59c41705b96a6711d4679079d00"/137], 0x15) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = dup(r1) write$FUSE_BMAP(r3, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r3, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) 22:50:57 executing program 0: [ 214.171158][ T9860] BFS-fs: bfs_fill_super(): loop4 is unclean, continuing 22:50:57 executing program 2: 22:50:57 executing program 3: pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6ead74ed8a60ab563e98b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621d6234555c08dc540473786cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b59c41705b96a6711d4679079d00"/137], 0x15) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = dup(r1) write$FUSE_BMAP(r3, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r3, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) 22:50:57 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/userio\x00', 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_aout(r0, 0x0, 0x0) 22:50:57 executing program 5: 22:50:57 executing program 0: 22:50:57 executing program 4: getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000380)=ANY=[], 0x0) syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x1, &(0x7f0000000080)=[{&(0x7f0000000180)="cefaad1bb83c000040dc", 0xff0f}], 0x2, 0x0) 22:50:57 executing program 2: 22:50:57 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/userio\x00', 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_aout(r0, 0x0, 0x0) 22:50:57 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000440)=""/222, 0xde}], 0x1}, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0xfd1d, 0x0, 0x0, 0x800e00516) shutdown(r0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup2(r1, r2) getsockopt$inet_mreqn(r2, 0x0, 0x9, 0x0, &(0x7f00000000c0)) recvfrom$inet(r3, 0x0, 0xfffffe98, 0x0, 0x0, 0x800e00511) shutdown(r2, 0x0) 22:50:57 executing program 3: mkdir(0x0, 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6ead74ed8a60ab563e98b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621d6234555c08dc540473786cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b59c41705b96a6711d4679079d00"/137], 0x15) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = dup(r1) write$FUSE_BMAP(r3, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r3, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) 22:50:57 executing program 0: r0 = socket$inet6_sctp(0x1c, 0x1, 0x84) poll(&(0x7f00000000c0)=[{}, {}, {r0}, {}], 0x4, 0x4e) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0xfd1d, 0x0, 0x0, 0x800e00505) r2 = socket$inet_udplite(0x2, 0x2, 0x88) sendfile(r1, 0xffffffffffffffff, 0x0, 0x0) recvfrom$inet(r2, 0x0, 0x22b41b9a8748acb4, 0x0, 0x0, 0x800e0050e) shutdown(r1, 0x0) shutdown(r2, 0x0) 22:50:57 executing program 2: poll(&(0x7f0000000240), 0x200000000000002a, 0x51) r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r0, 0x0, 0xbf, 0x0, 0x0, 0x800e006af) recvmsg(r0, &(0x7f0000002b80)={0x0, 0x0, &(0x7f00000029c0)=[{&(0x7f00000005c0)=""/222, 0xde}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5}, 0x0) shutdown(r0, 0x0) [ 214.564326][ T9885] BFS-fs: bfs_fill_super(): loop4 is unclean, continuing 22:50:57 executing program 3: mkdir(0x0, 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6ead74ed8a60ab563e98b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621d6234555c08dc540473786cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b59c41705b96a6711d4679079d00"/137], 0x15) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = dup(r1) write$FUSE_BMAP(r3, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r3, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) 22:50:57 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/userio\x00', 0x2000000000000006, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_aout(r0, 0x0, 0x0) 22:50:57 executing program 4: getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000380)=ANY=[], 0x0) syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x1, &(0x7f0000000080)=[{&(0x7f0000000180)="cefaad1bb83c000040dc", 0xff0f}], 0x2, 0x0) 22:50:57 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000140)=""/52, 0x34}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x8}, 0x0) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0xffffff2e, 0x0, 0x0, 0x800e005ae) shutdown(r1, 0x0) readv(r2, &(0x7f0000003700)=[{&(0x7f0000000c40)=""/31, 0x1f}, {0x0}, {0x0}, {0x0}], 0x4) shutdown(r2, 0x0) 22:50:57 executing program 3: mkdir(0x0, 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6ead74ed8a60ab563e98b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621d6234555c08dc540473786cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b59c41705b96a6711d4679079d00"/137], 0x15) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = dup(r1) write$FUSE_BMAP(r3, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r3, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) [ 214.872699][ T9916] misc userio: Invalid payload size [ 214.889876][ T9915] BFS-fs: bfs_fill_super(): loop4 is unclean, continuing 22:50:58 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/userio\x00', 0x2000000000000006, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_aout(r0, 0x0, 0x0) 22:50:58 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(0x0, 0x0) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6ead74ed8a60ab563e98b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621d6234555c08dc540473786cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b59c41705b96a6711d4679079d00"/137], 0x15) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = dup(0xffffffffffffffff) write$FUSE_BMAP(r1, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r1, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)={'trans=fd,', {'rfdno'}, 0x2c, {'wfdno'}}) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) 22:50:58 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r0, &(0x7f0000002580)=[{&(0x7f0000000040)=""/4096, 0x1000}, {0x0}], 0x2) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x2769, 0x0, 0x0, 0x800e00506) shutdown(r1, 0x0) setsockopt$sock_timeval(r2, 0xffff, 0x1006, &(0x7f0000000140)={0x0, 0xfed1}, 0x10) setsockopt$inet_msfilter(0xffffffffffffffff, 0x0, 0x4a, 0x0, 0xfffffffffffffefa) recvfrom$inet(r2, 0x0, 0xb5962e0fc0aae43, 0x0, 0x0, 0x800e0050f) shutdown(r2, 0x0) 22:50:58 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r0, &(0x7f0000000000)=""/230, 0xe6, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x2d79, 0x0, 0x0, 0x800e00519) shutdown(r1, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0x0) recvfrom$inet(r2, 0x0, 0x1789836bed901fc7, 0x0, 0x0, 0x800e0050e) shutdown(r2, 0x0) 22:50:58 executing program 4: getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000380)=ANY=[], 0x0) syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x1, &(0x7f0000000080)=[{&(0x7f0000000180)="cefaad1bb83c000040dc", 0xff0f}], 0x2, 0x0) [ 215.121575][ T9938] misc userio: Invalid payload size [ 215.156973][ T1077] INFO: task khugepaged:1085 blocked for more than 143 seconds. [ 215.189170][ T9947] kobject: 'loop4' (00000000ea27e6c2): kobject_uevent_env [ 215.197014][ T9947] kobject: 'loop4' (00000000ea27e6c2): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 215.199020][ T1077] Not tainted 5.4.0-rc5-next-20191031 #0 [ 215.230262][ T9947] BFS-fs: bfs_fill_super(): loop4 is unclean, continuing [ 215.236950][ T1077] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 215.246552][ T1077] khugepaged D27840 1085 2 0x80004000 [ 215.253316][ T1077] Call Trace: 22:50:58 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/userio\x00', 0x2000000000000006, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_aout(r0, 0x0, 0x0) 22:50:58 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f00000001c0)=""/70, 0x46}], 0x1}, 0x2) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0x6cbbfc07, 0x0, 0x0, 0x800e00549) recvfrom$inet(r1, &(0x7f0000000240)=""/231, 0xe7, 0x2, 0x0, 0x0) recvmsg(r1, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x2) shutdown(r0, 0x0) fcntl$getown(r0, 0x5) recvfrom$inet(r1, 0x0, 0xff4c, 0x80002, 0x0, 0x800e0054e) shutdown(r1, 0x0) [ 215.256475][ T9945] 9pnet: Insufficient options for proto=fd [ 215.256936][ T1077] __schedule+0x94a/0x1e70 [ 215.273753][ T1077] ? __sched_text_start+0x8/0x8 [ 215.283383][ T1077] ? blk_insert_cloned_request+0x530/0x530 [ 215.292579][ T3998] kobject: 'loop1' (0000000077c7dc4b): kobject_uevent_env 22:50:58 executing program 1: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/userio\x00', 0x2000000000000006, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_aout(r0, 0x0, 0x0) [ 215.302496][ T3998] kobject: 'loop1' (0000000077c7dc4b): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 215.319929][ T3998] kobject: 'loop5' (000000001316048a): kobject_uevent_env [ 215.330953][ T9957] misc userio: Invalid payload size [ 215.336609][ T3998] kobject: 'loop5' (000000001316048a): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 215.351008][ T1077] ? _raw_spin_unlock_irq+0x23/0x80 22:50:58 executing program 2: poll(&(0x7f0000000680)=[{}], 0x2000000000000019, 0x220000004d) r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r0, 0x0, 0xfffffd05, 0x0, 0x0, 0x800e00515) readv(0xffffffffffffffff, &(0x7f0000000480)=[{&(0x7f0000000000)=""/153, 0xfffffffffffffec5}, {&(0x7f0000000580)=""/97, 0x61}, {&(0x7f0000000140)=""/184, 0xb8}, {&(0x7f0000000500)=""/114, 0x72}, {&(0x7f0000000280)=""/106, 0xfffffffffffffebd}], 0x10000000000000de) r1 = socket$inet6_sctp(0x1c, 0x5, 0x84) recvmsg(r1, &(0x7f0000002700)={0x0, 0x0, &(0x7f0000001600), 0xa}, 0x0) shutdown(r0, 0x0) 22:50:58 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(0x0, 0x0) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6ead74ed8a60ab563e98b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621d6234555c08dc540473786cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b59c41705b96a6711d4679079d00"/137], 0x15) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = dup(0xffffffffffffffff) write$FUSE_BMAP(r1, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r1, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000580)={'trans=fd,', {'rfdno'}, 0x2c, {'wfdno'}}) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=@known='user.syz\x00', 0x0, 0x0) [ 215.393454][ T1077] ? __lock_page+0x3d9/0xab0 [ 215.401645][ T1077] ? _raw_spin_unlock_irq+0x23/0x80 [ 215.410949][ T1077] schedule+0xdc/0x2b0 [ 215.419248][ T1077] io_schedule+0x1c/0x70 [ 215.423542][ T1077] __lock_page+0x422/0xab0 [ 215.428433][ T1077] ? wait_on_page_bit+0xa60/0xa60 22:50:58 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000001080)=[{&(0x7f0000000cc0)=""/73, 0x49}, {0x0}, {0x0}], 0x3}, 0x0) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x10000013c, 0x0, 0x0, 0x800e005d1) shutdown(r1, 0x0) r3 = open$dir(&(0x7f0000000000)='./file0\x00', 0x40000400000002c2, 0x0) writev(r3, &(0x7f0000000340)=[{&(0x7f0000000180), 0x80000}], 0x1000000000000013) shutdown(r2, 0x0) [ 215.443709][ T1077] ? page_cache_next_miss+0x340/0x340 [ 215.450762][ T1077] ? ___might_sleep+0x163/0x2c0 [ 215.455771][ T1077] ? __might_sleep+0x95/0x190 [ 215.461217][ T1077] mpage_prepare_extent_to_map+0xb3f/0xf90 [ 215.467515][ T1077] ? mpage_process_page_bufs+0x780/0x780 [ 215.473256][ T1077] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 215.479325][ T1077] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 215.485340][ T1077] ? __kmalloc_node+0xf/0x70 [ 215.490626][ T1077] ext4_writepages+0x954/0x2e70 [ 215.495487][ T1077] ? get_page_from_freelist+0x21fb/0x4330 [ 215.501314][ T1077] ? find_held_lock+0x35/0x130 [ 215.506112][ T1077] ? get_page_from_freelist+0x21fb/0x4330 [ 215.511880][ T1077] ? ext4_mark_inode_dirty+0x9b0/0x9b0 [ 215.517441][ T1077] ? 0xffffffff81000000 [ 215.521610][ T1077] ? mark_lock+0xc2/0x1220 [ 215.526025][ T1077] ? prep_new_page+0x19f/0x200 [ 215.530867][ T1077] ? wbc_attach_and_unlock_inode+0x514/0x920 [ 215.536951][ T1077] ? find_held_lock+0x35/0x130 [ 215.541728][ T1077] ? wbc_attach_and_unlock_inode+0x515/0x920 [ 215.547774][ T1077] ? ext4_mark_inode_dirty+0x9b0/0x9b0 [ 215.553237][ T1077] do_writepages+0xfa/0x2a0 [ 215.557858][ T1077] ? do_writepages+0xfa/0x2a0 [ 215.562529][ T1077] ? lock_downgrade+0x920/0x920 [ 215.567448][ T1077] ? page_writeback_cpu_online+0x20/0x20 [ 215.573079][ T1077] ? __kasan_check_read+0x11/0x20 [ 215.578215][ T1077] ? do_raw_spin_unlock+0x57/0x270 [ 215.583328][ T1077] ? _raw_spin_unlock+0x28/0x40 [ 215.588219][ T1077] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 215.594473][ T1077] ? wbc_attach_and_unlock_inode+0x5bf/0x920 [ 215.600691][ T1077] __filemap_fdatawrite_range+0x2bc/0x3b0 [ 215.606414][ T1077] ? delete_from_page_cache_batch+0xfe0/0xfe0 [ 215.612543][ T1077] ? lockdep_hardirqs_on+0x421/0x5e0 [ 215.618903][ T1077] filemap_flush+0x24/0x30 [ 215.623332][ T1077] collapse_file+0x36b1/0x41a0 [ 215.628274][ T1077] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 215.634436][ T1077] ? khugepaged+0x21c0/0x4360 [ 215.639285][ T1077] ? trace_event_raw_event_mm_collapse_huge_page_isolate+0x370/0x370 [ 215.647449][ T1077] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 215.653166][ T1077] ? khugepaged_find_target_node+0x142/0x180 [ 215.659252][ T1077] khugepaged+0x2da9/0x4360 [ 215.663788][ T1077] ? __kasan_check_read+0x11/0x20 [ 215.668875][ T1077] ? __lock_acquire+0x16f2/0x4a00 [ 215.673910][ T1077] ? collapse_pte_mapped_thp+0xbe0/0xbe0 [ 215.679654][ T1077] ? lock_downgrade+0x920/0x920 [ 215.684513][ T1077] ? finish_wait+0x260/0x260 [ 215.689153][ T1077] ? lockdep_hardirqs_on+0x421/0x5e0 22:50:58 executing program 5: r0 = socket$inet6_sctp(0x1c, 0x5, 0x84) poll(&(0x7f0000000000)=[{}, {r0, 0x1}, {}], 0x3, 0x8000000000047) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0xfd1d, 0x0, 0x0, 0x800e00507) r2 = dup(r1) recvfrom$inet(r2, 0x0, 0xcf70, 0x0, 0x0, 0x800e0050e) shutdown(r2, 0x0) [ 215.694459][ T1077] ? trace_hardirqs_on+0x67/0x240 [ 215.699628][ T1077] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 215.705879][ T1077] ? __kthread_parkme+0x108/0x1c0 [ 215.710966][ T1077] ? __kasan_check_read+0x11/0x20 [ 215.716004][ T1077] kthread+0x361/0x430 [ 215.720269][ T1077] ? collapse_pte_mapped_thp+0xbe0/0xbe0 [ 215.725916][ T1077] ? kthread_mod_delayed_work+0x1f0/0x1f0 [ 215.732187][ T1077] ret_from_fork+0x24/0x30 [ 215.736952][ T1077] [ 215.736952][ T1077] Showing all locks held in the system: [ 215.744673][ T1077] 4 locks held by kworker/u4:0/7: [ 215.750365][ T1077] #0: ffff88821b337d28 ((wq_completion)writeback){+.+.}, at: process_one_work+0x88b/0x1740 [ 215.760710][ T1077] #1: ffff8880a988fdc0 ((work_completion)(&(&wb->dwork)->work)){+.+.}, at: process_one_work+0x8c1/0x1740 [ 215.772399][ T1077] #2: ffff88809acd00d8 (&type->s_umount_key#32){++++}, at: trylock_super+0x22/0x110 [ 215.781929][ T1077] #3: ffff88809acd2990 (&sbi->s_journal_flag_rwsem){.+.+}, at: do_writepages+0xfa/0x2a0 [ 215.791864][ T1077] 1 lock held by khungtaskd/1077: [ 215.796940][ T1077] #0: ffffffff88faba40 (rcu_read_lock){....}, at: debug_show_all_locks+0x5f/0x279 [ 215.806248][ T1077] 1 lock held by khugepaged/1085: [ 215.811308][ T1077] #0: ffff88809acd2990 (&sbi->s_journal_flag_rwsem){.+.+}, at: do_writepages+0xfa/0x2a0 [ 215.821406][ T1077] 1 lock held by rsyslogd/8720: [ 215.826249][ T1077] #0: ffff8880a1c5bd60 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xee/0x110 [ 215.834919][ T1077] 2 locks held by getty/8810: [ 215.839649][ T1077] #0: ffff8880a75ec090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 215.848668][ T1077] #1: ffffc90005f352e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 [ 215.858287][ T1077] 2 locks held by getty/8811: [ 215.862976][ T1077] #0: ffff8880980b8090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 215.871953][ T1077] #1: ffffc90005f292e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 [ 215.882551][ T1077] 2 locks held by getty/8812: [ 215.887276][ T1077] #0: ffff8880917e0090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 215.898280][ T1077] #1: ffffc90005f392e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 [ 215.907908][ T1077] 2 locks held by getty/8813: [ 215.912596][ T1077] #0: ffff888097eb5090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 215.921695][ T1077] #1: ffffc90005f412e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 [ 215.931303][ T1077] 2 locks held by getty/8814: [ 215.935958][ T1077] #0: ffff888097805090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 215.945002][ T1077] #1: ffffc90005f3d2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 [ 215.954617][ T1077] 2 locks held by getty/8815: [ 215.959391][ T1077] #0: ffff88809fc30090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 215.968380][ T1077] #1: ffffc90005f192e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 [ 215.978007][ T1077] 2 locks held by getty/8816: [ 215.982700][ T1077] #0: ffff8880a75c3090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 215.991769][ T1077] #1: ffffc90005f112e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 [ 216.001402][ T1077] 2 locks held by syz-executor.0/8850: [ 216.007822][ T1077] #0: ffff8880a6655738 (&bdev->bd_mutex){+.+.}, at: __blkdev_get+0x19b/0x1600 [ 216.016844][ T1077] #1: ffffffff89520dc0 (loop_ctl_mutex){+.+.}, at: lo_open+0x1d/0xd0 [ 216.025023][ T1077] 2 locks held by syz-executor.1/8852: [ 216.030557][ T1077] #0: ffff8880a6658778 (&bdev->bd_mutex){+.+.}, at: __blkdev_get+0x19b/0x1600 [ 216.039676][ T1077] #1: ffffffff89520dc0 (loop_ctl_mutex){+.+.}, at: lo_open+0x1d/0xd0 [ 216.047899][ T1077] 2 locks held by syz-executor.2/8855: [ 216.053362][ T1077] #0: ffff8880a04f41f8 (&bdev->bd_mutex){+.+.}, at: __blkdev_get+0x19b/0x1600 [ 216.062367][ T1077] #1: ffffffff89520dc0 (loop_ctl_mutex){+.+.}, at: lo_open+0x1d/0xd0 [ 216.070584][ T1077] 2 locks held by syz-executor.3/8858: [ 216.076020][ T1077] #0: ffff8880a6655138 (&bdev->bd_mutex){+.+.}, at: __blkdev_get+0x19b/0x1600 [ 216.085022][ T1077] #1: ffffffff89520dc0 (loop_ctl_mutex){+.+.}, at: lo_open+0x1d/0xd0 [ 216.093252][ T1077] 1 lock held by syz-executor.5/8865: [ 216.098700][ T1077] #0: ffff8880904bf278 (&bdev->bd_mutex){+.+.}, at: __blkdev_get+0x19b/0x1600 [ 216.107709][ T1077] 1 lock held by syz-executor.4/9947: [ 216.113070][ T1077] #0: ffffffff89520dc0 (loop_ctl_mutex){+.+.}, at: __loop_clr_fd+0x88/0xd60 [ 216.122003][ T1077] 1 lock held by blkid/9956: [ 216.126712][ T1077] #0: ffff8880a6658778 (&bdev->bd_mutex){+.+.}, at: __blkdev_get+0x19b/0x1600 [ 216.135737][ T1077] 2 locks held by blkid/9962: [ 216.141300][ T1077] #0: ffff8880904bf278 (&bdev->bd_mutex){+.+.}, at: __blkdev_get+0x19b/0x1600 [ 216.150311][ T1077] #1: ffffffff89520dc0 (loop_ctl_mutex){+.+.}, at: lo_open+0x1d/0xd0 [ 216.158575][ T1077] [ 216.160904][ T1077] ============================================= [ 216.160904][ T1077] [ 216.169366][ T1077] NMI backtrace for cpu 1 [ 216.173700][ T1077] CPU: 1 PID: 1077 Comm: khungtaskd Not tainted 5.4.0-rc5-next-20191031 #0 [ 216.182268][ T1077] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 216.192308][ T1077] Call Trace: [ 216.195604][ T1077] dump_stack+0x172/0x1f0 [ 216.200721][ T1077] nmi_cpu_backtrace.cold+0x70/0xb2 [ 216.205917][ T1077] ? vprintk_func+0x86/0x189 [ 216.210536][ T1077] ? lapic_can_unplug_cpu.cold+0x3a/0x3a [ 216.216167][ T1077] nmi_trigger_cpumask_backtrace+0x23b/0x28b [ 216.222141][ T1077] arch_trigger_cpumask_backtrace+0x14/0x20 [ 216.228049][ T1077] watchdog+0xc8f/0x1350 [ 216.232280][ T1077] kthread+0x361/0x430 [ 216.236329][ T1077] ? reset_hung_task_detector+0x30/0x30 [ 216.241856][ T1077] ? kthread_mod_delayed_work+0x1f0/0x1f0 [ 216.248342][ T1077] ret_from_fork+0x24/0x30 [ 216.252857][ T1077] Sending NMI from CPU 1 to CPUs 0: [ 216.258451][ C0] NMI backtrace for cpu 0 [ 216.258457][ C0] CPU: 0 PID: 231 Comm: kworker/u4:3 Not tainted 5.4.0-rc5-next-20191031 #0 [ 216.258463][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 216.258466][ C0] Workqueue: bat_events batadv_nc_worker [ 216.258472][ C0] RIP: 0010:__lock_acquire+0x235/0x4a00 [ 216.258481][ C0] Code: 39 e6 75 09 48 85 db 0f 85 fc 11 00 00 4c 03 95 60 ff ff ff 44 89 e6 66 81 e6 ff 1f 49 8d 42 20 48 89 c2 48 89 85 50 ff ff ff <48> b8 00 00 00 00 00 fc ff df 48 c1 ea 03 0f b6 14 02 84 d2 74 09 [ 216.258485][ C0] RSP: 0018:ffff8880a9217b38 EFLAGS: 00000002 [ 216.258492][ C0] RAX: ffff8880a920ab90 RBX: 0000000000000000 RCX: 0000000000000002 [ 216.258496][ C0] RDX: ffff8880a920ab90 RSI: 0000000000000029 RDI: ffff8880a920ab68 [ 216.258501][ C0] RBP: ffff8880a9217c50 R08: 0000000000000000 R09: 1ffff1101524156d [ 216.258506][ C0] R10: ffff8880a920ab70 R11: ffff8880a920a280 R12: 0000000000000029 [ 216.258510][ C0] R13: 0000000000000000 R14: ffffffff88faba40 R15: 0000000000000000 [ 216.258515][ C0] FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 [ 216.258519][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 216.258524][ C0] CR2: 0000001b2da25000 CR3: 0000000067947000 CR4: 00000000001406f0 [ 216.258529][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 216.258533][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 216.258536][ C0] Call Trace: [ 216.258539][ C0] ? mark_held_locks+0xa4/0xf0 [ 216.258542][ C0] ? _raw_spin_unlock_irqrestore+0x66/0xe0 [ 216.258546][ C0] ? rcu_preempt_deferred_qs_irqrestore+0x4ff/0xd60 [ 216.258550][ C0] ? _raw_spin_unlock_irqrestore+0x66/0xe0 [ 216.258553][ C0] ? batadv_nc_worker+0x1fa/0x760 [ 216.258556][ C0] ? mark_held_locks+0xf0/0xf0 [ 216.258560][ C0] ? rcu_preempt_deferred_qs_irqrestore+0x4ff/0xd60 [ 216.258563][ C0] lock_acquire+0x190/0x410 [ 216.258566][ C0] ? batadv_nc_worker+0xe3/0x760 [ 216.258570][ C0] batadv_nc_worker+0x117/0x760 [ 216.258573][ C0] ? batadv_nc_worker+0xe3/0x760 [ 216.258576][ C0] process_one_work+0x9af/0x1740 [ 216.258579][ C0] ? pwq_dec_nr_in_flight+0x320/0x320 [ 216.258583][ C0] ? lock_acquire+0x190/0x410 [ 216.258586][ C0] worker_thread+0x98/0xe40 [ 216.258588][ C0] kthread+0x361/0x430 [ 216.258592][ C0] ? process_one_work+0x1740/0x1740 [ 216.258595][ C0] ? kthread_mod_delayed_work+0x1f0/0x1f0 [ 216.258598][ C0] ret_from_fork+0x24/0x30 [ 216.259154][ T1077] Kernel panic - not syncing: hung_task: blocked tasks [ 216.509270][ T1077] CPU: 1 PID: 1077 Comm: khungtaskd Not tainted 5.4.0-rc5-next-20191031 #0 [ 216.517848][ T1077] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 216.527899][ T1077] Call Trace: [ 216.531185][ T1077] dump_stack+0x172/0x1f0 [ 216.535498][ T1077] panic+0x2e3/0x75c [ 216.539378][ T1077] ? add_taint.cold+0x16/0x16 [ 216.544055][ T1077] ? lapic_can_unplug_cpu.cold+0x3a/0x3a [ 216.549940][ T1077] ? ___preempt_schedule+0x16/0x18 [ 216.555054][ T1077] ? nmi_trigger_cpumask_backtrace+0x21b/0x28b [ 216.561191][ T1077] ? nmi_trigger_cpumask_backtrace+0x24c/0x28b [ 216.567336][ T1077] ? nmi_trigger_cpumask_backtrace+0x256/0x28b [ 216.573615][ T1077] ? nmi_trigger_cpumask_backtrace+0x21b/0x28b [ 216.579862][ T1077] watchdog+0xca0/0x1350 [ 216.584095][ T1077] kthread+0x361/0x430 [ 216.588161][ T1077] ? reset_hung_task_detector+0x30/0x30 [ 216.593703][ T1077] ? kthread_mod_delayed_work+0x1f0/0x1f0 [ 216.599412][ T1077] ret_from_fork+0x24/0x30 [ 216.605414][ T1077] Kernel Offset: disabled [ 216.609925][ T1077] Rebooting in 86400 seconds..