] Bluetooth: hci3: command 0x041b tx timeout
[  424.902792][T10216] 8021q: adding VLAN 0 to HW filter on device bond0
[  425.074098][ T8724] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  425.083282][ T8724] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  425.142949][T10216] 8021q: adding VLAN 0 to HW filter on device team0
[  425.288822][ T8724] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  425.299141][ T8724] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  425.308925][ T8724] bridge0: port 1(bridge_slave_0) entered blocking state
[  425.316269][ T8724] bridge0: port 1(bridge_slave_0) entered forwarding state
[  425.473275][ T8724] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  425.483308][ T8724] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  425.494866][ T8724] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  425.504447][ T8724] bridge0: port 2(bridge_slave_1) entered blocking state
[  425.511672][ T8724] bridge0: port 2(bridge_slave_1) entered forwarding state
[  425.520816][ T8724] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  425.532019][ T8724] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  425.720375][T10216] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[  425.731095][T10216] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  425.767182][ T8724] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  425.779719][ T8724] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  425.790296][ T8724] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  425.801245][ T8724] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  425.811891][ T8724] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  425.821855][ T8724] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  425.832534][ T8724] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  425.842379][ T8724] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  425.998778][T10216] 8021q: adding VLAN 0 to HW filter on device batadv0
[  426.031781][ T9068] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  426.042216][ T9068] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  426.051424][ T9068] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[  426.059210][ T9068] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[  426.182516][ T2287] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[  426.192892][ T2287] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[  426.345992][ T2287] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[  426.356369][ T2287] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[  426.397281][T10216] device veth0_vlan entered promiscuous mode
[  426.411278][ T2287] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[  426.421023][ T2287] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[  426.502534][T10216] device veth1_vlan entered promiscuous mode
[  426.609284][ T2287] Bluetooth: hci3: command 0x040f tx timeout
[  426.688959][ T2287] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[  426.698635][ T2287] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[  426.708410][ T2287] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[  426.718680][ T2287] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[  426.753560][T10216] device veth0_macvtap entered promiscuous mode
[  426.784623][ T2287] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[  426.801655][T10216] device veth1_macvtap entered promiscuous mode
[  426.882320][T10216] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[  426.892983][T10216] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  426.903120][T10216] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[  426.913714][T10216] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  426.923719][T10216] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[  426.934881][T10216] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  426.949427][T10216] batman_adv: batadv0: Interface activated: batadv_slave_0
[  426.969315][ T2287] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[  426.979756][ T2287] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[  427.201110][T10216] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[  427.211779][T10216] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  427.222486][T10216] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[  427.233097][T10216] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  427.243061][T10216] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[  427.253763][T10216] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  427.268485][T10216] batman_adv: batadv0: Interface activated: batadv_slave_1
[  427.291174][ T8724] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[  427.302047][ T8724] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
04:59:05 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
r3 = perf_event_open(&(0x7f0000000400)={0x0, 0x70, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
fcntl$lock(r3, 0x26, &(0x7f0000000000))
r4 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r4, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

04:59:05 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r3}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r3}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:05 executing program 1:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

04:59:05 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r3}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r3}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  428.125838][T10522] overlayfs: missing 'workdir'
[  428.268449][T10524] IPVS: ftp: loaded support on port[0] = 21
04:59:05 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:05 executing program 1:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  428.603522][T10526] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  428.610914][T10526] IPv6: NLM_F_CREATE should be set when creating new route
[  428.690733][ T8723] Bluetooth: hci3: command 0x0419 tx timeout
04:59:06 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
r3 = perf_event_open(&(0x7f0000000400)={0x0, 0x70, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
fcntl$lock(r3, 0x26, &(0x7f0000000000))
r4 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r4, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

04:59:06 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r3, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  429.304470][T10556] overlayfs: missing 'workdir'
04:59:06 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  429.440353][T10559] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  429.447751][T10559] IPv6: NLM_F_CREATE should be set when creating new route
[  429.609744][T10561] IPVS: ftp: loaded support on port[0] = 21
04:59:07 executing program 1:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, 0x0, &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

04:59:07 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r3, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  430.350819][T10577] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  430.358341][T10577] IPv6: NLM_F_CREATE should be set when creating new route
04:59:07 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  430.738812][T10590] overlayfs: conflicting lowerdir path
04:59:08 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r3, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:08 executing program 1:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, 0x0, &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  431.194483][T10608] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  431.201906][T10608] IPv6: NLM_F_CREATE should be set when creating new route
04:59:08 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:08 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  431.625577][T10610] overlayfs: conflicting lowerdir path
04:59:09 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:09 executing program 1:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, 0x0, &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  431.845589][T10616] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  431.852971][T10616] IPv6: NLM_F_CREATE should be set when creating new route
[  432.327575][T10621] overlayfs: conflicting lowerdir path
04:59:10 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
r3 = perf_event_open(&(0x7f0000000400)={0x0, 0x70, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
fcntl$lock(r3, 0x26, &(0x7f0000000000))
r4 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r4, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

04:59:10 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:10 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:10 executing program 1:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', 0x0, 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  433.282517][T10631] overlayfs: conflicting lowerdir path
04:59:10 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:10 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  433.587115][T10635] IPVS: ftp: loaded support on port[0] = 21
04:59:10 executing program 1:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', 0x0, 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

04:59:11 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:11 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  434.314137][T10650] overlayfs: conflicting lowerdir path
[  434.408299][    T7] tipc: TX() has been purged, node left!
04:59:11 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:11 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
r3 = perf_event_open(&(0x7f0000000400)={0x0, 0x70, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
fcntl$lock(r3, 0x26, &(0x7f0000000000))
r4 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r4, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

04:59:11 executing program 1:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', 0x0, 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

04:59:12 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  434.839823][T10672] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  434.847302][T10672] IPv6: NLM_F_CREATE should be set when creating new route
04:59:12 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  435.169638][T10674] IPVS: ftp: loaded support on port[0] = 21
[  435.282760][T10679] overlayfs: conflicting lowerdir path
04:59:13 executing program 1:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0)

04:59:13 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r3, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:13 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  436.410912][T10720] overlayfs: conflicting lowerdir path
[  436.457366][T10724] overlayfs: missing 'lowerdir'
04:59:13 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r3, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:13 executing program 1:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0)

04:59:13 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:14 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, <r1=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r1}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:14 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r3, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  437.283715][T10737] overlayfs: missing 'lowerdir'
[  437.297419][T10736] overlayfs: conflicting lowerdir path
04:59:15 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
r3 = perf_event_open(&(0x7f0000000400)={0x0, 0x70, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
fcntl$lock(r3, 0x26, &(0x7f0000000000))
syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

04:59:15 executing program 1:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0)

04:59:15 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r3, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:15 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, <r1=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r1}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  438.756285][T10752] overlayfs: missing 'lowerdir'
[  438.763193][T10750] overlayfs: conflicting lowerdir path
04:59:16 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, <r1=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r1}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:16 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r3, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:16 executing program 1:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}]})

[  439.077190][T10754] IPVS: ftp: loaded support on port[0] = 21
04:59:16 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  439.692170][T10773] overlayfs: conflicting lowerdir path
[  439.736415][T10774] overlayfs: missing 'lowerdir'
[  439.799541][ T9466] tipc: TX() has been purged, node left!
04:59:17 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r3, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:17 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
r3 = perf_event_open(&(0x7f0000000400)={0x0, 0x70, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
fcntl$lock(r3, 0x26, &(0x7f0000000000))
syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

04:59:17 executing program 1:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}]})

[  440.061808][T10786] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  440.069235][T10786] IPv6: NLM_F_CREATE should be set when creating new route
04:59:17 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  440.577259][T10794] overlayfs: missing 'lowerdir'
[  440.581326][T10792] IPVS: ftp: loaded support on port[0] = 21
[  440.584177][T10793] overlayfs: conflicting lowerdir path
04:59:17 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r3, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:18 executing program 1:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}]})

[  441.251023][T10811] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  441.258503][T10811] IPv6: NLM_F_CREATE should be set when creating new route
04:59:18 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
r3 = perf_event_open(&(0x7f0000000400)={0x0, 0x70, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
fcntl$lock(r3, 0x26, &(0x7f0000000000))
syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  441.495813][T10823] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  441.503137][T10823] IPv6: NLM_F_CREATE should be set when creating new route
04:59:18 executing program 3:
r0 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, <r1=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r1}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  441.766580][T10826] overlayfs: conflicting lowerdir path
[  441.782546][T10828] overlayfs: missing 'lowerdir'
[  441.950050][T10827] IPVS: ftp: loaded support on port[0] = 21
04:59:19 executing program 1:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

04:59:19 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r3, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  442.734376][T10846] overlayfs: conflicting lowerdir path
[  442.738478][T10852] overlayfs: missing 'workdir'
04:59:20 executing program 3:
r0 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, <r1=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r1}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  442.913687][T10861] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  442.921121][T10861] IPv6: NLM_F_CREATE should be set when creating new route
04:59:20 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
r3 = perf_event_open(&(0x7f0000000400)={0x0, 0x70, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
fcntl$lock(r3, 0x26, &(0x7f0000000000))
getpeername$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

04:59:20 executing program 1:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

04:59:20 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r3, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:20 executing program 3:
r0 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, <r1=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r1}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  443.559490][T10865] IPVS: ftp: loaded support on port[0] = 21
[  443.776542][T10869] overlayfs: conflicting lowerdir path
[  443.792613][T10870] overlayfs: missing 'workdir'
04:59:21 executing program 1:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  444.155054][T10877] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  444.162435][T10877] IPv6: NLM_F_CREATE should be set when creating new route
[  444.172564][ T9466] tipc: TX() has been purged, node left!
04:59:21 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x0, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  444.633649][T10902] overlayfs: conflicting lowerdir path
[  444.637916][T10905] overlayfs: missing 'workdir'
04:59:22 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
r3 = perf_event_open(&(0x7f0000000400)={0x0, 0x70, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
fcntl$lock(r3, 0x26, &(0x7f0000000000))
getpeername$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

04:59:22 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r3, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:22 executing program 1:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

04:59:22 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x0, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  445.252272][T10909] IPVS: ftp: loaded support on port[0] = 21
[  445.700230][T10922] overlayfs: option "workdir=./file1" is useless in a non-upper mount, ignore
[  445.709344][T10922] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent
[  445.889477][T10927] overlayfs: conflicting lowerdir path
04:59:23 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x0, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:23 executing program 1:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

04:59:23 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r3, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:23 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
r3 = perf_event_open(&(0x7f0000000400)={0x0, 0x70, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
fcntl$lock(r3, 0x26, &(0x7f0000000000))
getpeername$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

04:59:23 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x0, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  446.710833][T10952] overlayfs: conflicting lowerdir path
[  446.722571][T10953] overlayfs: option "workdir=./file1" is useless in a non-upper mount, ignore
[  446.731875][T10953] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent
04:59:24 executing program 1:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  447.240822][T10963] IPVS: ftp: loaded support on port[0] = 21
04:59:24 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x0, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  447.679914][T10967] overlayfs: conflicting lowerdir path
[  447.715528][T10970] overlayfs: option "workdir=./file1" is useless in a non-upper mount, ignore
[  447.724559][T10970] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent
04:59:25 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x0, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:25 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r3, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  448.183121][ T9466] tipc: TX() has been purged, node left!
[  448.229671][ T9466] tipc: TX() has been purged, node left!
04:59:25 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
perf_event_open(&(0x7f0000000400)={0x0, 0x70, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

04:59:25 executing program 1:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
r3 = perf_event_open(&(0x7f0000000400)={0x0, 0x70, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
fcntl$lock(r3, 0x26, &(0x7f0000000000))
getpeername$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

04:59:26 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  449.097632][T11004] IPVS: ftp: loaded support on port[0] = 21
[  449.098601][T11006] IPVS: ftp: loaded support on port[0] = 21
04:59:26 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x0, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:27 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:27 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
perf_event_open(&(0x7f0000000400)={0x0, 0x70, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

04:59:27 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x0, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:27 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:27 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r3, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  450.727022][T11060] IPVS: ftp: loaded support on port[0] = 21
04:59:28 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x0, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:28 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, 0x0, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:28 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
perf_event_open(&(0x7f0000000400)={0x0, 0x70, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

04:59:29 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, 0x0, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:29 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x0, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  452.283409][T11103] IPVS: ftp: loaded support on port[0] = 21
04:59:29 executing program 1:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

04:59:29 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, 0x0, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  453.003399][T11132] overlayfs: missing 'workdir'
04:59:30 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x0, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:30 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

04:59:30 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:30 executing program 1:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
perf_event_open(&(0x7f0000000400)={0x0, 0x70, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  453.591715][T11138] IPVS: ftp: loaded support on port[0] = 21
[  453.658633][ T9466] tipc: TX() has been purged, node left!
[  453.683742][ T9466] tipc: TX() has been purged, node left!
[  453.791200][ T9466] tipc: TX() has been purged, node left!
04:59:31 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x0, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  454.046259][ T9466] tipc: TX() has been purged, node left!
[  454.191213][T11152] IPVS: ftp: loaded support on port[0] = 21
04:59:31 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

04:59:31 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:32 executing program 4:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

04:59:32 executing program 1:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
r3 = perf_event_open(&(0x7f0000000400)={0x0, 0x70, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
fcntl$lock(r3, 0x26, &(0x7f0000000000))
r4 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r4, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

04:59:32 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:32 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  455.378725][T11195] IPVS: ftp: loaded support on port[0] = 21
[  455.768362][T11197] IPVS: ftp: loaded support on port[0] = 21
04:59:33 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:33 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:34 executing program 1:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
r3 = perf_event_open(&(0x7f0000000400)={0x0, 0x70, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
fcntl$lock(r3, 0x26, &(0x7f0000000000))
r4 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r4, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

04:59:34 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:34 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  457.569059][T11237] IPVS: ftp: loaded support on port[0] = 21
04:59:34 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, 0x0, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  458.221392][T11229] IPVS: ftp: loaded support on port[0] = 21
[  459.439973][T11229] chnl_net:caif_netlink_parms(): no params data found
04:59:36 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

04:59:36 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  459.921893][T11229] bridge0: port 1(bridge_slave_0) entered blocking state
[  459.929973][T11229] bridge0: port 1(bridge_slave_0) entered disabled state
[  459.939996][T11229] device bridge_slave_0 entered promiscuous mode
[  459.966953][ T8716] Bluetooth: hci4: command 0x0409 tx timeout
[  460.083700][T11229] bridge0: port 2(bridge_slave_1) entered blocking state
[  460.091121][T11229] bridge0: port 2(bridge_slave_1) entered disabled state
[  460.101179][T11229] device bridge_slave_1 entered promiscuous mode
[  460.189238][T11404] IPVS: ftp: loaded support on port[0] = 21
[  460.296875][T11229] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  460.512246][T11229] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  460.741550][T11229] team0: Port device team_slave_0 added
[  460.818102][T11229] team0: Port device team_slave_1 added
[  461.012931][T11229] batman_adv: batadv0: Adding interface: batadv_slave_0
[  461.020466][T11229] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  461.047641][T11229] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  461.108111][ T9466] tipc: TX() has been purged, node left!
[  461.149745][ T9466] tipc: TX() has been purged, node left!
[  461.150275][T11229] batman_adv: batadv0: Adding interface: batadv_slave_1
[  461.162897][T11229] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  461.189101][T11229] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  461.424691][T11229] device hsr_slave_0 entered promiscuous mode
[  461.460507][T11229] device hsr_slave_1 entered promiscuous mode
[  461.498877][T11229] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  461.506857][T11229] Cannot create hsr debugfs directory
[  462.047139][ T8716] Bluetooth: hci4: command 0x041b tx timeout
[  462.731615][T11229] netdevsim netdevsim4 netdevsim0: renamed from eth0
[  462.826334][T11229] netdevsim netdevsim4 netdevsim1: renamed from eth1
[  462.918940][T11229] netdevsim netdevsim4 netdevsim2: renamed from eth2
[  463.025306][T11229] netdevsim netdevsim4 netdevsim3: renamed from eth3
[  463.677477][T11229] 8021q: adding VLAN 0 to HW filter on device bond0
[  463.764789][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  463.774428][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  463.821166][T11229] 8021q: adding VLAN 0 to HW filter on device team0
[  463.906782][ T9614] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  463.917505][ T9614] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  463.927144][ T9614] bridge0: port 1(bridge_slave_0) entered blocking state
[  463.934389][ T9614] bridge0: port 1(bridge_slave_0) entered forwarding state
[  464.005029][ T9614] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  464.014652][ T9614] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  464.025266][ T9614] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  464.035414][ T9614] bridge0: port 2(bridge_slave_1) entered blocking state
[  464.042720][ T9614] bridge0: port 2(bridge_slave_1) entered forwarding state
[  464.051912][ T9614] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  464.101007][ T8722] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  464.126707][ T9614] Bluetooth: hci4: command 0x040f tx timeout
[  464.144157][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  464.155209][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  464.192308][T11331] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  464.202998][T11331] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  464.214038][T11331] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  464.268293][ T9614] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  464.278154][ T9614] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  464.319531][ T9614] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  464.329523][ T9614] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  464.360270][T11229] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  464.462652][ T9614] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[  464.471384][ T9614] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[  464.515322][T11229] 8021q: adding VLAN 0 to HW filter on device batadv0
[  464.789532][ T9614] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[  464.800920][ T9614] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[  464.877156][ T9614] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[  464.887324][ T9614] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[  464.915440][T11229] device veth0_vlan entered promiscuous mode
[  464.932572][ T9614] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[  464.942397][ T9614] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[  464.996521][T11229] device veth1_vlan entered promiscuous mode
[  465.103376][ T8716] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[  465.113328][ T8716] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[  465.123183][ T8716] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[  465.133621][ T8716] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[  465.173384][T11229] device veth0_macvtap entered promiscuous mode
[  465.206408][T11229] device veth1_macvtap entered promiscuous mode
[  465.282247][T11229] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[  465.294147][T11229] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  465.304216][T11229] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[  465.314754][T11229] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  465.324765][T11229] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[  465.337312][T11229] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  465.347313][T11229] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[  465.357843][T11229] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  465.372732][T11229] batman_adv: batadv0: Interface activated: batadv_slave_0
[  465.385502][ T8716] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[  465.395523][ T8716] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[  465.405430][ T8716] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[  465.415995][ T8716] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[  465.466973][T11229] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[  465.481382][T11229] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  465.491727][T11229] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[  465.502294][T11229] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  465.512439][T11229] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[  465.523062][T11229] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  465.533119][T11229] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[  465.543757][T11229] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  465.559390][T11229] batman_adv: batadv0: Interface activated: batadv_slave_1
[  465.579918][ T8716] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[  465.591633][ T8716] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[  466.232382][T11529] IPVS: ftp: loaded support on port[0] = 21
[  466.307501][ T9068] Bluetooth: hci4: command 0x0419 tx timeout
04:59:44 executing program 4:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

04:59:44 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, 0x0, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:44 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r3, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:44 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, 0x0, &(0x7f0000000200))
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:44 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  467.225626][T11555] IPVS: ftp: loaded support on port[0] = 21
[  467.570546][T11567] IPVS: ftp: loaded support on port[0] = 21
[  467.832390][T11563] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  467.839874][T11563] IPv6: NLM_F_CREATE should be set when creating new route
04:59:45 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, 0x0, &(0x7f0000000200))
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:45 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, 0x0, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  468.527619][ T9466] tipc: TX() has been purged, node left!
04:59:45 executing program 1:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

04:59:45 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

04:59:46 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, 0x0, &(0x7f0000000200))
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:46 executing program 4:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  469.171524][T11618] IPVS: ftp: loaded support on port[0] = 21
04:59:46 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  469.403501][T11621] IPVS: ftp: loaded support on port[0] = 21
[  469.732639][T11624] IPVS: ftp: loaded support on port[0] = 21
04:59:47 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:47 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:48 executing program 1:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

04:59:48 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

04:59:48 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:48 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:48 executing program 4:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  471.486869][T11702] IPVS: ftp: loaded support on port[0] = 21
[  471.589177][T11703] IPVS: ftp: loaded support on port[0] = 21
04:59:49 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:49 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  472.621814][T11754] IPVS: ftp: loaded support on port[0] = 21
04:59:50 executing program 1:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
r3 = perf_event_open(&(0x7f0000000400)={0x0, 0x70, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
fcntl$lock(r3, 0x26, &(0x7f0000000000))
r4 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r4, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

04:59:50 executing program 4 (fault-call:4 fault-nth:0):
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

04:59:50 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

04:59:50 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:50 executing program 3:
socket$nl_route(0x10, 0x3, 0x0)
r0 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, <r1=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r1}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  473.889854][T11784] IPVS: ftp: loaded support on port[0] = 21
[  474.003230][T11786] overlayfs: conflicting lowerdir path
[  474.072105][T11788] FAULT_INJECTION: forcing a failure.
[  474.072105][T11788] name failslab, interval 1, probability 0, space 0, times 1
[  474.085351][T11788] CPU: 1 PID: 11788 Comm: syz-executor.4 Not tainted 5.8.0-rc5-syzkaller #0
[  474.094347][T11788] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  474.104762][T11788] Call Trace:
[  474.108451][T11788]  dump_stack+0x21c/0x280
[  474.113235][T11788]  should_fail+0x8b7/0x9e0
[  474.118247][T11788]  __should_failslab+0x1f6/0x290
[  474.123490][T11788]  should_failslab+0x29/0x70
[  474.128248][T11788]  __kmalloc_track_caller+0x1a8/0xe10
[  474.133739][T11788]  ? __msan_metadata_ptr_for_load_8+0x10/0x20
[  474.139991][T11788]  ? copy_mount_string+0x69/0xb0
[  474.145104][T11788]  strndup_user+0x19d/0x410
[  474.149828][T11788]  copy_mount_string+0x69/0xb0
[  474.154751][T11788]  __se_compat_sys_mount+0xb7/0xaa0
[  474.160342][T11788]  __ia32_compat_sys_mount+0x62/0x80
[  474.165909][T11788]  __do_fast_syscall_32+0x2af/0x480
[  474.171534][T11788]  do_fast_syscall_32+0x6b/0xd0
[  474.176504][T11788]  do_SYSENTER_32+0x73/0x90
[  474.181161][T11788]  entry_SYSENTER_compat_after_hwframe+0x4d/0x5c
[  474.187703][T11788] RIP: 0023:0xf7f7d549
[  474.191825][T11788] Code: Bad RIP value.
[  474.195971][T11788] RSP: 002b:00000000f55560cc EFLAGS: 00000296 ORIG_RAX: 0000000000000015
[  474.204493][T11788] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000020000040
[  474.212554][T11788] RDX: 0000000020000080 RSI: 0000000000000000 RDI: 0000000020000300
[  474.220602][T11788] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[  474.228666][T11788] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[  474.237103][T11788] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
04:59:51 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:52 executing program 3:
socket$nl_route(0x10, 0x3, 0x0)
r0 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, <r1=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r1}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  475.277625][ T9466] tipc: TX() has been purged, node left!
[  475.309949][ T9466] tipc: TX() has been purged, node left!
[  475.324966][T11792] IPVS: ftp: loaded support on port[0] = 21
[  475.389027][ T9466] tipc: TX() has been purged, node left!
[  475.437265][ T9466] tipc: TX() has been purged, node left!
04:59:52 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, 0x0, &(0x7f0000000200))
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:52 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:52 executing program 3:
socket$nl_route(0x10, 0x3, 0x0)
r0 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, <r1=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r1}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:53 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  476.275188][ T9466] tipc: TX() has been purged, node left!
04:59:53 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, 0x0, &(0x7f0000000200))
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:53 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

04:59:53 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, 0x0, 0x24000000)

[  476.941131][T11855] overlayfs: conflicting lowerdir path
04:59:54 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, 0x0, &(0x7f0000000200))
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:54 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:54 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, 0x0, 0x24000000)

[  477.478388][T11861] IPVS: ftp: loaded support on port[0] = 21
04:59:55 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

04:59:55 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:55 executing program 1:
r0 = socket(0x1000000010, 0x80002, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x4924924924926d3, 0x0)
setsockopt$bt_BT_CHANNEL_POLICY(r0, 0x112, 0xa, &(0x7f0000000000)=0x652aa13, 0x4)
r1 = msgget$private(0x0, 0x0)
msgrcv(r1, 0x0, 0x1, 0x1, 0x0)
msgrcv(r1, 0x0, 0x0, 0x2, 0x0)
msgsnd(r1, &(0x7f0000000080)={0x2}, 0x8, 0x0)

04:59:55 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, 0x0, 0x24000000)

04:59:56 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

04:59:56 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  479.209329][T11907] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
[  479.221190][T11906] overlayfs: conflicting lowerdir path
04:59:56 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x24000000)

[  479.408979][T11909] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
[  479.425935][T11906] overlayfs: conflicting lowerdir path
[  479.621897][T11910] IPVS: ftp: loaded support on port[0] = 21
04:59:56 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:57 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x2, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

04:59:57 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x24000000)

04:59:58 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  481.097402][T11945] overlayfs: conflicting lowerdir path
[  481.183115][T11945] overlayfs: conflicting lowerdir path
04:59:58 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x24000000)

04:59:58 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

04:59:58 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x3, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  482.004594][T11957] IPVS: ftp: loaded support on port[0] = 21
[  482.344386][T11960] overlayfs: conflicting lowerdir path
04:59:59 executing program 1:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

04:59:59 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

04:59:59 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x24000000)

[  482.532390][ T9068] Bluetooth: hci0: command 0x0406 tx timeout
[  482.622646][T11961] overlayfs: conflicting lowerdir path
04:59:59 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x4, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:00:00 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:00:00 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:00:00 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x24000000)

[  483.311283][T11989] IPVS: ftp: loaded support on port[0] = 21
[  483.652645][T11994] overlayfs: conflicting lowerdir path
[  483.692388][T11995] IPVS: ftp: loaded support on port[0] = 21
[  484.054203][T11994] overlayfs: conflicting lowerdir path
05:00:01 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, 0x0, &(0x7f0000000200))
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:00:01 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x5, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:00:01 executing program 1:
syz_mount_image$reiserfs(&(0x7f0000000000)='reiserfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='nobttrs=\x00'])

05:00:02 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x24000000)

05:00:02 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:00:02 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, 0x0, &(0x7f0000000200))
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  485.234545][T12049] overlayfs: conflicting lowerdir path
[  485.259998][T12050] REISERFS warning (device loop1): super-6502 reiserfs_getopt: unknown mount option "nobttrs="
[  485.371412][T12047] overlayfs: conflicting lowerdir path
[  485.452028][T12050] REISERFS warning (device loop1): super-6502 reiserfs_getopt: unknown mount option "nobttrs="
05:00:02 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, 0x0, &(0x7f0000000200))
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  485.731970][T12063] IPVS: ftp: loaded support on port[0] = 21
05:00:03 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x6, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:00:03 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x0, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:00:03 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="680000001000010425bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000045c000001400040073797a6b616c6c6572300000000000000a000100aaaaaaaaaabb0000280012800900010076657468"], 0x68}}, 0x0)
openat$zero(0xffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400000, 0x0)

05:00:03 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  486.619023][T12093] netlink: 'syz-executor.1': attribute type 4 has an invalid length.
[  486.627369][T12093] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
[  486.695184][T12091] overlayfs: conflicting lowerdir path
05:00:04 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x0, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  486.931875][T12095] overlayfs: conflicting lowerdir path
05:00:04 executing program 1:
r0 = socket(0x80000000000000a, 0x2, 0x0)
setsockopt$inet6_group_source_req(r0, 0x29, 0x2a, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108)
r1 = socket(0x80000000000000a, 0x2, 0x0)
setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000080)={0x1, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote}}}, 0x104)
setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}}, 0xff1c)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = socket$netlink(0x10, 0x3, 0x0)
setxattr$security_ima(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380)='security.ima\x00', &(0x7f0000000780)=@md5={0x1, "7eb743f8a307ef565ab1d676bb7205ef"}, 0x11, 0x0)
r5 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000580)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {}, {0x8}}, [@filter_kind_options=@f_u32={{0x8, 0x1, 'u32\x00'}, {0x18, 0x2, [@TCA_U32_SEL={0x14}]}}]}, 0x44}}, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000740)=[{&(0x7f0000000400)=""/141, 0x8d}, {&(0x7f0000000600)=""/216, 0xd8}, {&(0x7f00000004c0)=""/4, 0x4}, {&(0x7f0000000500)=""/75, 0x4b}, {&(0x7f0000000700)=""/46, 0x2e}, {&(0x7f0000001500)=""/4096, 0x1000}], 0x6, 0x3, 0xab)
getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14)
sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000280012000900010071657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000014c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r6, @ANYBLOB="00006807ccf10d1919ea5a29adc300"/27], 0x38}}, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000580)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {}, {0x8}}, [@filter_kind_options=@f_u32={{0x8, 0x1, 'u32\x00'}, {0x18, 0x2, [@TCA_U32_SEL={0x14}]}}]}, 0x44}}, 0x0)
getpeername(r2, &(0x7f0000000000)=@in, &(0x7f00000001c0)=0x80)
setsockopt$inet6_group_source_req(r0, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @loopback}}}, 0x108)
close(r0)

05:00:04 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:00:04 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:00:04 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x7, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  487.489473][T12102] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
05:00:04 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x0, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  487.565029][T12105] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.1'.
[  487.583161][ T9466] tipc: TX() has been purged, node left!
[  487.664427][ T9466] tipc: TX() has been purged, node left!
[  487.692012][T12105] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
[  487.732066][ T9466] tipc: TX() has been purged, node left!
[  487.752642][T12102] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.1'.
[  487.799030][ T9466] tipc: TX() has been purged, node left!
[  487.831140][ T9466] tipc: TX() has been purged, node left!
[  487.884379][ T9466] tipc: TX() has been purged, node left!
[  488.000043][T12109] IPVS: ftp: loaded support on port[0] = 21
[  488.060587][ T9466] tipc: TX() has been purged, node left!
[  488.173576][T12117] overlayfs: conflicting lowerdir path
05:00:05 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  488.270370][T12115] overlayfs: conflicting lowerdir path
05:00:05 executing program 1:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:00:05 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x24000000)

05:00:05 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x8, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:00:06 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x24000000)

05:00:06 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r3, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  489.219248][T12151] IPVS: ftp: loaded support on port[0] = 21
05:00:06 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r2 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r2, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  489.469537][T12153] overlayfs: conflicting lowerdir path
[  489.660145][T12154] overlayfs: conflicting lowerdir path
05:00:07 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x9, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  490.072865][T12175] IPVS: ftp: loaded support on port[0] = 21
[  490.322463][T12179] overlayfs: conflicting lowerdir path
[  490.491956][T12180] overlayfs: conflicting lowerdir path
05:00:07 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}]}, 0x24}}, 0x24000000)

05:00:07 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r3, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:00:08 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xa, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:00:08 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r2 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r2, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:00:08 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev}]}, 0x38}}, 0x24000000)

[  491.709109][T12217] overlayfs: conflicting lowerdir path
[  491.763992][T12218] overlayfs: conflicting lowerdir path
[  492.048135][T12225] IPVS: ftp: loaded support on port[0] = 21
[  492.768397][   T28] Bluetooth: hci1: command 0x0406 tx timeout
05:00:10 executing program 1:
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x0, 0x25}}, &(0x7f0000000000)='GPL\x00', 0x3fe, 0x252, &(0x7f000000cf3d)=""/195}, 0x48)

05:00:10 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r3, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:00:10 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev}]}, 0x38}}, 0x24000000)

05:00:10 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xb, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:00:10 executing program 5:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:00:10 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r2 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r2, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  493.988070][T12272] IPVS: ftp: loaded support on port[0] = 21
[  494.066346][T12270] overlayfs: conflicting lowerdir path
[  494.337231][T12270] overlayfs: conflicting lowerdir path
05:00:11 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev}]}, 0x38}}, 0x24000000)

05:00:11 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, 0x0, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:00:12 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xc, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:00:12 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:00:12 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x6}}, {[{}], {{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:00:12 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x30, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x30}}, 0x24000000)

05:00:12 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, 0x0, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  495.559221][T12305] IPVS: ftp: loaded support on port[0] = 21
[  495.904180][T12311] overlayfs: conflicting lowerdir path
[  496.097351][T12264] usb 2-1: new low-speed USB device number 6 using dummy_hcd
05:00:13 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xd, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  496.463246][T12264] usb 2-1: No LPM exit latency info found, disabling LPM.
[  496.559000][T12264] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10
[  496.570297][T12264] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  496.581243][T12264] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 is Bulk; changing to Interrupt
[  496.591384][T12264] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 is Bulk; changing to Interrupt
05:00:13 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x30, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x30}}, 0x24000000)

05:00:13 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, 0x0, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  497.038469][T12264] usb 2-1: string descriptor 0 read error: -22
[  497.045052][T12264] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  497.054463][T12264] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  497.284178][T12312] raw-gadget gadget: fail, usb_ep_enable returned -22
[  497.318297][T12312] raw-gadget gadget: fail, usb_ep_enable returned -22
[  497.343748][T12344] overlayfs: conflicting lowerdir path
[  497.363317][T12264] cdc_ether: probe of 2-1:1.0 failed with error -22
[  497.616030][T12264] usb 2-1: USB disconnect, device number 6
[  497.658462][T12345] overlayfs: conflicting lowerdir path
[  497.681532][T12331] IPVS: ftp: loaded support on port[0] = 21
[  498.408002][T11332] usb 2-1: new low-speed USB device number 7 using dummy_hcd
[  498.533830][ T9466] tipc: TX() has been purged, node left!
[  498.580321][ T9466] tipc: TX() has been purged, node left!
[  498.606694][ T9466] tipc: TX() has been purged, node left!
[  498.631612][ T9466] tipc: TX() has been purged, node left!
[  498.769266][T11332] usb 2-1: No LPM exit latency info found, disabling LPM.
[  498.848929][T11332] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10
[  498.860247][T11332] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  498.870369][T11332] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 is Bulk; changing to Interrupt
[  498.880533][T11332] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 is Bulk; changing to Interrupt
[  499.045702][T12331] chnl_net:caif_netlink_parms(): no params data found
[  499.248138][T11332] usb 2-1: string descriptor 0 read error: -71
[  499.254718][T11332] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  499.264205][T11332] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  499.458996][T11332] usb 2-1: can't set config #1, error -71
[  499.487512][ T8721] Bluetooth: hci5: command 0x0409 tx timeout
[  499.501729][T11332] usb 2-1: USB disconnect, device number 7
[  499.982364][T12331] bridge0: port 1(bridge_slave_0) entered blocking state
[  499.989760][T12331] bridge0: port 1(bridge_slave_0) entered disabled state
[  500.000418][T12331] device bridge_slave_0 entered promiscuous mode
[  500.015026][T12331] bridge0: port 2(bridge_slave_1) entered blocking state
[  500.023159][T12331] bridge0: port 2(bridge_slave_1) entered disabled state
[  500.033025][T12331] device bridge_slave_1 entered promiscuous mode
[  500.111553][T12331] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  500.126479][T12331] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  500.196030][T12331] team0: Port device team_slave_0 added
[  500.235187][T12331] team0: Port device team_slave_1 added
[  500.273752][T12331] batman_adv: batadv0: Adding interface: batadv_slave_0
[  500.281006][T12331] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  500.307372][T12331] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  500.332829][T12331] batman_adv: batadv0: Adding interface: batadv_slave_1
[  500.340561][T12331] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  500.366699][T12331] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  500.448432][T12331] device hsr_slave_0 entered promiscuous mode
[  500.459622][T12331] device hsr_slave_1 entered promiscuous mode
[  500.469749][T12331] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  500.477471][T12331] Cannot create hsr debugfs directory
[  500.851368][T12331] netdevsim netdevsim5 netdevsim0: renamed from eth0
[  500.870832][T12331] netdevsim netdevsim5 netdevsim1: renamed from eth1
[  500.894416][T12331] netdevsim netdevsim5 netdevsim2: renamed from eth2
[  501.005085][T12331] netdevsim netdevsim5 netdevsim3: renamed from eth3
[  501.345098][T12331] 8021q: adding VLAN 0 to HW filter on device bond0
[  501.386410][T11332] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  501.396739][T11332] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  501.423046][T12331] 8021q: adding VLAN 0 to HW filter on device team0
[  501.455464][T11332] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  501.467129][T11332] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  501.476978][T11332] bridge0: port 1(bridge_slave_0) entered blocking state
[  501.484348][T11332] bridge0: port 1(bridge_slave_0) entered forwarding state
[  501.495835][T11332] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  501.544148][T11332] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  501.554540][T11332] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  501.564262][T11332] bridge0: port 2(bridge_slave_1) entered blocking state
[  501.571601][T11332] bridge0: port 2(bridge_slave_1) entered forwarding state
[  501.589509][T11332] Bluetooth: hci5: command 0x041b tx timeout
[  501.608557][   T28] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  501.635277][T11332] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  501.660596][ T9069] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  501.670925][ T9069] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  501.692503][ T9069] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  501.709420][ T8724] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  501.720547][ T8724] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  501.750792][T12262] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  501.760998][T12262] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  501.788315][ T9069] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  501.797886][ T9069] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  501.811023][T12331] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  501.859699][ T9069] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[  501.867282][ T9069] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[  501.903247][T12331] 8021q: adding VLAN 0 to HW filter on device batadv0
[  502.062984][ T9069] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[  502.073499][ T9069] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[  502.128807][ T9069] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[  502.139053][ T9069] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[  502.160075][T12331] device veth0_vlan entered promiscuous mode
[  502.169304][ T9069] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[  502.179292][ T9069] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[  502.215650][T12331] device veth1_vlan entered promiscuous mode
[  502.282584][T12262] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[  502.294192][T12262] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[  502.304238][T12262] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[  502.314668][T12262] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[  502.336428][T12331] device veth0_macvtap entered promiscuous mode
[  502.355040][T12331] device veth1_macvtap entered promiscuous mode
[  502.414287][T12331] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[  502.424976][T12331] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  502.435181][T12331] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[  502.446273][T12331] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  502.457173][T12331] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[  502.467785][T12331] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  502.477932][T12331] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[  502.488568][T12331] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  502.498611][T12331] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[  502.509250][T12331] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  502.522305][T12331] batman_adv: batadv0: Interface activated: batadv_slave_0
[  502.531110][ T9069] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[  502.541156][ T9069] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[  502.550540][ T9069] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[  502.560938][ T9069] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[  502.589113][T12331] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[  502.600431][T12331] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  502.610497][T12331] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[  502.621040][T12331] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  502.631436][T12331] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[  502.642044][T12331] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  502.652097][T12331] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[  502.662757][T12331] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  502.672824][T12331] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[  502.683446][T12331] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  502.696688][T12331] batman_adv: batadv0: Interface activated: batadv_slave_1
[  502.714810][ T8724] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[  502.725530][ T8724] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[  503.209601][T12590] IPVS: ftp: loaded support on port[0] = 21
05:00:20 executing program 5:
syz_usb_connect(0x0, 0x36, &(0x7f0000000300)=ANY=[@ANYBLOB="12010000f1b7df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x4a401, 0x0)

05:00:20 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:00:20 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x30, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x30}}, 0x24000000)

05:00:20 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:00:20 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xe, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:00:20 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x6}}, {[{}], {{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

[  503.649240][ T9069] Bluetooth: hci5: command 0x040f tx timeout
[  503.924088][T12617] overlayfs: conflicting lowerdir path
[  503.982972][T12621] overlayfs: conflicting lowerdir path
05:00:21 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  504.080051][T12623] IPVS: ftp: loaded support on port[0] = 21
05:00:21 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  504.203672][ T8724] usb 2-1: new low-speed USB device number 8 using dummy_hcd
05:00:21 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x10, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  504.610272][ T8724] usb 2-1: No LPM exit latency info found, disabling LPM.
[  504.710492][ T8724] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10
[  504.721861][ T8724] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  504.731929][ T8724] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 is Bulk; changing to Interrupt
[  504.742074][ T8724] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 is Bulk; changing to Interrupt
[  504.824572][ T9069] usb 6-1: new high-speed USB device number 2 using dummy_hcd
05:00:22 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  505.077809][ T9069] usb 6-1: Using ep0 maxpacket: 8
05:00:22 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  505.199755][ T9069] usb 6-1: config 0 has an invalid interface number: 2 but max is 0
[  505.208100][ T9069] usb 6-1: config 0 has no interface number 0
[  505.214368][ T9069] usb 6-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024
[  505.225878][ T9069] usb 6-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024
[  505.236061][ T9069] usb 6-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8
[  505.246118][ T9069] usb 6-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5
[  505.255420][ T9069] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
05:00:22 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  505.310354][ T8724] usb 2-1: string descriptor 0 read error: -22
[  505.317005][ T8724] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  505.326344][ T8724] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  505.502638][T12624] raw-gadget gadget: fail, usb_ep_enable returned -22
[  505.536848][T12624] raw-gadget gadget: fail, usb_ep_enable returned -22
[  505.621284][ T8724] cdc_ether: probe of 2-1:1.0 failed with error -22
[  505.666550][T12663] overlayfs: conflicting lowerdir path
[  505.705532][ T9069] usb 6-1: config 0 descriptor??
[  505.732891][T12628] raw-gadget gadget: fail, usb_ep_enable returned -22
[  505.740638][ T8722] Bluetooth: hci5: command 0x0419 tx timeout
[  505.802593][T12628] raw-gadget gadget: fail, usb_ep_enable returned -22
[  505.876006][T12663] overlayfs: conflicting lowerdir path
[  506.013459][T12670] IPVS: ftp: loaded support on port[0] = 21
[  506.088767][T12255] usb 2-1: USB disconnect, device number 8
[  506.331253][ T9069] usb 6-1: USB disconnect, device number 2
[  506.831413][ T9466] tipc: TX() has been purged, node left!
[  507.258075][ T9069] usb 6-1: new high-speed USB device number 3 using dummy_hcd
[  507.497834][ T9069] usb 6-1: Using ep0 maxpacket: 8
[  507.618780][ T9069] usb 6-1: config 0 has an invalid interface number: 2 but max is 0
[  507.626944][ T9069] usb 6-1: config 0 has no interface number 0
[  507.633446][ T9069] usb 6-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024
[  507.644823][ T9069] usb 6-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024
[  507.656731][ T9069] usb 6-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8
[  507.666758][ T9069] usb 6-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5
[  507.679342][ T9069] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  507.756377][ T9069] usb 6-1: config 0 descriptor??
[  507.791848][T12628] raw-gadget gadget: fail, usb_ep_enable returned -22
[  507.822407][T12628] raw-gadget gadget: fail, usb_ep_enable returned -22
05:00:25 executing program 5:
syz_usb_connect(0x0, 0x36, &(0x7f0000000300)=ANY=[@ANYBLOB="12010000f1b7df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x4a401, 0x0)

05:00:25 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:00:25 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:00:25 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x11, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:00:25 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x6}}, {[{}], {{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:00:25 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  507.996754][ T9069] usb 6-1: USB disconnect, device number 3
[  508.321334][T12763] overlayfs: conflicting lowerdir path
[  508.403718][T12771] overlayfs: conflicting lowerdir path
[  508.476910][T12764] IPVS: ftp: loaded support on port[0] = 21
05:00:25 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x0)

[  508.568401][ T8722] usb 2-1: new low-speed USB device number 9 using dummy_hcd
05:00:26 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  508.931560][ T8722] usb 2-1: No LPM exit latency info found, disabling LPM.
[  509.021910][ T8722] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10
[  509.033322][ T8722] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  509.043413][ T8722] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 is Bulk; changing to Interrupt
[  509.053575][ T8722] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 is Bulk; changing to Interrupt
05:00:26 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x12, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:00:26 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  509.409793][T12263] usb 6-1: new high-speed USB device number 4 using dummy_hcd
[  509.561827][T12804] IPVS: ftp: loaded support on port[0] = 21
05:00:26 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x0)

[  509.618097][ T8722] usb 2-1: string descriptor 0 read error: -22
[  509.624673][ T8722] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  509.634140][ T8722] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  509.658311][T12263] usb 6-1: Using ep0 maxpacket: 8
05:00:26 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  509.772747][T12769] raw-gadget gadget: fail, usb_ep_enable returned -22
[  509.781062][T12263] usb 6-1: config 0 has an invalid interface number: 2 but max is 0
[  509.789405][T12263] usb 6-1: config 0 has no interface number 0
[  509.795760][T12263] usb 6-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024
[  509.807036][T12263] usb 6-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024
[  509.817202][T12263] usb 6-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8
[  509.827223][T12263] usb 6-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5
[  509.836474][T12263] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  509.864184][T12769] raw-gadget gadget: fail, usb_ep_enable returned -22
[  509.911491][ T8722] cdc_ether: probe of 2-1:1.0 failed with error -22
[  510.029694][T12809] overlayfs: conflicting lowerdir path
[  510.137138][T12810] overlayfs: conflicting lowerdir path
[  510.191780][T12263] usb 6-1: config 0 descriptor??
[  510.209430][T12797] raw-gadget gadget: fail, usb_ep_enable returned -22
[  510.211233][ T8722] usb 2-1: USB disconnect, device number 9
[  510.216719][T12797] raw-gadget gadget: fail, usb_ep_enable returned -22
[  510.768523][ T9067] tipc: TX() has been purged, node left!
[  510.778623][T12263] usb 6-1: USB disconnect, device number 4
05:00:28 executing program 5:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000640)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c)
sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0)

05:00:28 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x13, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:00:28 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x0)

05:00:28 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300"], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:00:28 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:00:28 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x6}}, {[{}], {{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

[  511.912921][T12880] IPVS: ftp: loaded support on port[0] = 21
[  511.932516][T12883] overlayfs: conflicting lowerdir path
[  512.118198][T12261] usb 2-1: new low-speed USB device number 10 using dummy_hcd
[  512.317433][T12879] overlayfs: conflicting lowerdir path
05:00:29 executing program 3:
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f0000000480)={'filter\x00', 0x10, 0x4, 0x418, 0x0, 0xf0, 0x0, 0x330, 0x330, 0x330, 0x4, 0x0, {[{{@uncond=[0x1d], 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x130}, @unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "60f744eed86ae13015064177b5414a6d3de279f4065f8f373a1916a8259f96bdf94646de2f1b57042f1147e056cdf0a6b0768f5bce2a3a310526b11cb99b090b"}}}, {{@arp={@local, @remote, 0x0, 0x0, 0x0, 0x0, {}, {@mac=@local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'netdevsim0\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@local, @mac=@random="ff4d5def0197", @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x468)

05:00:29 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x22, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:00:29 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300"], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  512.555473][T12261] usb 2-1: No LPM exit latency info found, disabling LPM.
05:00:29 executing program 5:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={<r0=>0xffffffffffffffff})
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r2 = socket$inet_udplite(0x2, 0x2, 0x88)
setsockopt$IPT_SO_SET_REPLACE(r2, 0x8001000000000000, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x250, 0xd0, 0x0, 0x148, 0xd0, 0x0, 0x1b8, 0x2a8, 0x2a8, 0x1b8, 0x2a8, 0x3, 0x0, {[{{@ip={@dev, @multicast2, 0x0, 0x0, 'bridge_slave_0\x00', 'veth0_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00'}}, {{@uncond, 0x0, 0xc0, 0xe8, 0x0, {}, [@common=@unspec=@addrtype1={{0x28, 'addrtype\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x2b0)

[  512.665398][T12261] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10
[  512.676688][T12261] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  512.687384][T12261] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 is Bulk; changing to Interrupt
[  512.698816][T12261] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 is Bulk; changing to Interrupt
05:00:29 executing program 3:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{{0x9, 0x5, 0x81, 0x3, 0x8}}], {}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:00:30 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(0xffffffffffffffff, 0x0, 0x0)
r1 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r2 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r2, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  513.109036][T12261] usb 2-1: string descriptor 0 read error: -22
[  513.115623][T12261] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  513.125167][T12261] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
05:00:30 executing program 5:

05:00:30 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300"], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  513.248192][T11332] Bluetooth: hci2: command 0x0406 tx timeout
[  513.312311][T12882] raw-gadget gadget: fail, usb_ep_enable returned -22
[  513.345695][T12882] raw-gadget gadget: fail, usb_ep_enable returned -22
[  513.407200][T12928] overlayfs: conflicting lowerdir path
[  513.451613][T12261] cdc_ether: probe of 2-1:1.0 failed with error -22
[  513.544329][T12930] overlayfs: conflicting lowerdir path
[  513.654341][T12935] IPVS: ftp: loaded support on port[0] = 21
[  513.713593][T12263] usb 4-1: new low-speed USB device number 2 using dummy_hcd
[  513.786795][ T8724] usb 2-1: USB disconnect, device number 10
05:00:31 executing program 5:

05:00:31 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x24, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  514.292967][T12263] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 0
05:00:31 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  514.589143][T12263] usb 4-1: string descriptor 0 read error: -22
[  514.595727][T12263] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  514.605193][T12263] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  514.666021][T12967] overlayfs: conflicting lowerdir path
05:00:31 executing program 1:

05:00:32 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(0xffffffffffffffff, 0x0, 0x0)
r1 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r2 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r2, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  514.773141][T12926] raw-gadget gadget: fail, usb_ep_enable returned -22
[  514.784669][T12969] overlayfs: conflicting lowerdir path
[  514.804066][T12263] cdc_ether: probe of 4-1:1.0 failed with error -22
05:00:32 executing program 5:

[  515.028982][ T8724] usb 4-1: USB disconnect, device number 2
05:00:32 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x25, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:00:32 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  515.203611][ T9067] tipc: TX() has been purged, node left!
[  515.269559][ T9067] tipc: TX() has been purged, node left!
[  515.448679][T12983] IPVS: ftp: loaded support on port[0] = 21
[  516.081068][T12999] overlayfs: conflicting lowerdir path
[  516.162447][T12261] usb 4-1: new low-speed USB device number 3 using dummy_hcd
05:00:33 executing program 3:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{{0x9, 0x5, 0x81, 0x3, 0x8}}], {}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:00:33 executing program 5:

05:00:33 executing program 1:

05:00:33 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x2c, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:00:33 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  516.647592][T12261] usb 4-1: unable to read config index 0 descriptor/start: -71
[  516.655430][T12261] usb 4-1: can't read configurations, error -71
[  516.885267][T13031] overlayfs: conflicting lowerdir path
05:00:34 executing program 1:

05:00:34 executing program 5:

05:00:34 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  517.387323][T12261] usb 4-1: new low-speed USB device number 4 using dummy_hcd
[  517.558821][T13045] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[  517.758685][T12261] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 0
[  518.055367][T12261] usb 4-1: string descriptor 0 read error: -22
[  518.062306][T12261] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  518.071760][T12261] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  518.151815][T13040] raw-gadget gadget: fail, usb_ep_enable returned -22
[  518.191215][T12261] cdc_ether: probe of 4-1:1.0 failed with error -22
[  518.464534][T12261] usb 4-1: USB disconnect, device number 4
05:00:35 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(0xffffffffffffffff, 0x0, 0x0)
r1 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r2 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r2, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:00:35 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x2f, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:00:35 executing program 1:
syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x6}}, {[{}], {{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:00:35 executing program 5:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={<r0=>0xffffffffffffffff})
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r2 = socket$inet_udplite(0x2, 0x2, 0x88)
setsockopt$IPT_SO_SET_REPLACE(r2, 0x8001000000000000, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x250, 0xd0, 0x0, 0x148, 0xd0, 0x0, 0x1b8, 0x2a8, 0x2a8, 0x1b8, 0x2a8, 0x3, 0x0, {[{{@ip={@dev, @multicast2, 0x0, 0x0, 'bridge_slave_0\x00', 'veth0_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0xffffffffffffffff}, {0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x6800]}}}}, {{@uncond, 0x0, 0xc0, 0xe8, 0x0, {}, [@common=@unspec=@addrtype1={{0x28, 'addrtype\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x2b0)

[  518.964235][T13059] overlayfs: conflicting lowerdir path
[  519.040855][T13059] overlayfs: conflicting lowerdir path
[  519.230061][ T8721] usb 2-1: new high-speed USB device number 11 using dummy_hcd
[  519.259419][T13070] IPVS: ftp: loaded support on port[0] = 21
05:00:36 executing program 3:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{{0x9, 0x5, 0x81, 0x3, 0x8}}], {}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:00:36 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:00:36 executing program 5:

05:00:36 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x30, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  519.477311][ T8721] usb 2-1: Using ep0 maxpacket: 8
[  519.530304][T13074] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[  519.677747][ T8721] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  519.689250][ T8721] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  519.699343][ T8721] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64
05:00:37 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:00:37 executing program 5:

[  520.177034][ T8721] usb 2-1: string descriptor 0 read error: -22
[  520.183778][ T8721] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  520.193268][ T8721] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  520.277296][T12255] usb 4-1: new low-speed USB device number 5 using dummy_hcd
[  520.362478][T13063] raw-gadget gadget: fail, usb_ep_enable returned -22
[  520.502270][T13095] overlayfs: conflicting lowerdir path
[  520.550679][    T7] tipc: TX() has been purged, node left!
[  520.634914][T13103] overlayfs: conflicting lowerdir path
[  520.641749][ T8721] cdc_ether: probe of 2-1:1.0 failed with error -71
[  520.658564][T12255] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 0
[  520.692894][ T8721] usb 2-1: USB disconnect, device number 11
[  520.798030][T13111] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
05:00:38 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  520.929949][T12255] usb 4-1: string descriptor 0 read error: -22
[  520.936743][T12255] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  520.945931][T12255] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
05:00:38 executing program 5:

05:00:38 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x3a, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:00:38 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB, @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  521.121226][T13085] raw-gadget gadget: fail, usb_ep_enable returned -22
[  521.239904][T12255] cdc_ether: probe of 4-1:1.0 failed with error -22
05:00:38 executing program 1:
syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x6}}, {[{}], {{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

[  521.555822][T13121] IPVS: ftp: loaded support on port[0] = 21
[  521.690586][   T28] usb 4-1: USB disconnect, device number 5
[  521.945273][T13124] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[  522.001585][T13140] overlayfs: conflicting lowerdir path
05:00:39 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB, @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  522.268320][T13141] overlayfs: conflicting lowerdir path
05:00:39 executing program 3:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{{0x9, 0x5, 0x81, 0x3, 0x8}}], {}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:00:39 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:00:39 executing program 5:

05:00:39 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x48, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  522.720026][T13163] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[  522.741609][   T28] usb 2-1: new high-speed USB device number 12 using dummy_hcd
[  522.895562][T13162] IPVS: ftp: loaded support on port[0] = 21
05:00:40 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB, @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  523.556931][   T28] usb 2-1: Using ep0 maxpacket: 8
05:00:40 executing program 5:

05:00:40 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  523.766418][   T28] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  523.777849][   T28] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  523.787940][   T28] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64
[  523.830121][T13192] overlayfs: conflicting lowerdir path
[  523.836834][ T8722] usb 4-1: new low-speed USB device number 6 using dummy_hcd
[  523.926366][T13194] overlayfs: conflicting lowerdir path
[  524.011630][T13198] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[  524.120061][   T28] usb 2-1: string descriptor 0 read error: -22
[  524.127798][   T28] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  524.137140][   T28] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
05:00:41 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x4c, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  524.207431][ T8722] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 0
[  524.321211][T13158] raw-gadget gadget: fail, usb_ep_enable returned -22
05:00:41 executing program 5:

[  524.420352][T13201] IPVS: ftp: loaded support on port[0] = 21
05:00:41 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="0300001601000000180012000800", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  524.486946][ T8722] usb 4-1: string descriptor 0 read error: -22
[  524.493583][ T8722] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  524.502948][ T8722] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  524.691120][T13188] raw-gadget gadget: fail, usb_ep_enable returned -22
[  524.749668][ T8722] cdc_ether: probe of 4-1:1.0 failed with error -22
[  524.766471][   T28] cdc_ether: probe of 2-1:1.0 failed with error -71
[  524.820896][   T28] usb 2-1: USB disconnect, device number 12
[  525.113532][T13218] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'.
[  525.199895][T13214] overlayfs: conflicting lowerdir path
[  525.269224][ T8721] usb 4-1: USB disconnect, device number 6
[  525.369367][T13214] overlayfs: conflicting lowerdir path
05:00:42 executing program 1:
syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x6}}, {[{}], {{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:00:42 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = socket(0x0, 0x0, 0x0)
getsockname$packet(r2, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14)
ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000001c0)={'syztnl2\x00', 0x0})
ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f00000002c0)={0x0, @rc, @in={0x2, 0x0, @multicast1}, @llc={0x1a, 0x204, 0x7, 0x0, 0xc9, 0x5}, 0xfff7, 0x0, 0x0, 0x0, 0x8000, &(0x7f0000000080)='dummy0\x00', 0x4, 0x0, 0x6})
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil})
r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
r4 = bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000000)={@cgroup, r4}, 0x10)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf9, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000200)={[], 0x1f000})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
shmat(0x0, &(0x7f0000000000/0x13000)=nil, 0x4000)

[  525.972698][T13249] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details.
05:00:43 executing program 3:
syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{{0x9, 0x5, 0x81, 0x3, 0x8}}], {}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:00:43 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="0300001601000000180012000800", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:00:43 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x5c, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:00:43 executing program 0:
socket$alg(0x26, 0x5, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r0, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r0, 0x0, 0x0)
r1 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r2 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r2, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  526.230076][T13261] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'.
[  526.389774][    T7] tipc: TX() has been purged, node left!
[  526.415631][ T8722] usb 2-1: new high-speed USB device number 13 using dummy_hcd
[  526.439489][T13264] overlayfs: conflicting lowerdir path
[  526.474375][T13262] IPVS: ftp: loaded support on port[0] = 21
[  526.715375][ T8722] usb 2-1: Using ep0 maxpacket: 8
[  526.766127][T13269] overlayfs: conflicting lowerdir path
[  526.917416][ T8722] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  526.928640][ T8722] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  526.939279][ T8722] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64
05:00:44 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="0300001601000000180012000800", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:00:44 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = syz_open_procfs(0x0, &(0x7f0000000040))
fcntl$notify(r2, 0x402, 0xb1c661d318500c73)
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='sessionid\x00')
dup3(r3, r2, 0x0)

05:00:44 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x68, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  527.365895][ T8721] usb 4-1: new high-speed USB device number 7 using dummy_hcd
[  527.416142][ T8722] usb 2-1: string descriptor 0 read error: -22
[  527.422937][ T8722] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  527.432350][ T8722] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  527.550892][T13257] raw-gadget gadget: fail, usb_ep_enable returned -22
[  527.605559][ T8721] usb 4-1: Using ep0 maxpacket: 8
[  527.652018][T13301] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'.
05:00:44 executing program 0:
socket$alg(0x26, 0x5, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r0, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r0, 0x0, 0x0)
r1 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r2 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r2, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  527.726737][ T8721] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 0
[  527.846162][ T8722] cdc_ether: probe of 2-1:1.0 failed with error -71
[  527.944039][ T8722] usb 2-1: USB disconnect, device number 13
[  528.006574][ T8721] usb 4-1: string descriptor 0 read error: -22
[  528.013156][ T8721] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  528.023164][ T8721] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
05:00:45 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  528.100969][T13313] overlayfs: conflicting lowerdir path
[  528.171277][T13283] raw-gadget gadget: fail, usb_ep_enable returned -22
05:00:45 executing program 5:
perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x7f, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
creat(&(0x7f0000000280)='./file0\x00', 0x0)
r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0)
r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0)
linkat(r0, &(0x7f0000000000)='./file0\x00', r1, &(0x7f0000000080)='./file1\x00', 0x0)

[  528.222631][T13316] overlayfs: conflicting lowerdir path
[  528.250375][ T8721] cdc_ether: probe of 4-1:1.0 failed with error -22
[  528.429846][T13320] IPVS: ftp: loaded support on port[0] = 21
[  528.473571][ T8721] usb 4-1: USB disconnect, device number 7
05:00:45 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x0, 0x0, &(0x7f0000000480)={0x0, 0x0, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:00:45 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x6c, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  528.726914][T13328] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'.
05:00:46 executing program 3:
syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{{0x9, 0x5, 0x81, 0x3, 0x8}}], {}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:00:46 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:00:46 executing program 5:
perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x7f, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
creat(&(0x7f0000000280)='./file0\x00', 0x1)
r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0)
r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0)
linkat(r0, &(0x7f0000000000)='./file0\x00', r1, &(0x7f0000000080)='./file1\x00', 0x0)

[  529.542204][T13358] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'.
05:00:46 executing program 0:
socket$alg(0x26, 0x5, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r0, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r0, 0x0, 0x0)
r1 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r2 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r2, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  529.712613][T13359] overlayfs: conflicting lowerdir path
05:00:47 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x0, 0x0, &(0x7f0000000480)={0x0, 0x0, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

[  529.827167][T13361] overlayfs: conflicting lowerdir path
05:00:47 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:00:47 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x74, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  530.215696][T12263] usb 4-1: new high-speed USB device number 8 using dummy_hcd
[  530.318046][T13372] IPVS: ftp: loaded support on port[0] = 21
[  530.474873][T12263] usb 4-1: Using ep0 maxpacket: 8
[  530.616323][T12263] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 0
05:00:48 executing program 5:

[  530.922071][T13397] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'.
[  530.955986][T12263] usb 4-1: string descriptor 0 read error: -22
[  530.962563][T12263] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  530.971986][T12263] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
05:00:48 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  531.079686][T13364] raw-gadget gadget: fail, usb_ep_enable returned -22
05:00:48 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x0, 0x0, &(0x7f0000000480)={0x0, 0x0, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

[  531.138584][T12263] cdc_ether: probe of 4-1:1.0 failed with error -22
[  531.379775][ T8721] usb 4-1: USB disconnect, device number 8
05:00:48 executing program 0:
bind$alg(0xffffffffffffffff, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r0, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r0, 0x0, 0x0)
r1 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r2 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r2, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  531.480607][T13406] overlayfs: conflicting lowerdir path
[  531.598356][T13413] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.2'.
[  531.637918][T13403] overlayfs: conflicting lowerdir path
05:00:48 executing program 5:

[  531.747021][    T7] tipc: TX() has been purged, node left!
05:00:49 executing program 3:
syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{{0x9, 0x5, 0x81, 0x3, 0x8}}], {}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:00:49 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x7a, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:00:49 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  532.245112][T13417] IPVS: ftp: loaded support on port[0] = 21
05:00:49 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x6}}, {[{}], {{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

[  532.417721][T13421] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.2'.
[  532.904901][   T28] usb 4-1: new high-speed USB device number 9 using dummy_hcd
05:00:50 executing program 5:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=@newlink={0x58, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_VFINFO_LIST={0x30, 0x16, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, [@IFLA_VF_MAC={0x28, 0x1, {0x0, @broadcast}}]}]}, @IFLA_GROUP={0x8}]}, 0x58}}, 0x0)

05:00:50 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  533.128565][T13446] overlayfs: conflicting lowerdir path
[  533.154634][   T28] usb 4-1: Using ep0 maxpacket: 8
[  533.295861][   T28] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 0
[  533.334543][ T8722] usb 2-1: new low-speed USB device number 14 using dummy_hcd
05:00:50 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xa1, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  533.444534][T13456] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.2'.
05:00:50 executing program 0:
bind$alg(0xffffffffffffffff, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r0, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r0, 0x0, 0x0)
r1 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r2 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r2, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  533.580490][T13458] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  533.609187][   T28] usb 4-1: string descriptor 0 read error: -22
[  533.615876][   T28] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  533.625347][   T28] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  533.697003][ T8722] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10
[  533.708520][ T8722] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  533.718636][ T8722] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 is Bulk; changing to Interrupt
[  533.728810][ T8722] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 is Bulk; changing to Interrupt
05:00:50 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c000200080003", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  533.748974][T13424] raw-gadget gadget: fail, usb_ep_enable returned -22
[  533.817964][   T28] cdc_ether: probe of 4-1:1.0 failed with error -22
05:00:51 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = eventfd(0x0)
ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x2})
ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000080)={0x0, 0x0, 0x4, r2, 0x7})

[  534.109008][   T28] usb 4-1: USB disconnect, device number 9
[  534.165036][ T8722] usb 2-1: string descriptor 0 read error: -22
[  534.171629][ T8722] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  534.181006][ T8722] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  534.388253][T13447] raw-gadget gadget: fail, usb_ep_enable returned -22
[  534.445048][T13447] raw-gadget gadget: fail, usb_ep_enable returned -22
[  534.487737][ T8722] cdc_ether: probe of 2-1:1.0 failed with error -22
05:00:51 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c000200080003", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  534.691990][   T28] usb 2-1: USB disconnect, device number 14
05:00:52 executing program 3:
syz_usb_connect$cdc_ecm(0x1, 0x0, 0x0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

[  534.850929][T13466] IPVS: ftp: loaded support on port[0] = 21
[  534.903061][T13468] overlayfs: conflicting lowerdir path
[  535.046170][T13470] overlayfs: conflicting lowerdir path
05:00:52 executing program 5:
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000280)="6653070000053c27bc3376003639405cb4aed12f0000001500ae47a825d86800278dcff47d010000805acf4f8f36460234432479aed75d492b415bcee00a06dc9d8e99adaf81dcfc6afd983f79e65199615607676f8f9fc0ebf8b0b16d6f2c59957ab364884b3c5d05692e664ebf68e6faa53367f05f4ad6142134b62f11e931e7d62ead037cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f480800b1ed19bca008388e736e518b98d91c22def1125d7b1e821039a9f3e0b5556a985900"/242, 0xf2}], 0x4, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
tkill(r0, 0x3d)
write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0xb2)
ptrace$cont(0x18, r0, 0x0, 0x0)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x1f, r0, 0x0, 0x0)

05:00:52 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x155, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:00:52 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x6}}, {[{}], {{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:00:52 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c000200080003", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:00:52 executing program 5:
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
r3 = dup(r2)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
writev(r1, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1)
write$binfmt_elf64(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="edbb39cf1a45d347bd011edbf6cba4f79b1994b3b7f7"], 0x16)
r4 = socket$netlink(0x10, 0x3, 0x4)
write$binfmt_misc(r1, &(0x7f0000000240)=ANY=[], 0xfef0)
splice(r0, 0x0, r4, 0x0, 0x80000001, 0x0)

[  535.731842][T13519] ptrace attach of "/root/syz-executor.5"[13518] was attempted by "/root/syz-executor.5"[13519]
05:00:53 executing program 0:
bind$alg(0xffffffffffffffff, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r0, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r0, 0x0, 0x0)
r1 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r2 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r2, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  535.916141][T13522] overlayfs: conflicting lowerdir path
05:00:53 executing program 3:
syz_usb_connect$cdc_ecm(0x1, 0x0, 0x0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

[  536.072471][T13526] overlayfs: conflicting lowerdir path
05:00:53 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  536.294632][ T8722] usb 2-1: new low-speed USB device number 15 using dummy_hcd
05:00:53 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x2aa, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  536.563196][    T7] tipc: TX() has been purged, node left!
[  536.590941][    T7] tipc: TX() has been purged, node left!
[  536.654653][ T8722] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10
[  536.666049][ T8722] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  536.676495][ T8722] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 is Bulk; changing to Interrupt
[  536.686986][ T8722] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 is Bulk; changing to Interrupt
05:00:54 executing program 5:
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="6653070000053c27bc3376003239405cb4ae24f12f0000001500ae47a825", 0x1e}], 0x4, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
tkill(r0, 0x3d)
ptrace$cont(0x18, r0, 0x0, 0x0)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x20, r0, 0x0, 0x0)

[  536.910760][T13541] IPVS: ftp: loaded support on port[0] = 21
[  536.948108][T13543] overlayfs: conflicting lowerdir path
[  536.974804][T13539] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'.
[  537.122976][T13543] overlayfs: conflicting lowerdir path
[  537.343897][T13550] ptrace attach of "/root/syz-executor.5"[13549] was attempted by "/root/syz-executor.5"[13550]
05:00:54 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x3a]}}}, 0x33}], [], 0x2f})

05:00:54 executing program 3:
syz_usb_connect$cdc_ecm(0x1, 0x0, 0x0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

[  537.594105][ T8722] usb 2-1: string descriptor 0 read error: -22
[  537.600699][ T8722] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  537.610438][ T8722] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
05:00:54 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:00:54 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x300, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  537.668974][T13527] raw-gadget gadget: fail, usb_ep_enable returned -22
[  537.694404][T13527] raw-gadget gadget: fail, usb_ep_enable returned -22
[  537.707693][ T8722] cdc_ether: probe of 2-1:1.0 failed with error -22
[  537.951793][   T28] usb 2-1: USB disconnect, device number 15
[  538.115764][T13583] tmpfs: Bad value for 'mpol'
[  538.172331][T13585] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'.
[  538.233303][T13583] tmpfs: Bad value for 'mpol'
[  538.319202][T13590] overlayfs: conflicting lowerdir path
[  538.407380][T13590] overlayfs: conflicting lowerdir path
05:00:55 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x6}}, {[{}], {{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:00:55 executing program 0:
socket$alg(0x26, 0x5, 0x0)
bind$alg(0xffffffffffffffff, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r0, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r0, 0x0, 0x0)
r1 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r2 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r2, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:00:55 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:00:55 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x3a]}}}, 0x33}], [], 0x2f})

05:00:55 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x408, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:00:55 executing program 3:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{{0x9, 0x5, 0x81, 0x3, 0x8}}], {}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

[  539.098096][T13595] IPVS: ftp: loaded support on port[0] = 21
[  539.141744][T13600] tmpfs: Bad value for 'mpol'
[  539.178087][T13601] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'.
05:00:56 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:00:56 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x3a]}}}, 0x33}], [], 0x2f})

[  539.654017][T12261] usb 2-1: new low-speed USB device number 16 using dummy_hcd
[  539.755523][ T8724] usb 4-1: new low-speed USB device number 10 using dummy_hcd
[  539.813594][T13612] overlayfs: conflicting lowerdir path
[  539.843398][T13618] overlayfs: conflicting lowerdir path
[  540.076220][ T8724] usb 4-1: device descriptor read/64, error 18
05:00:57 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x480, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  540.130043][T12261] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10
[  540.141694][T12261] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  540.151809][T12261] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 is Bulk; changing to Interrupt
[  540.162038][T12261] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 is Bulk; changing to Interrupt
[  540.204226][T13640] tmpfs: Bad value for 'mpol'
05:00:57 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:00:57 executing program 0:
socket$alg(0x26, 0x5, 0x0)
bind$alg(0xffffffffffffffff, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r0, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r0, 0x0, 0x0)
r1 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r2 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r2, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  540.484008][ T8724] usb 4-1: device descriptor read/64, error 18
05:00:57 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x3a]}}}, 0x33}], [], 0x2f})

[  540.615587][T12261] usb 2-1: string descriptor 0 read error: -22
[  540.622461][T12261] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  540.631764][T12261] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  540.783182][ T8724] usb 4-1: new low-speed USB device number 11 using dummy_hcd
[  540.796897][T13605] raw-gadget gadget: fail, usb_ep_enable returned -22
[  540.835476][T13605] raw-gadget gadget: fail, usb_ep_enable returned -22
[  540.897618][T12261] cdc_ether: probe of 2-1:1.0 failed with error -22
[  541.044317][T13649] overlayfs: conflicting lowerdir path
[  541.076675][ T8724] usb 4-1: device descriptor read/64, error 18
[  541.099531][ T8722] usb 2-1: USB disconnect, device number 16
[  541.219561][T13652] IPVS: ftp: loaded support on port[0] = 21
[  541.326027][T13653] overlayfs: conflicting lowerdir path
05:00:59 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x0, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x6}}, {[{}], {{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:00:59 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:00:59 executing program 0:
socket$alg(0x26, 0x5, 0x0)
bind$alg(0xffffffffffffffff, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r0, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r0, 0x0, 0x0)
r1 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r2 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r2, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  541.854075][T13666] tmpfs: Bad value for 'mpol'
[  542.023541][ T8724] usb 4-1: device descriptor read/64, error 18
05:00:59 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x4f5, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:00:59 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  542.143761][ T8724] usb usb4-port1: attempt power cycle
[  542.495130][T13691] IPVS: ftp: loaded support on port[0] = 21
[  542.523865][T12255] usb 2-1: new low-speed USB device number 17 using dummy_hcd
05:00:59 executing program 3:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{{0x9, 0x5, 0x81, 0x3, 0x8}}], {}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:00:59 executing program 5:
syz_mount_image$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x3a]}}}, 0x33}], [], 0x2f})

[  542.802700][T12255] usb 2-1: device descriptor read/64, error 18
[  543.002615][T13703] overlayfs: conflicting lowerdir path
05:01:00 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  543.088810][T13705] overlayfs: conflicting lowerdir path
[  543.193518][T12255] usb 2-1: device descriptor read/64, error 18
05:01:00 executing program 5:
syz_mount_image$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x3a]}}}, 0x33}], [], 0x2f})

05:01:00 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, 0x0, 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:01:00 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x500, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  543.464028][T12255] usb 2-1: new low-speed USB device number 18 using dummy_hcd
05:01:00 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  543.732767][T12255] usb 2-1: device descriptor read/64, error 18
[  543.762846][ T8724] usb 4-1: new low-speed USB device number 12 using dummy_hcd
[  543.853041][ T8724] usb 4-1: Invalid ep0 maxpacket: 0
[  543.962892][T11331] Bluetooth: hci3: command 0x0406 tx timeout
[  544.012804][ T8724] usb 4-1: new low-speed USB device number 13 using dummy_hcd
[  544.065040][T13732] IPVS: ftp: loaded support on port[0] = 21
[  544.124179][ T8724] usb 4-1: Invalid ep0 maxpacket: 0
[  544.137720][ T8724] usb usb4-port1: unable to enumerate USB device
[  544.149544][    T7] tipc: TX() has been purged, node left!
[  544.195802][T12255] usb 2-1: device descriptor read/64, error 18
[  544.526753][T13737] overlayfs: conflicting lowerdir path
[  544.579933][T12255] usb usb2-port1: attempt power cycle
[  544.632058][    T7] tipc: TX() has been purged, node left!
[  544.778463][T13739] overlayfs: conflicting lowerdir path
[  544.789808][    T7] tipc: TX() has been purged, node left!
05:01:02 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x0, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x6}}, {[{}], {{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:01:02 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:01:02 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, 0x0, 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:01:02 executing program 5:
syz_mount_image$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x3a]}}}, 0x33}], [], 0x2f})

05:01:02 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x600, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  545.490465][T13771] IPVS: ftp: loaded support on port[0] = 21
[  545.736185][T13775] overlayfs: conflicting lowerdir path
[  545.996372][T13777] overlayfs: conflicting lowerdir path
[  546.172332][T12255] usb 2-1: new low-speed USB device number 19 using dummy_hcd
[  546.292309][T12255] usb 2-1: Invalid ep0 maxpacket: 0
[  546.471964][T12255] usb 2-1: new low-speed USB device number 20 using dummy_hcd
05:01:03 executing program 3:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{{0x9, 0x5, 0x81, 0x3, 0x8}}], {}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:01:03 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x3a]}}}, 0x33}], [], 0x2f})

05:01:03 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x700, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:01:03 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  546.574449][T12255] usb 2-1: Invalid ep0 maxpacket: 0
[  546.590164][T12255] usb usb2-port1: unable to enumerate USB device
05:01:04 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, 0x0, 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  547.080013][T13811] overlayfs: conflicting lowerdir path
05:01:04 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x3a]}}}, 0x33}], [], 0x2f})

[  547.209494][T13816] overlayfs: conflicting lowerdir path
05:01:04 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  547.402223][ T8724] usb 4-1: new low-speed USB device number 14 using dummy_hcd
[  547.712060][ T8724] usb 4-1: device descriptor read/64, error 18
[  548.142138][ T8724] usb 4-1: device descriptor read/64, error 18
[  548.453197][ T8724] usb 4-1: new low-speed USB device number 15 using dummy_hcd
[  548.732008][ T8724] usb 4-1: device descriptor read/64, error 18
[  548.744487][T13829] IPVS: ftp: loaded support on port[0] = 21
05:01:06 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x0, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x6}}, {[{}], {{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:01:06 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x804, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:01:06 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="38000000100005070002", @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:01:06 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x3a]}}}, 0x33}], [], 0x2f})

[  549.193034][ T8724] usb 4-1: device descriptor read/64, error 18
[  549.312058][ T8724] usb usb4-port1: attempt power cycle
05:01:06 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x0, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  549.387903][T13857] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[  549.599332][T13858] overlayfs: conflicting lowerdir path
[  549.684300][T13861] overlayfs: conflicting lowerdir path
[  549.836559][T13868] IPVS: ftp: loaded support on port[0] = 21
[  550.111484][ T8724] usb 4-1: new low-speed USB device number 16 using dummy_hcd
[  550.120529][   T28] usb 2-1: new low-speed USB device number 21 using dummy_hcd
05:01:07 executing program 3:
syz_usb_connect$cdc_ecm(0x1, 0x4d, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3b, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[], {}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:01:07 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="38000000100005070002", @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:01:07 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)

05:01:07 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x900, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  550.526716][ T8724] usb 4-1: device descriptor read/8, error -71
[  550.662219][   T28] usb 2-1: device descriptor read/64, error 18
[  550.689262][T13898] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[  550.719792][T13900] overlayfs: failed to resolve './file0/../file0': -2
[  550.753740][ T8724] usb 4-1: device descriptor read/8, error -71
[  550.784328][    T7] tipc: TX() has been purged, node left!
[  550.817146][T13900] overlayfs: conflicting lowerdir path
05:01:08 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)

05:01:08 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x0, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:01:08 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xa00, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  551.080540][   T28] usb 2-1: device descriptor read/64, error 18
[  551.352204][   T28] usb 2-1: new low-speed USB device number 22 using dummy_hcd
[  551.361886][T13911] overlayfs: conflicting lowerdir path
[  551.434416][T13910] IPVS: ftp: loaded support on port[0] = 21
[  551.540882][T13911] overlayfs: conflicting lowerdir path
[  551.561203][ T8724] usb 4-1: new low-speed USB device number 17 using dummy_hcd
[  551.651305][   T28] usb 2-1: device descriptor read/64, error 18
[  551.781405][ T8724] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 0
[  552.053408][   T28] usb 2-1: device descriptor read/64, error 18
[  552.137677][ T8724] usb 4-1: string descriptor 0 read error: -22
[  552.144333][ T8724] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  552.153693][ T8724] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  552.174295][   T28] usb usb2-port1: attempt power cycle
[  552.276757][T13905] raw-gadget gadget: fail, usb_ep_enable returned -22
[  552.315752][ T8724] cdc_ether: probe of 4-1:1.0 failed with error -22
[  552.556906][T12263] usb 4-1: USB disconnect, device number 17
05:01:09 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x6}}, {[{}], {{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:01:09 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="38000000100005070002", @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:01:09 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)

05:01:09 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x0, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:01:09 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xb00, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  552.940128][T13958] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[  553.033782][T13956] IPVS: ftp: loaded support on port[0] = 21
[  553.118863][T13954] overlayfs: failed to resolve './file0/../file0': -2
05:01:10 executing program 3:
syz_usb_connect$cdc_ecm(0x1, 0x4d, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3b, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[], {}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:01:10 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[], [], 0x2f})

05:01:10 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xc00, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:01:10 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="380000001000050700020000000000", @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  553.821632][   T28] usb 2-1: new low-speed USB device number 23 using dummy_hcd
[  554.084194][   T28] usb 2-1: No LPM exit latency info found, disabling LPM.
[  554.127195][T13993] tmpfs: Unknown parameter '/'
[  554.153319][T13994] overlayfs: conflicting lowerdir path
[  554.172084][   T28] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 0
[  554.260964][T12264] usb 4-1: new low-speed USB device number 18 using dummy_hcd
05:01:11 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, 0x0)
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  554.311578][T13998] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[  554.314687][T13997] overlayfs: conflicting lowerdir path
05:01:11 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[], [], 0x2f})

05:01:11 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xd00, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  554.564996][   T28] usb 2-1: string descriptor 0 read error: -22
[  554.572963][   T28] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  554.582595][   T28] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  554.652927][T12264] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 0
[  554.760329][T13963] raw-gadget gadget: fail, usb_ep_enable returned -22
[  554.790725][T13963] raw-gadget gadget: fail, usb_ep_enable returned -22
[  554.814764][   T28] cdc_ether: probe of 2-1:1.0 failed with error -22
[  554.912425][T12264] usb 4-1: string descriptor 0 read error: -22
[  554.919049][T12264] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  554.928533][T12264] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  554.968446][    T7] tipc: TX() has been purged, node left!
[  555.064640][T13990] raw-gadget gadget: fail, usb_ep_enable returned -22
[  555.069310][T14007] IPVS: ftp: loaded support on port[0] = 21
[  555.124824][T12264] cdc_ether: probe of 4-1:1.0 failed with error -22
[  555.157416][T11331] usb 2-1: USB disconnect, device number 23
[  555.215819][T14015] tmpfs: Unknown parameter '/'
[  555.286431][T14019] overlayfs: conflicting lowerdir path
[  555.385512][T12264] usb 4-1: USB disconnect, device number 18
[  555.409280][T14019] overlayfs: conflicting lowerdir path
05:01:13 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x6}}, {[{}], {{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:01:13 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="380000001000050700020000000000", @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:01:13 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xe00, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:01:13 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[], [], 0x2f})

05:01:13 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, 0x0)
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:01:13 executing program 3:
syz_usb_connect$cdc_ecm(0x1, 0x4d, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3b, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[], {}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

[  556.228393][T14051] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[  556.262747][T14055] tmpfs: Unknown parameter '/'
[  556.414391][T14057] IPVS: ftp: loaded support on port[0] = 21
[  556.420397][T14052] overlayfs: conflicting lowerdir path
[  556.578972][T14058] overlayfs: conflicting lowerdir path
05:01:14 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="380000001000050700020000000000", @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:01:14 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38]}}}, 0x33}], [], 0x2f})

05:01:14 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, 0x0)
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:01:14 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x1020, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  557.210817][T11331] usb 4-1: new low-speed USB device number 19 using dummy_hcd
[  557.232164][ T8722] usb 2-1: new low-speed USB device number 24 using dummy_hcd
[  557.298408][T14089] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[  557.448642][T14095] tmpfs: Bad value for 'mpol'
[  557.596759][T14094] IPVS: ftp: loaded support on port[0] = 21
[  557.942068][T14100] overlayfs: conflicting lowerdir path
05:01:15 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="380000001000050700020000000000000000", @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  558.113128][T11331] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 0
[  558.132559][ T8722] usb 2-1: No LPM exit latency info found, disabling LPM.
[  558.201448][T14099] overlayfs: conflicting lowerdir path
[  558.211362][ T8722] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 0
05:01:15 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38]}}}, 0x33}], [], 0x2f})

[  558.362664][T11331] usb 4-1: string descriptor 0 read error: -22
[  558.369252][T11331] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  558.378693][T11331] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  558.504048][T14074] raw-gadget gadget: fail, usb_ep_enable returned -22
[  558.512382][ T8722] usb 2-1: string descriptor 0 read error: -22
[  558.518925][ T8722] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  558.529501][ T8722] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  558.583740][T11331] cdc_ether: probe of 4-1:1.0 failed with error -22
[  558.635072][T14124] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'.
[  558.684567][T14082] raw-gadget gadget: fail, usb_ep_enable returned -22
[  558.725597][T14082] raw-gadget gadget: fail, usb_ep_enable returned -22
[  558.758601][T14130] tmpfs: Bad value for 'mpol'
[  558.792309][T11331] usb 4-1: USB disconnect, device number 19
[  558.843926][ T8722] cdc_ether: probe of 2-1:1.0 failed with error -22
[  559.066736][ T8722] usb 2-1: USB disconnect, device number 24
05:01:16 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x6}}, {[{}], {{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:01:16 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x1100, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:01:16 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="380000001000050700020000000000000000", @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:01:16 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:01:16 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38]}}}, 0x33}], [], 0x2f})

05:01:16 executing program 3:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{}], {}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

[  559.662973][    T7] tipc: TX() has been purged, node left!
[  559.821177][T14153] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'.
[  559.911085][T14157] tmpfs: Bad value for 'mpol'
[  559.949413][T14152] IPVS: ftp: loaded support on port[0] = 21
[  560.096453][T12263] usb 4-1: new low-speed USB device number 20 using dummy_hcd
[  560.138932][T14158] overlayfs: conflicting lowerdir path
[  560.258732][T14162] overlayfs: conflicting lowerdir path
05:01:17 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x0]}}}, 0x33}], [], 0x2f})

05:01:17 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="380000001000050700020000000000000000", @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  560.502431][   T28] usb 2-1: new low-speed USB device number 25 using dummy_hcd
[  560.527552][T12263] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 0
05:01:17 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x1200, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  560.660699][T14173] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'.
[  560.862502][T12263] usb 4-1: string descriptor 0 read error: -22
[  560.869112][T12263] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  560.878487][T12263] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  560.957365][   T28] usb 2-1: No LPM exit latency info found, disabling LPM.
[  561.051845][   T28] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 0
[  561.076591][T14194] tmpfs: Bad value for 'mpol'
05:01:18 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="38000000100005070002000000000000000000", @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:01:18 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  561.097873][T14154] raw-gadget gadget: fail, usb_ep_enable returned -22
[  561.194138][T12263] cdc_ether: probe of 4-1:1.0 failed with error -22
[  561.263413][T14199] overlayfs: conflicting lowerdir path
[  561.390002][   T28] usb 2-1: string descriptor 0 read error: -22
[  561.396598][   T28] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  561.407066][   T28] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  561.452315][T14199] overlayfs: conflicting lowerdir path
[  561.464055][T12264] usb 4-1: USB disconnect, device number 20
[  561.543578][T14165] raw-gadget gadget: fail, usb_ep_enable returned -22
[  561.586257][T14165] raw-gadget gadget: fail, usb_ep_enable returned -22
[  561.594803][T14206] IPVS: ftp: loaded support on port[0] = 21
05:01:18 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x0]}}}, 0x33}], [], 0x2f})

[  561.634628][T14212] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[  561.673579][   T28] cdc_ether: probe of 2-1:1.0 failed with error -22
[  561.915520][ T8721] usb 2-1: USB disconnect, device number 25
[  562.436720][T14238] tmpfs: Bad value for 'mpol'
05:01:19 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x1300, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:01:19 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="38000000100005070002000000000000000000", @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:01:19 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{}], {{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:01:19 executing program 3:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{}], {}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:01:19 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x0]}}}, 0x33}], [], 0x2f})

05:01:19 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  562.873070][T14254] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[  562.927411][T14251] overlayfs: conflicting lowerdir path
[  563.080198][ T8722] usb 4-1: new low-speed USB device number 21 using dummy_hcd
05:01:20 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="38000000100005070002000000000000000000", @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:01:20 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x2000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  563.192914][T14260] tmpfs: Bad value for 'mpol'
[  563.362825][   T28] usb 2-1: new low-speed USB device number 26 using dummy_hcd
[  563.406974][T14263] IPVS: ftp: loaded support on port[0] = 21
05:01:20 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x3a]}}}, 0x33}], [], 0x2f})

[  563.551675][ T8722] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 0
[  563.646053][T14266] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[  563.810848][ T8722] usb 4-1: string descriptor 0 read error: -22
[  563.817765][ T8722] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  563.827219][ T8722] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  563.864602][   T28] usb 2-1: No LPM exit latency info found, disabling LPM.
05:01:21 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r3, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  564.115550][T14250] raw-gadget gadget: fail, usb_ep_enable returned -22
[  564.173753][   T28] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10
[  564.185146][   T28] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  564.195491][   T28] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 is Bulk; changing to Interrupt
[  564.205772][   T28] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 is Bulk; changing to Interrupt
[  564.237013][T14278] tmpfs: Bad value for 'mpol'
[  564.314896][ T8722] cdc_ether: probe of 4-1:1.0 failed with error -22
[  564.385570][T14281] overlayfs: conflicting lowerdir path
[  564.490129][   T28] usb 2-1: string descriptor 0 read error: -22
[  564.496835][   T28] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  564.506494][   T28] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  564.538513][ T8721] usb 4-1: USB disconnect, device number 21
05:01:21 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x0)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:01:21 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x3a]}}}, 0x33}], [], 0x2f})

05:01:21 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x2010, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  564.673359][T14258] raw-gadget gadget: fail, usb_ep_enable returned -22
[  564.733808][T14258] raw-gadget gadget: fail, usb_ep_enable returned -22
[  564.802982][   T28] cdc_ether: probe of 2-1:1.0 failed with error -22
[  564.962798][T14311] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  564.970494][T14311] IPv6: NLM_F_CREATE should be set when creating new route
[  564.994590][    T7] tipc: TX() has been purged, node left!
[  565.008241][T12263] usb 2-1: USB disconnect, device number 26
[  565.040966][    T7] tipc: TX() has been purged, node left!
[  565.066902][    T7] tipc: TX() has been purged, node left!
[  565.230672][T14319] tmpfs: Bad value for 'mpol'
05:01:22 executing program 3:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{}], {}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

[  565.471182][T14325] overlayfs: conflicting lowerdir path
[  565.516410][T14324] IPVS: ftp: loaded support on port[0] = 21
[  565.671721][T14325] overlayfs: conflicting lowerdir path
05:01:22 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x4d, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3b, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[], {{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:01:22 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r3, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:01:22 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x3a]}}}, 0x33}], [], 0x2f})

05:01:23 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x2200, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  566.275426][ T8724] usb 4-1: new low-speed USB device number 22 using dummy_hcd
[  566.422308][T14333] tmpfs: Bad value for 'mpol'
[  566.424225][T14343] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  566.435601][T14343] IPv6: NLM_F_CREATE should be set when creating new route
[  566.465319][T14349] overlayfs: conflicting lowerdir path
[  566.574847][T14353] overlayfs: conflicting lowerdir path
[  566.691228][ T8724] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 0
05:01:23 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x0, 0x3a]}}}, 0x33}], [], 0x2f})

[  566.780109][T12263] usb 2-1: new low-speed USB device number 27 using dummy_hcd
05:01:24 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x2400, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  566.960428][ T8724] usb 4-1: string descriptor 0 read error: -22
[  566.967207][ T8724] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  566.977266][ T8724] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  567.060448][T14328] raw-gadget gadget: fail, usb_ep_enable returned -22
[  567.093116][ T8724] cdc_ether: probe of 4-1:1.0 failed with error -22
05:01:24 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r3, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  567.108217][T14372] tmpfs: Bad value for 'mpol'
[  567.192214][T12263] usb 2-1: No LPM exit latency info found, disabling LPM.
[  567.301871][T12263] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 is Bulk; changing to Interrupt
[  567.312504][T12263] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 is Bulk; changing to Interrupt
[  567.324097][T12263] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  567.358956][   T28] usb 4-1: USB disconnect, device number 22
05:01:24 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x0, 0x3a]}}}, 0x33}], [], 0x2f})

[  567.633925][T12263] usb 2-1: string descriptor 0 read error: -22
[  567.640819][T12263] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  567.650169][T12263] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  567.735886][T14394] overlayfs: conflicting lowerdir path
[  567.762343][T14402] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  567.769917][T14402] IPv6: NLM_F_CREATE should be set when creating new route
[  567.891004][T14394] overlayfs: conflicting lowerdir path
[  567.951920][T14352] raw-gadget gadget: fail, usb_ep_enable returned -22
[  567.993367][T14352] raw-gadget gadget: fail, usb_ep_enable returned -22
[  568.094108][T12263] cdc_ether: probe of 2-1:1.0 failed with error -22
[  568.295775][T12263] usb 2-1: USB disconnect, device number 27
[  568.412263][T14410] tmpfs: Bad value for 'mpol'
05:01:26 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x0)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:01:26 executing program 3:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{{0x9, 0x5, 0x81, 0x3, 0x8}}]}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:01:26 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x2500, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:01:26 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x0, 0x3a]}}}, 0x33}], [], 0x2f})

05:01:26 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:01:26 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x4d, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3b, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[], {{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

[  569.924000][T14432] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  569.926618][T14430] tmpfs: Bad value for 'mpol'
[  569.931987][T14432] IPv6: NLM_F_CREATE should be set when creating new route
05:01:27 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  570.066804][T14424] overlayfs: conflicting lowerdir path
[  570.069115][T11331] usb 2-1: new low-speed USB device number 28 using dummy_hcd
[  570.089165][   T28] usb 4-1: new low-speed USB device number 23 using dummy_hcd
[  570.181654][T14437] IPVS: ftp: loaded support on port[0] = 21
[  570.355906][T14429] overlayfs: conflicting lowerdir path
[  570.469876][   T28] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 0
05:01:27 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x26d8, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:01:27 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x38, 0x3a]}}}, 0x33}], [], 0x2f})

[  570.750263][   T28] usb 4-1: string descriptor 0 read error: -22
[  570.757166][   T28] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  570.767972][   T28] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  570.841065][T11331] usb 2-1: No LPM exit latency info found, disabling LPM.
05:01:28 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x0)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  570.992626][   T28] cdc_ether: probe of 4-1:1.0 failed with error -22
[  571.014186][T11331] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 is Bulk; changing to Interrupt
[  571.025378][T11331] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 is Bulk; changing to Interrupt
[  571.035682][T11331] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  571.118675][T14467] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  571.126192][T14467] IPv6: NLM_F_CREATE should be set when creating new route
[  571.129498][T14471] tmpfs: Bad value for 'mpol'
[  571.196660][   T28] usb 4-1: USB disconnect, device number 23
[  571.298742][T11331] usb 2-1: string descriptor 0 read error: -22
[  571.305527][T11331] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  571.315071][T11331] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
05:01:28 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x38, 0x3a]}}}, 0x33}], [], 0x2f})

05:01:28 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  571.451264][T14425] raw-gadget gadget: fail, usb_ep_enable returned -22
[  571.487591][T14481] overlayfs: conflicting lowerdir path
[  571.495391][T14425] raw-gadget gadget: fail, usb_ep_enable returned -22
[  571.567919][T14482] IPVS: ftp: loaded support on port[0] = 21
[  571.625160][T11331] cdc_ether: probe of 2-1:1.0 failed with error -22
[  571.730660][T14481] overlayfs: conflicting lowerdir path
[  571.863302][T11331] usb 2-1: USB disconnect, device number 28
05:01:29 executing program 3:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{{0x9, 0x5, 0x81, 0x3, 0x8}}]}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:01:29 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x26db, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  572.352505][T14510] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  572.360427][T14510] IPv6: NLM_F_CREATE should be set when creating new route
[  572.393303][T14513] tmpfs: Bad value for 'mpol'
05:01:29 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(0xffffffffffffffff, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  572.630018][T14522] overlayfs: conflicting lowerdir path
05:01:29 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  572.729338][T14522] overlayfs: conflicting lowerdir path
05:01:30 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x4d, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3b, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[], {{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:01:30 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x38, 0x3a]}}}, 0x33}], [], 0x2f})

05:01:30 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x2c00, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  573.114270][T14529] IPVS: ftp: loaded support on port[0] = 21
[  573.174624][   T28] usb 4-1: new low-speed USB device number 24 using dummy_hcd
[  573.439524][T14541] tmpfs: Bad value for 'mpol'
[  573.488217][T14536] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  573.496178][T14536] IPv6: NLM_F_CREATE should be set when creating new route
[  573.798410][   T28] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 0
[  573.818669][T12263] usb 2-1: new low-speed USB device number 29 using dummy_hcd
05:01:31 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x0, 0x38, 0x3a]}}}, 0x33}], [], 0x2f})

[  573.872998][T14542] overlayfs: conflicting lowerdir path
[  573.962877][    T7] tipc: TX() has been purged, node left!
05:01:31 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  574.014935][T14542] overlayfs: conflicting lowerdir path
[  574.112731][   T28] usb 4-1: string descriptor 0 read error: -22
[  574.120880][   T28] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  574.130916][   T28] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
05:01:31 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(0xffffffffffffffff, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  574.252337][T12263] usb 2-1: No LPM exit latency info found, disabling LPM.
05:01:31 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x2f00, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  574.341260][   T28] cdc_ether: probe of 4-1:1.0 failed with error -22
[  574.356051][T12263] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 is Bulk; changing to Interrupt
[  574.366441][T12263] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 is Bulk; changing to Interrupt
[  574.376684][T12263] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  574.496986][T14573] tmpfs: Bad value for 'mpol'
[  574.566255][T12264] usb 4-1: USB disconnect, device number 24
[  574.682501][T12263] usb 2-1: string descriptor 0 read error: -22
[  574.689266][T12263] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  574.699212][T12263] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  574.775886][T14583] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  574.783425][T14583] IPv6: NLM_F_CREATE should be set when creating new route
[  574.951327][T14537] raw-gadget gadget: fail, usb_ep_enable returned -22
[  574.960210][T14585] IPVS: ftp: loaded support on port[0] = 21
[  575.046258][T14537] raw-gadget gadget: fail, usb_ep_enable returned -22
05:01:32 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x0, 0x38, 0x3a]}}}, 0x33}], [], 0x2f})

[  575.231993][T12263] cdc_ether: probe of 2-1:1.0 failed with error -22
[  575.464858][T12263] usb 2-1: USB disconnect, device number 29
05:01:32 executing program 3:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{{0x9, 0x5, 0x81, 0x3, 0x8}}]}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:01:32 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  575.699848][T14613] overlayfs: conflicting lowerdir path
[  575.785538][T14619] tmpfs: Bad value for 'mpol'
05:01:33 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x3000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:01:33 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(0xffffffffffffffff, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  576.122652][T14628] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  576.130094][T14628] IPv6: NLM_F_CREATE should be set when creating new route
05:01:33 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{}], {}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:01:33 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x0, 0x38, 0x3a]}}}, 0x33}], [], 0x2f})

[  576.418000][T12263] usb 4-1: new low-speed USB device number 25 using dummy_hcd
[  576.545525][T14634] overlayfs: conflicting lowerdir path
[  576.549043][T14631] IPVS: ftp: loaded support on port[0] = 21
[  576.700025][T14635] overlayfs: conflicting lowerdir path
[  576.746190][T14638] tmpfs: Bad value for 'mpol'
05:01:34 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  576.880031][T12263] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 0
05:01:34 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x3a00, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:01:34 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x2d, 0x38, 0x3a]}}}, 0x33}], [], 0x2f})

[  577.220352][T12263] usb 4-1: string descriptor 0 read error: -22
[  577.226943][T12263] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  577.236292][T12263] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  577.258102][T12264] usb 2-1: new low-speed USB device number 30 using dummy_hcd
[  577.397322][T12263] cdc_ether: probe of 4-1:1.0 failed with error -22
[  577.542083][T14666] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  577.549511][T14666] IPv6: NLM_F_CREATE should be set when creating new route
[  577.627229][ T8716] usb 4-1: USB disconnect, device number 25
[  577.679698][T12264] usb 2-1: No LPM exit latency info found, disabling LPM.
[  577.710324][T14675] tmpfs: Bad value for 'mpol'
[  577.768976][T12264] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10
[  577.780302][T12264] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  577.790558][T12264] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 is Bulk; changing to Interrupt
[  577.800799][T12264] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0
[  577.811730][T12264] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 is Bulk; changing to Interrupt
[  577.910856][T14683] overlayfs: conflicting lowerdir path
05:01:35 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  578.004301][T14682] overlayfs: conflicting lowerdir path
05:01:35 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x2d, 0x38, 0x3a]}}}, 0x33}], [], 0x2f})

05:01:35 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x3f00, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:01:35 executing program 3:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{{0x9, 0x5, 0x81, 0x3, 0x8}}], {}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, 0x0)

[  578.279908][T12264] usb 2-1: string descriptor 0 read error: -22
[  578.286607][T12264] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  578.295947][T12264] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  578.432373][T14642] raw-gadget gadget: fail, usb_ep_enable returned -22
[  578.497153][T12264] cdc_ether: probe of 2-1:1.0 failed with error -22
[  578.588129][T14699] tmpfs: Bad value for 'mpol'
[  578.730026][ T8721] usb 2-1: USB disconnect, device number 30
[  578.756250][T14707] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  578.763810][T14707] IPv6: NLM_F_CREATE should be set when creating new route
[  578.913584][T14712] overlayfs: conflicting lowerdir path
05:01:36 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x2d, 0x38, 0x3a]}}}, 0x33}], [], 0x2f})

[  578.985799][T14712] overlayfs: conflicting lowerdir path
05:01:36 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  579.157753][T12264] usb 4-1: new low-speed USB device number 26 using dummy_hcd
[  579.448749][T14720] tmpfs: Bad value for 'mpol'
[  579.550072][T12264] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 0
[  579.584603][T14724] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  579.592344][T14724] IPv6: NLM_F_CREATE should be set when creating new route
05:01:37 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x0, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:01:37 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x4000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:01:37 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{}], {}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:01:37 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x0, 0x2d, 0x38, 0x3a]}}}, 0x33}], [], 0x2f})

05:01:37 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  580.512438][T14735] tmpfs: Bad value for 'mpol'
[  580.641129][T14742] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  580.648570][T14742] IPv6: NLM_F_CREATE should be set when creating new route
[  580.704488][T14733] overlayfs: conflicting lowerdir path
[  580.747313][T12263] usb 2-1: new low-speed USB device number 31 using dummy_hcd
[  580.845040][T14740] IPVS: ftp: loaded support on port[0] = 21
[  580.967225][T14733] overlayfs: conflicting lowerdir path
05:01:38 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x0, 0x2d, 0x38, 0x3a]}}}, 0x33}], [], 0x2f})

[  581.128279][T12263] usb 2-1: No LPM exit latency info found, disabling LPM.
[  581.228183][T12263] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10
[  581.239514][T12263] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  581.249554][T12263] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 is Bulk; changing to Interrupt
[  581.259752][T12263] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0
[  581.269712][T12263] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 is Bulk; changing to Interrupt
05:01:38 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:01:38 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x4800, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  581.615934][ T1432] tipc: TX() has been purged, node left!
[  581.639819][T14772] tmpfs: Bad value for 'mpol'
05:01:39 executing program 3:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{{0x9, 0x5, 0x81, 0x3, 0x8}}], {}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, 0x0)

05:01:39 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x0, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  581.856703][T12263] usb 2-1: string descriptor 0 read error: -22
[  581.863445][T12263] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  581.873096][T12263] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
05:01:39 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x0, 0x2d, 0x38, 0x3a]}}}, 0x33}], [], 0x2f})

[  581.982824][T14734] raw-gadget gadget: fail, usb_ep_enable returned -22
[  581.990150][T12264] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  581.999391][T12264] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  582.033341][T12263] cdc_ether: probe of 2-1:1.0 failed with error -22
[  582.189119][T12264] usb 4-1: can't set config #1, error -71
[  582.212807][T14786] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  582.220262][T14786] IPv6: NLM_F_CREATE should be set when creating new route
[  582.228417][T12264] usb 4-1: USB disconnect, device number 26
[  582.259280][T12263] usb 2-1: USB disconnect, device number 31
[  582.498544][T14796] overlayfs: conflicting lowerdir path
05:01:39 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  582.626458][T14798] overlayfs: conflicting lowerdir path
[  582.656446][T14803] tmpfs: Bad value for 'mpol'
[  582.758326][T14804] IPVS: ftp: loaded support on port[0] = 21
[  582.816495][T12264] usb 4-1: new low-speed USB device number 27 using dummy_hcd
05:01:40 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{}], {}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:01:40 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x4c00, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  583.222776][T12264] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 0
[  583.291967][T14810] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  583.299438][T14810] IPv6: NLM_F_CREATE should be set when creating new route
05:01:40 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = eventfd(0x0)
ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000000)={0x0, 0x0, 0x0, r2})
ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000080)={0x0, 0x0, 0x0, r2, 0x2})

[  583.831484][T14840] overlayfs: conflicting lowerdir path
05:01:41 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x0, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  583.927661][ T8721] usb 2-1: new low-speed USB device number 32 using dummy_hcd
[  583.974278][T14848] overlayfs: conflicting lowerdir path
05:01:41 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000180)=[@text32={0x20, &(0x7f00000000c0)="b9800000c00f322e0f0178000f309a0900000065002ed8ddc74424008fc4bd87c7442402c43a727fc7442406000000000f011424f30f090f013a360f06c4c18d72d683ed", 0x44}], 0x1, 0x0, 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc62]})
openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x7, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000380)=ANY=[@ANYBLOB="020000000080000001000000000005040000020000000033c458f576e1000000000000092a221ce47549bc00000000000a000000000003000019b11792"])
pipe(&(0x7f0000000000))
ioctl$KVM_RUN(r2, 0xae80, 0x0)

05:01:41 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:01:41 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x4f82, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  584.288946][ T8721] usb 2-1: No LPM exit latency info found, disabling LPM.
[  584.368303][ T8721] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10
[  584.379767][ T8721] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  584.389858][ T8721] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 is Bulk; changing to Interrupt
[  584.400026][ T8721] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0
[  584.410083][ T8721] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 is Bulk; changing to Interrupt
[  584.579639][T14855] IPVS: ftp: loaded support on port[0] = 21
[  584.921989][ T8722] Bluetooth: hci4: command 0x0406 tx timeout
[  584.946103][T14872] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  584.953641][T14872] IPv6: NLM_F_CREATE should be set when creating new route
[  584.969339][ T8721] usb 2-1: string descriptor 0 read error: -22
[  584.975902][ T8721] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  584.985282][ T8721] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  585.079231][T14871] overlayfs: conflicting lowerdir path
[  585.211727][T14838] raw-gadget gadget: fail, usb_ep_enable returned -22
05:01:42 executing program 5:
syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="552968034bfa", @dev, @void, {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x1, @multicast, @dev, @broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}}}}}, 0x0)

05:01:42 executing program 3:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{{0x9, 0x5, 0x81, 0x3, 0x8}}], {}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, 0x0)

[  585.310763][ T8721] cdc_ether: probe of 2-1:1.0 failed with error -22
[  585.519269][T12264] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  585.524744][ T8721] usb 2-1: USB disconnect, device number 32
[  585.529129][T12264] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
05:01:42 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x5501, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  585.658540][T12264] usb 4-1: can't set config #1, error -71
[  585.718562][T12264] usb 4-1: USB disconnect, device number 27
05:01:42 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:01:43 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  586.044349][ T1432] tipc: TX() has been purged, node left!
[  586.072065][ T1432] tipc: TX() has been purged, node left!
05:01:43 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{}], {{0x9, 0x5, 0x82, 0x2, 0x200}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:01:43 executing program 5:
clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0)
ptrace$setopts(0x4206, r2, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x146, 0x146, 0x7, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @enum={0x0, 0x1, 0x0, 0x6, 0x4, [{}]}, @union={0x0, 0x4, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}]}, @datasec={0x0, 0x6, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}, {}], "18"}, @datasec={0x0, 0x6, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}, {}], 'u'}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0]}}, 0x0, 0x167}, 0x20)
process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0)
tkill(r2, 0x40)
ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080))
ptrace$cont(0x7, r2, 0x0, 0x0)

[  586.236695][T12264] usb 4-1: new low-speed USB device number 28 using dummy_hcd
[  586.366091][T14917] IPVS: ftp: loaded support on port[0] = 21
[  586.368506][T14919] overlayfs: conflicting lowerdir path
[  586.521200][T14923] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  586.528787][T14923] IPv6: NLM_F_CREATE should be set when creating new route
[  586.615902][T14919] overlayfs: conflicting lowerdir path
[  586.647584][T12264] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 0
05:01:43 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:01:44 executing program 5:
clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x14a, 0x14a, 0x8, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @enum, @union={0x0, 0x4, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}]}, @datasec={0x0, 0x6, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}, {}], "18"}, @datasec={0x0, 0x7, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}, {}, {}], 'u'}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, 0x0, 0x16c}, 0x20)
process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0)
tkill(r0, 0x40)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = fcntl$dupfd(r1, 0x0, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0)
ptrace$cont(0x7, r0, 0x0, 0x0)

[  586.801608][T14952] ptrace attach of "/root/syz-executor.5"[14951] was attempted by "/root/syz-executor.5"[14952]
05:01:44 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x5c00, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:01:44 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  586.977332][ T8722] usb 2-1: new low-speed USB device number 33 using dummy_hcd
[  587.337130][ T8722] usb 2-1: No LPM exit latency info found, disabling LPM.
[  587.417558][ T8722] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10
[  587.428975][ T8722] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  587.439648][ T8722] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 is Bulk; changing to Interrupt
[  587.449827][ T8722] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 is Bulk; changing to Interrupt
[  587.460014][ T8722] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0
[  587.488499][T14958] IPVS: ftp: loaded support on port[0] = 21
05:01:44 executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount$fuse(0x20000000, &(0x7f0000000440)='./file0\x00', 0x0, 0x7a04, 0x0)
sendmsg$AUDIT_USER_TTY(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYRES64], 0x1}}, 0x0)
r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0)
sched_rr_get_interval(0x0, 0x0)
ioctl$FS_IOC_SETVERSION(r0, 0xc0c0583b, &(0x7f0000000080))
dup2(0xffffffffffffffff, 0xffffffffffffffff)

[  587.760827][T14975] overlayfs: conflicting lowerdir path
[  587.821553][T14962] overlayfs: conflicting lowerdir path
[  587.967931][ T8722] usb 2-1: string descriptor 0 read error: -22
[  587.974777][ T8722] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  587.984184][ T8722] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  588.052362][T14978] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  588.059860][T14978] IPv6: NLM_F_CREATE should be set when creating new route
05:01:45 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  588.280579][T14944] raw-gadget gadget: fail, usb_ep_enable returned -22
[  588.363377][ T8722] cdc_ether: probe of 2-1:1.0 failed with error -22
[  588.591264][ T8722] usb 2-1: USB disconnect, device number 33
[  589.143154][T15003] IPVS: ftp: loaded support on port[0] = 21
05:01:46 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x6800, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:01:46 executing program 5:
perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x7f, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000000000)='./file0\x00', 0x0)
mount$bpf(0x20000000, &(0x7f0000000100)='./file0\x00', 0x0, 0x181445, 0x0)

05:01:46 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x18, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}}, 0x18}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:01:46 executing program 3:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{{0x9, 0x5, 0x81, 0x3, 0x8}}], {}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x2, [{0x0, 0x0}, {0x0, 0x0}]})

[  589.306712][T12264] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  589.316033][T12264] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
05:01:46 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{}], {{0x9, 0x5, 0x82, 0x2, 0x200}}}}}]}}]}}, 0x0)

[  589.486954][T12264] usb 4-1: can't set config #1, error -71
[  589.539153][T12264] usb 4-1: USB disconnect, device number 28
[  589.617773][T15012] overlayfs: conflicting lowerdir path
[  589.842963][T15025] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  589.845635][T15010] overlayfs: conflicting lowerdir path
[  589.850489][T15025] IPv6: NLM_F_CREATE should be set when creating new route
05:01:47 executing program 5:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={<r0=>0xffffffffffffffff})
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
keyctl$join(0x1, 0xfffffffffffffffe)

05:01:47 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x6c00, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  590.257770][T12264] usb 4-1: new low-speed USB device number 29 using dummy_hcd
[  590.366644][ T8721] usb 2-1: new low-speed USB device number 34 using dummy_hcd
[  590.628289][T12264] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 0
05:01:47 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, 0x0, 0x0)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:01:47 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0484c39ceb0f958f471ea46695c9db4380b771596729a398339a44a13da2e965c876ef1b8b88bdbac20aa265e214800000000dddc48359b085f74321851f892dc5e2c4d7fdd361d6fa771eebfea5838b8a3a4bd67f35c5456cfd80676dd7680f828b3d67d1d878b5c33a8575a", 0xd8)

[  590.726637][ T8721] usb 2-1: unable to get BOS descriptor or descriptor too short
05:01:48 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x18, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}}, 0x18}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  590.806640][ T8721] usb 2-1: unable to read config index 0 descriptor/start: -71
[  590.814387][ T8721] usb 2-1: can't read configurations, error -71
[  590.919311][T12264] usb 4-1: string descriptor 0 read error: -22
[  590.925943][T12264] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  590.935615][T12264] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  591.032263][T15021] raw-gadget gadget: fail, usb_ep_enable returned -22
[  591.090406][T12264] cdc_ether: probe of 4-1:1.0 failed with error -22
[  591.120670][T15056] overlayfs: conflicting lowerdir path
[  591.166326][T15062] sg_write: data in/out 167162/168 bytes for SCSI command 0xff-- guessing data in;
[  591.166326][T15062]    program syz-executor.5 not setting count and/or reply_len properly
[  591.298856][T11331] usb 4-1: USB disconnect, device number 29
[  591.324355][T15060] overlayfs: conflicting lowerdir path
[  591.414221][T15072] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  591.421784][T15072] IPv6: NLM_F_CREATE should be set when creating new route
05:01:48 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{}], {{0x9, 0x5, 0x82, 0x2, 0x200}}}}}]}}]}}, 0x0)

[  591.646349][T15071] IPVS: ftp: loaded support on port[0] = 21
05:01:48 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x7400, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:01:49 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0484c39ceb0f958f471ea46695c9db4380b771596729a398339a44a13da2e965c876ef1b8b88bdbac20aa265e214800000000dddc48359b085f74321851f892dc5e2c4d7fdd361d6fa771eebfea5838b8a3a4bd67f35c5456cfd80676dd7680f828b3d67d1d878b5c33a8575a", 0xd8)

05:01:49 executing program 3:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{{0x9, 0x5, 0x81, 0x3, 0x8}}], {}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]})

05:01:49 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x18, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}}, 0x18}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  592.556952][T11331] usb 2-1: new low-speed USB device number 36 using dummy_hcd
[  592.586215][ T1432] tipc: TX() has been purged, node left!
[  592.627693][T15107] sg_write: data in/out 167162/168 bytes for SCSI command 0xff-- guessing data in;
[  592.627693][T15107]    program syz-executor.5 not setting count and/or reply_len properly
05:01:49 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, 0x0, 0x0)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  592.711231][T15108] overlayfs: conflicting lowerdir path
[  592.808665][T15108] overlayfs: conflicting lowerdir path
05:01:50 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0484c39ceb0f958f471ea46695c9db4380b771596729a398339a44a13da2e965c876ef1b8b88bdbac20aa265e214800000000dddc48359b085f74321851f892dc5e2c4d7fdd361d6fa771eebfea5838b8a3a4bd67f35c5456cfd80676dd7680f828b3d67d1d878b5c33a8575a", 0xd8)

[  592.887181][ T8716] usb 4-1: new low-speed USB device number 30 using dummy_hcd
[  592.916482][T11331] usb 2-1: unable to get BOS descriptor or descriptor too short
[  593.114925][T11331] usb 2-1: unable to read config index 0 descriptor/start: -71
[  593.123466][T11331] usb 2-1: can't read configurations, error -71
[  593.137166][T15116] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  593.144595][T15116] IPv6: NLM_F_CREATE should be set when creating new route
[  593.277956][ T8716] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 0
05:01:50 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x7a00, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  593.353069][T15118] IPVS: ftp: loaded support on port[0] = 21
05:01:50 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{}], {{0x9, 0x5, 0x82, 0x2, 0x200}}}}}]}}]}}, 0x0)

[  593.557960][ T8716] usb 4-1: string descriptor 0 read error: -22
[  593.564646][ T8716] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  593.574007][ T8716] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  593.592425][T15122] sg_write: data in/out 167162/168 bytes for SCSI command 0xff-- guessing data in;
[  593.592425][T15122]    program syz-executor.5 not setting count and/or reply_len properly
05:01:51 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0484c39ceb0f958f471ea46695c9db4380b771596729a398339a44a13da2e965c876ef1b8b88bdbac20aa265e214800000000dddc48359b085f74321851f892dc5e2c4d7fdd361d6fa771eebfea5838b8a3a4bd67f35c5456cfd80676dd7680f828b3d67d1d878b5c33a8575a", 0xd8)

05:01:51 executing program 2:
socket$nl_route(0x10, 0x3, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r3, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  593.792215][T15105] raw-gadget gadget: fail, usb_ep_enable returned -22
[  593.869810][ T8716] cdc_ether: probe of 4-1:1.0 failed with error -22
[  594.091447][T12261] usb 4-1: USB disconnect, device number 30
[  594.283537][T15151] overlayfs: conflicting lowerdir path
[  594.310089][T15157] sg_write: data in/out 167162/168 bytes for SCSI command 0xff-- guessing data in;
[  594.310089][T15157]    program syz-executor.5 not setting count and/or reply_len properly
[  594.398083][T15156] overlayfs: conflicting lowerdir path
[  594.409177][T11331] usb 2-1: new low-speed USB device number 37 using dummy_hcd
05:01:51 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, 0x0, 0x0)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:01:51 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x8004, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:01:51 executing program 5:
write(0xffffffffffffffff, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0484c39ceb0f958f471ea46695c9db4380b771596729a398339a44a13da2e965c876ef1b8b88bdbac20aa265e214800000000dddc48359b085f74321851f892dc5e2c4d7fdd361d6fa771eebfea5838b8a3a4bd67f35c5456cfd80676dd7680f828b3d67d1d878b5c33a8575a", 0xd8)

05:01:52 executing program 3:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{{0x9, 0x5, 0x81, 0x3, 0x8}}], {}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0})

[  594.777345][T11331] usb 2-1: unable to get BOS descriptor or descriptor too short
[  594.846164][T11331] usb 2-1: unable to read config index 0 descriptor/start: -71
[  594.853911][T11331] usb 2-1: can't read configurations, error -71
[  594.911889][T11331] usb usb2-port1: attempt power cycle
[  595.183216][T15162] IPVS: ftp: loaded support on port[0] = 21
05:01:52 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{}], {{0x9, 0x5, 0x82, 0x2, 0x200}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

[  595.736388][T12261] usb 4-1: new low-speed USB device number 31 using dummy_hcd
05:01:53 executing program 5:
write(0xffffffffffffffff, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0484c39ceb0f958f471ea46695c9db4380b771596729a398339a44a13da2e965c876ef1b8b88bdbac20aa265e214800000000dddc48359b085f74321851f892dc5e2c4d7fdd361d6fa771eebfea5838b8a3a4bd67f35c5456cfd80676dd7680f828b3d67d1d878b5c33a8575a", 0xd8)

[  595.811752][T15169] overlayfs: conflicting lowerdir path
[  595.978744][T15186] overlayfs: conflicting lowerdir path
[  596.147040][T12261] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 0
05:01:53 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x824f, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:01:53 executing program 5:
write(0xffffffffffffffff, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0484c39ceb0f958f471ea46695c9db4380b771596729a398339a44a13da2e965c876ef1b8b88bdbac20aa265e214800000000dddc48359b085f74321851f892dc5e2c4d7fdd361d6fa771eebfea5838b8a3a4bd67f35c5456cfd80676dd7680f828b3d67d1d878b5c33a8575a", 0xd8)

05:01:53 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4), 0x0)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  596.728327][T11331] usb 2-1: new low-speed USB device number 38 using dummy_hcd
[  596.856235][T15204] overlayfs: conflicting lowerdir path
[  596.959996][T15205] overlayfs: conflicting lowerdir path
[  596.986970][T11331] usb 2-1: unable to get BOS descriptor or descriptor too short
[  597.067264][T11331] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10
[  597.078572][T11331] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  597.088671][T11331] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 is Bulk; changing to Interrupt
[  597.098922][T11331] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 is Bulk; changing to Interrupt
[  597.109033][T11331] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0
[  597.119273][T15209] IPVS: ftp: loaded support on port[0] = 21
05:01:54 executing program 5:
r0 = syz_open_dev$sg(0x0, 0x0, 0x10008002)
write(r0, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0484c39ceb0f958f471ea46695c9db4380b771596729a398339a44a13da2e965c876ef1b8b88bdbac20aa265e214800000000dddc48359b085f74321851f892dc5e2c4d7fdd361d6fa771eebfea5838b8a3a4bd67f35c5456cfd80676dd7680f828b3d67d1d878b5c33a8575a", 0xd8)

05:01:54 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xa1ff, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  597.576653][T11331] usb 2-1: string descriptor 0 read error: -22
[  597.583264][T11331] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  597.592659][T11331] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  597.849425][T15198] raw-gadget gadget: fail, usb_ep_enable returned -22
[  597.904212][ T1432] tipc: TX() has been purged, node left!
[  597.910963][T11331] cdc_ether: probe of 2-1:1.0 failed with error -22
[  598.131650][T11331] usb 2-1: USB disconnect, device number 38
[  598.203912][T15239] overlayfs: conflicting lowerdir path
[  598.408586][T15245] overlayfs: conflicting lowerdir path
[  598.549088][T12261] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  598.558499][T12261] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  598.656256][T12261] usb 4-1: can't set config #1, error -71
05:01:55 executing program 2:
socket$nl_route(0x10, 0x3, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r3, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:01:55 executing program 5:
r0 = syz_open_dev$sg(0x0, 0x0, 0x10008002)
write(r0, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0484c39ceb0f958f471ea46695c9db4380b771596729a398339a44a13da2e965c876ef1b8b88bdbac20aa265e214800000000dddc48359b085f74321851f892dc5e2c4d7fdd361d6fa771eebfea5838b8a3a4bd67f35c5456cfd80676dd7680f828b3d67d1d878b5c33a8575a", 0xd8)

05:01:55 executing program 3:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{{0x9, 0x5, 0x81, 0x3, 0x8}}], {}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0})

05:01:55 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4), 0x0)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:01:55 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xaa02, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  598.704648][T12261] usb 4-1: USB disconnect, device number 31
05:01:56 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{}], {{0x9, 0x5, 0x82, 0x2, 0x200}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:01:56 executing program 5:
r0 = syz_open_dev$sg(0x0, 0x0, 0x10008002)
write(r0, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0484c39ceb0f958f471ea46695c9db4380b771596729a398339a44a13da2e965c876ef1b8b88bdbac20aa265e214800000000dddc48359b085f74321851f892dc5e2c4d7fdd361d6fa771eebfea5838b8a3a4bd67f35c5456cfd80676dd7680f828b3d67d1d878b5c33a8575a", 0xd8)

[  599.250334][T15263] IPVS: ftp: loaded support on port[0] = 21
[  599.395321][T15271] overlayfs: conflicting lowerdir path
[  599.471782][T15271] overlayfs: conflicting lowerdir path
[  599.478242][T12261] usb 4-1: new low-speed USB device number 32 using dummy_hcd
05:01:56 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xd826, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  599.966135][ T8716] usb 2-1: new low-speed USB device number 39 using dummy_hcd
05:01:57 executing program 2:
socket$nl_route(0x10, 0x3, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r3, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r4], 0x38}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r4}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  600.184278][T12261] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 0
05:01:57 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4), 0x0)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:01:57 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x0)
write(r0, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0484c39ceb0f958f471ea46695c9db4380b771596729a398339a44a13da2e965c876ef1b8b88bdbac20aa265e214800000000dddc48359b085f74321851f892dc5e2c4d7fdd361d6fa771eebfea5838b8a3a4bd67f35c5456cfd80676dd7680f828b3d67d1d878b5c33a8575a", 0xd8)

[  600.429769][ T8716] usb 2-1: unable to get BOS descriptor or descriptor too short
[  600.625502][ T8716] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10
[  600.637077][ T8716] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  600.647876][ T8716] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 is Bulk; changing to Interrupt
[  600.658015][ T8716] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 is Bulk; changing to Interrupt
[  600.668044][ T8716] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0
[  600.781659][T15308] overlayfs: conflicting lowerdir path
[  600.871230][T15312] overlayfs: conflicting lowerdir path
[  600.961073][T15313] IPVS: ftp: loaded support on port[0] = 21
05:01:58 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x0)
write(r0, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0484c39ceb0f958f471ea46695c9db4380b771596729a398339a44a13da2e965c876ef1b8b88bdbac20aa265e214800000000dddc48359b085f74321851f892dc5e2c4d7fdd361d6fa771eebfea5838b8a3a4bd67f35c5456cfd80676dd7680f828b3d67d1d878b5c33a8575a", 0xd8)

05:01:58 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xdb26, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  601.465148][ T8716] usb 2-1: string descriptor 0 read error: -22
[  601.471807][ T8716] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  601.482236][ T8716] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  601.591644][T15274] raw-gadget gadget: fail, usb_ep_enable returned -22
05:01:58 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, 0x0, 0x24000000)

[  601.668671][ T8716] cdc_ether: probe of 2-1:1.0 failed with error -22
[  601.891569][T12263] usb 2-1: USB disconnect, device number 39
05:01:59 executing program 3:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{{0x9, 0x5, 0x81, 0x3, 0x8}}], {}, {{0x9, 0x5, 0x3, 0x2, 0x40}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0})

05:01:59 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x0, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:01:59 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x0)
write(r0, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0484c39ceb0f958f471ea46695c9db4380b771596729a398339a44a13da2e965c876ef1b8b88bdbac20aa265e214800000000dddc48359b085f74321851f892dc5e2c4d7fdd361d6fa771eebfea5838b8a3a4bd67f35c5456cfd80676dd7680f828b3d67d1d878b5c33a8575a", 0xd8)

[  602.135361][T15349] overlayfs: conflicting lowerdir path
[  602.257981][T15349] overlayfs: conflicting lowerdir path
[  602.277403][T12261] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  602.287101][T12261] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  602.395605][T12261] usb 4-1: can't set config #1, error -71
[  602.446519][T12261] usb 4-1: USB disconnect, device number 32
05:01:59 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{}], {{0x9, 0x5, 0x82, 0x2, 0x200}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

05:01:59 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xedc0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  602.794538][T15365] IPVS: ftp: loaded support on port[0] = 21
[  603.008859][T15369] overlayfs: conflicting lowerdir path
05:02:00 executing program 5:
syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(0xffffffffffffffff, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0484c39ceb0f958f471ea46695c9db4380b771596729a398339a44a13da2e965c876ef1b8b88bdbac20aa265e214800000000dddc48359b085f74321851f892dc5e2c4d7fdd361d6fa771eebfea5838b8a3a4bd67f35c5456cfd80676dd7680f828b3d67d1d878b5c33a8575a", 0xd8)

[  603.147746][T15370] overlayfs: conflicting lowerdir path
[  603.185965][T12261] usb 4-1: new low-speed USB device number 33 using dummy_hcd
[  603.296421][ T1432] tipc: TX() has been purged, node left!
05:02:00 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xf504, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:02:00 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, 0x0, 0x24000000)

05:02:00 executing program 5:
syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(0xffffffffffffffff, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0484c39ceb0f958f471ea46695c9db4380b771596729a398339a44a13da2e965c876ef1b8b88bdbac20aa265e214800000000dddc48359b085f74321851f892dc5e2c4d7fdd361d6fa771eebfea5838b8a3a4bd67f35c5456cfd80676dd7680f828b3d67d1d878b5c33a8575a", 0xd8)

[  603.550164][ T1432] tipc: TX() has been purged, node left!
[  603.557697][T12261] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 0
[  603.574259][ T1432] tipc: TX() has been purged, node left!
[  603.656240][T12263] usb 2-1: new low-speed USB device number 40 using dummy_hcd
05:02:01 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x0, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  604.115859][T12263] usb 2-1: unable to get BOS descriptor or descriptor too short
[  604.170489][T15404] overlayfs: conflicting lowerdir path
[  604.206870][T12263] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10
[  604.218240][T12263] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  604.228306][T12263] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 is Bulk; changing to Interrupt
[  604.238434][T12263] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 is Bulk; changing to Interrupt
[  604.248491][T12263] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0
05:02:01 executing program 5:
syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(0xffffffffffffffff, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0484c39ceb0f958f471ea46695c9db4380b771596729a398339a44a13da2e965c876ef1b8b88bdbac20aa265e214800000000dddc48359b085f74321851f892dc5e2c4d7fdd361d6fa771eebfea5838b8a3a4bd67f35c5456cfd80676dd7680f828b3d67d1d878b5c33a8575a", 0xd8)

[  604.419666][T15409] overlayfs: conflicting lowerdir path
[  604.672595][T15411] IPVS: ftp: loaded support on port[0] = 21
[  604.709046][T12263] usb 2-1: string descriptor 0 read error: -22
[  604.715680][T12263] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  604.725136][T12263] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
05:02:02 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xff00, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  604.879161][T15373] raw-gadget gadget: fail, usb_ep_enable returned -22
[  604.938818][T12263] cdc_ether: probe of 2-1:1.0 failed with error -22
[  605.167950][ T8724] usb 2-1: USB disconnect, device number 40
[  605.421955][T15427] overlayfs: conflicting lowerdir path
[  605.498645][T15427] overlayfs: conflicting lowerdir path
05:02:02 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xff01, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:02:02 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, 0x0, 0x0)

05:02:02 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, 0x0, 0x24000000)

05:02:03 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{}], {{0x9, 0x5, 0x82, 0x2, 0x200}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}, 0x2, [{0x0, 0x0}, {0x0, 0x0}]})

05:02:03 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x0, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  605.855127][T12261] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  605.864357][T12261] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
05:02:03 executing program 3:
perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x7f, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2800}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  606.025000][T12261] usb 4-1: can't set config #1, error -71
[  606.076318][T12261] usb 4-1: USB disconnect, device number 33
[  606.328501][T15462] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  606.346736][T15462] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[  606.354832][T15462] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[  606.496026][T15463] IPVS: ftp: loaded support on port[0] = 21
05:02:03 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, 0x0, 0x0)

[  606.969218][ T8721] usb 2-1: new low-speed USB device number 41 using dummy_hcd
[  606.990303][T15469] overlayfs: conflicting lowerdir path
05:02:04 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x24000000)

[  607.220924][T15472] overlayfs: conflicting lowerdir path
[  607.276921][T15489] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  607.295260][T15489] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[  607.303139][T15489] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
05:02:04 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, 0x0, 0x0)

[  607.416056][ T8721] usb 2-1: No LPM exit latency info found, disabling LPM.
05:02:04 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xff03, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  607.496110][ T8721] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10
[  607.507467][ T8721] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  607.517686][ T8721] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 is Bulk; changing to Interrupt
[  607.527852][ T8721] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 is Bulk; changing to Interrupt
[  607.537934][ T8721] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0
05:02:04 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:02:04 executing program 3:
perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x7f, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2800}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

05:02:05 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000080), 0x0)

[  608.090771][ T8721] usb 2-1: string descriptor 0 read error: -22
[  608.097572][ T8721] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  608.107047][ T8721] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  608.202191][T15506] overlayfs: conflicting lowerdir path
[  608.259288][T15465] raw-gadget gadget: fail, usb_ep_enable returned -22
[  608.355055][T15507] overlayfs: conflicting lowerdir path
[  608.365212][ T8721] cdc_ether: probe of 2-1:1.0 failed with error -22
[  608.473289][T15515] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  608.493091][T15515] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[  608.494058][T15510] IPVS: ftp: loaded support on port[0] = 21
[  608.501054][T15515] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[  608.615331][ T8721] usb 2-1: USB disconnect, device number 41
05:02:06 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xff0f, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:02:06 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x24000000)

05:02:06 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{}], {{0x9, 0x5, 0x82, 0x2, 0x200}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}, 0x1, [{0x0, 0x0}]})

05:02:06 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000080), 0x0)

[  609.630484][T15544] overlayfs: conflicting lowerdir path
[  609.734468][T15551] overlayfs: conflicting lowerdir path
05:02:07 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x24000000)

05:02:07 executing program 3:
perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x7f, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2800}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

05:02:07 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:02:07 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xffa1, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:02:07 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000080), 0x0)

[  610.324426][ T8722] usb 2-1: new low-speed USB device number 42 using dummy_hcd
[  610.443031][T15565] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  610.461390][T15565] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[  610.469418][T15565] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[  610.695295][ T8722] usb 2-1: No LPM exit latency info found, disabling LPM.
[  610.780123][ T8722] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10
[  610.791708][ T8722] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  610.801819][ T8722] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 is Bulk; changing to Interrupt
[  610.811996][ T8722] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 is Bulk; changing to Interrupt
[  610.822136][ T8722] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0
[  610.845224][T15573] IPVS: ftp: loaded support on port[0] = 21
[  610.858154][T15569] overlayfs: conflicting lowerdir path
[  610.935351][ T1432] tipc: TX() has been purged, node left!
05:02:08 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0", 0x6c)

[  610.999058][ T1432] tipc: TX() has been purged, node left!
[  611.067397][ T1432] tipc: TX() has been purged, node left!
05:02:08 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x40000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  611.444588][ T8722] usb 2-1: string descriptor 0 read error: -22
[  611.451168][ T8722] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  611.460626][ T8722] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
05:02:08 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x24000000)

[  611.614288][T15588] sg_write: data in/out 167162/60 bytes for SCSI command 0xff-- guessing data in;
[  611.614288][T15588]    program syz-executor.5 not setting count and/or reply_len properly
[  611.670748][ T1432] tipc: TX() has been purged, node left!
[  611.708397][T15557] raw-gadget gadget: fail, usb_ep_enable returned -22
[  611.788507][ T8722] cdc_ether: probe of 2-1:1.0 failed with error -22
05:02:09 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0", 0x6c)

05:02:09 executing program 3:
perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x7f, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2800}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  611.922798][T15592] overlayfs: conflicting lowerdir path
[  612.013758][T15592] overlayfs: conflicting lowerdir path
[  612.017612][ T8721] usb 2-1: USB disconnect, device number 42
[  612.476073][T15618] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  612.496913][T15618] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[  612.505983][T15618] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
05:02:10 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{}], {{0x9, 0x5, 0x82, 0x2, 0x200}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}})

05:02:10 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x7ff00, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:02:10 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:02:10 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0", 0x6c)

05:02:10 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x24000000)

05:02:10 executing program 3:
perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x7f, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2800}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  613.233396][T15622] IPVS: ftp: loaded support on port[0] = 21
[  613.335486][T15623] overlayfs: conflicting lowerdir path
05:02:10 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0484c39ceb0f958f471ea46695c9db4380b771596729a398339a44a13da2e965c876ef1b8b88bdbac20aa265e214800000000dddc4835", 0xa2)

05:02:10 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x80000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  613.861953][T15648] sg_write: data in/out 167162/114 bytes for SCSI command 0xff-- guessing data in;
[  613.861953][T15648]    program syz-executor.5 not setting count and/or reply_len properly
[  613.938508][T12263] usb 2-1: new low-speed USB device number 43 using dummy_hcd
05:02:11 executing program 3:
perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x7f, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2800}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

05:02:11 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0", 0x6c)

[  614.348133][T12263] usb 2-1: No LPM exit latency info found, disabling LPM.
[  614.359715][T15666] overlayfs: conflicting lowerdir path
[  614.457266][T12263] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10
[  614.468444][T12263] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  614.478490][T12263] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 is Bulk; changing to Interrupt
[  614.488610][T12263] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 is Bulk; changing to Interrupt
[  614.493298][T15667] overlayfs: conflicting lowerdir path
[  614.498765][T12263] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0
05:02:11 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  614.676808][T15672] sg_write: data in/out 167162/60 bytes for SCSI command 0xff-- guessing data in;
[  614.676808][T15672]    program syz-executor.5 not setting count and/or reply_len properly
05:02:11 executing program 3:
perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x7f, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2800}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  615.242813][T15676] IPVS: ftp: loaded support on port[0] = 21
05:02:13 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{}], {{0x9, 0x5, 0x82, 0x2, 0x200}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}})

05:02:13 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x80040, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:02:13 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x24000000)

05:02:13 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0", 0x6c)

05:02:13 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2800}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

05:02:13 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  616.444186][T12263] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  616.453694][T12263] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  616.521890][T15709] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  616.541640][T15709] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[  616.542819][T12263] usb 2-1: can't set config #1, error -71
[  616.552022][T15709] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[  616.690753][T15718] sg_write: data in/out 167162/60 bytes for SCSI command 0xff-- guessing data in;
[  616.690753][T15718]    program syz-executor.5 not setting count and/or reply_len properly
[  616.785104][T12263] usb 2-1: USB disconnect, device number 43
[  616.867779][T15711] IPVS: ftp: loaded support on port[0] = 21
[  616.944631][T15719] overlayfs: conflicting lowerdir path
05:02:14 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0", 0x6c)

05:02:14 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x100000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  617.545406][T12263] usb 2-1: new low-speed USB device number 44 using dummy_hcd
[  617.602249][T15734] sg_write: data in/out 167162/60 bytes for SCSI command 0xff-- guessing data in;
[  617.602249][T15734]    program syz-executor.5 not setting count and/or reply_len properly
05:02:14 executing program 3:
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2800}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

05:02:15 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x0, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:02:15 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0484c39ceb0f958f471ea46695c9db4380b771596729a398339a44a", 0x87)

[  617.928209][T12263] usb 2-1: No LPM exit latency info found, disabling LPM.
[  618.007849][T15744] overlayfs: conflicting lowerdir path
[  618.050098][T12263] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10
[  618.061304][T12263] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  618.071366][T12263] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 is Bulk; changing to Interrupt
[  618.081550][T12263] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 is Bulk; changing to Interrupt
[  618.091592][T12263] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0
[  618.164487][T15752] overlayfs: conflicting lowerdir path
05:02:15 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  618.468311][T15762] sg_write: data in/out 167162/87 bytes for SCSI command 0xff-- guessing data in;
[  618.468311][T15762]    program syz-executor.5 not setting count and/or reply_len properly
[  618.557773][ T1432] tipc: TX() has been purged, node left!
[  618.569643][ T1432] tipc: TX() has been purged, node left!
[  618.597198][ T1432] tipc: TX() has been purged, node left!
[  619.023117][T15764] IPVS: ftp: loaded support on port[0] = 21
05:02:17 executing program 1:
syz_usb_connect$cdc_ecm(0x1, 0x56, &(0x7f0000000100)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{}], {{0x9, 0x5, 0x82, 0x2, 0x200}}}}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}})

05:02:17 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x1fffff, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:02:17 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x0, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:02:17 executing program 3:
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2800}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

05:02:17 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0484c39ceb0f958f471ea46695c9db4380b771596729a398339a44a", 0x87)

05:02:17 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  620.133684][T12263] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  620.143153][T12263] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  620.248440][T15799] sg_write: data in/out 167162/87 bytes for SCSI command 0xff-- guessing data in;
[  620.248440][T15799]    program syz-executor.5 not setting count and/or reply_len properly
[  620.383925][T12263] usb 2-1: can't set config #1, error -71
[  620.395007][T15801] IPVS: ftp: loaded support on port[0] = 21
[  620.406173][T12263] usb 2-1: USB disconnect, device number 44
[  620.460163][T15800] overlayfs: failed to resolve './file0/../file0': -2
05:02:17 executing program 3:
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2800}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  620.656830][T15805] overlayfs: conflicting lowerdir path
05:02:17 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x0, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

05:02:18 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0484c39ceb0f958f471ea46695c9db4380b771596729a398339a44a", 0x87)

[  620.754546][T12255] Bluetooth: hci5: command 0x0406 tx timeout
05:02:18 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x200000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:02:18 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  621.464791][T15841] sg_write: data in/out 167162/87 bytes for SCSI command 0xff-- guessing data in;
[  621.464791][T15841]    program syz-executor.5 not setting count and/or reply_len properly
[  621.533480][T12255] usb 2-1: new low-speed USB device number 45 using dummy_hcd
05:02:18 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, 0x0, 0x0)

[  621.945997][T15847] IPVS: ftp: loaded support on port[0] = 21
[  622.013874][T12255] usb 2-1: No LPM exit latency info found, disabling LPM.
[  622.030295][T15850] overlayfs: failed to resolve './file1': -2
[  622.094903][T12255] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10
[  622.106262][T12255] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  622.116652][T12255] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 is Bulk; changing to Interrupt
[  622.126926][T12255] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 is Bulk; changing to Interrupt
[  622.137017][T12255] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0
[  622.295016][T15849] overlayfs: conflicting lowerdir path
[  623.464860][ T1432] tipc: TX() has been purged, node left!
05:02:20 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}]}, 0x24}}, 0x24000000)

05:02:20 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0484c39ceb0f958f471ea46695c9db4380b771596729a398339a44a13da2e965c876ef1b8b88bdbac20", 0x95)

05:02:20 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x400000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:02:20 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, 0x0, 0x0)

05:02:20 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  623.843810][T12255] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  623.853165][T12255] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  624.004670][T12255] usb 2-1: can't set config #1, error -71
[  624.087396][T15885] IPVS: ftp: loaded support on port[0] = 21
[  624.092526][T12255] usb 2-1: USB disconnect, device number 45
[  624.197623][T15886] overlayfs: conflicting lowerdir path
05:02:21 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, 0x0, 0x0)

[  624.350020][T15886] overlayfs: conflicting lowerdir path
[  624.448373][T15896] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  624.455797][T15896] IPv6: NLM_F_CREATE should be set when creating new route
05:02:21 executing program 1:
clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0)
ptrace$setopts(0x4206, r2, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x11e, 0x11e, 0x8, [@func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x4, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}]}, @datasec={0x0, 0x6, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}, {}], "18"}, @datasec={0x0, 0x5, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}], 'u'}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, 0x0, 0x140}, 0x20)
process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0)
tkill(r2, 0x40)
ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080))
ptrace$cont(0x7, r2, 0x0, 0x0)

05:02:21 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0484c39ceb0f958f471ea46695c9db4380b771596729a398339a44a13da2e965c876ef1b8b88bdbac20", 0x95)

05:02:21 executing program 1:
r0 = syz_open_procfs(0x0, &(0x7f0000000040))
fcntl$notify(r0, 0x402, 0xb1c661d318500c40)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fcntl$notify(r0, 0x402, 0x0)

[  624.685997][T15908] ptrace attach of "/root/syz-executor.1"[15907] was attempted by "/root/syz-executor.1"[15908]
05:02:22 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x800000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  624.889220][T15914] sg_write: data in/out 167162/101 bytes for SCSI command 0xff-- guessing data in;
[  624.889220][T15914]    program syz-executor.5 not setting count and/or reply_len properly
05:02:22 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0)

05:02:22 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}]}, 0x24}}, 0x24000000)

05:02:22 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0484c39ceb0f958f471ea46695c9db4380b771596729a398339a44a13da2e965c876ef1b8b88bdbac20", 0x95)

05:02:22 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:02:22 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_SIGNAL_MASK(0xffffffffffffffff, 0x4004ae8b, &(0x7f0000001000)=ANY=[@ANYBLOB="61cf"])
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text16={0x10, 0x0}], 0x1, 0x6b, 0x0, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil})
ioctl$KVM_RUN(r2, 0xae80, 0x0)

[  625.732371][T15933] overlayfs: conflicting lowerdir path
[  625.806590][T15945] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  625.814159][T15945] IPv6: NLM_F_CREATE should be set when creating new route
[  625.891549][T15934] overlayfs: conflicting lowerdir path
[  626.055023][T15948] IPVS: ftp: loaded support on port[0] = 21
05:02:23 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0)

05:02:23 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0484c39ceb0f958f471ea46695c9db4380b771596729a398339a44a13da2e965c876ef1b8b88bdbac20aa265e21480000", 0x9c)

05:02:23 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x24, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}]}, 0x24}}, 0x24000000)

05:02:23 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xbf6190, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  626.562152][T15960] sg_write: data in/out 167162/108 bytes for SCSI command 0xff-- guessing data in;
[  626.562152][T15960]    program syz-executor.5 not setting count and/or reply_len properly
05:02:23 executing program 1:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xd, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x2c}, [@ldst={0x6, 0x0, 0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195}, 0x48)

05:02:24 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0)

05:02:24 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:02:24 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0484c39ceb0f958f471ea46695c9db4380b771596729a398339a44a13da2e965c876ef1b8b88bdbac20aa265e21480000", 0x9c)

[  627.201497][T15990] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  627.208973][T15990] IPv6: NLM_F_CREATE should be set when creating new route
05:02:24 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev}]}, 0x38}}, 0x24000000)

[  627.479466][T15991] overlayfs: conflicting lowerdir path
[  627.581214][T15994] overlayfs: conflicting lowerdir path
[  627.709887][T16000] sg_write: data in/out 167162/108 bytes for SCSI command 0xff-- guessing data in;
[  627.709887][T16000]    program syz-executor.5 not setting count and/or reply_len properly
[  627.896474][T16002] IPVS: ftp: loaded support on port[0] = 21
05:02:25 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={0x0}}, 0x0)

05:02:25 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xff0700, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:02:25 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0484c39ceb0f958f471ea46695c9db4380b771596729a398339a44a13da2e965c876ef1b8b88bdbac20aa265e21480000", 0x9c)

[  628.666700][T16019] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  628.674214][T16019] IPv6: NLM_F_CREATE should be set when creating new route
05:02:25 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0484c39ceb0f958f471ea46695c9db4380b771596729a398339a44a13da2e965c876ef1b8b88bdbac20aa265e214800000000dd", 0x9f)

05:02:26 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:02:26 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev}]}, 0x38}}, 0x24000000)

[  629.279297][T16037] overlayfs: conflicting lowerdir path
[  629.331331][ T1432] tipc: TX() has been purged, node left!
[  629.371222][ T1432] tipc: TX() has been purged, node left!
[  629.403014][T16039] overlayfs: conflicting lowerdir path
05:02:26 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={0x0}}, 0x0)

[  629.533146][T16044] sg_write: data in/out 167162/111 bytes for SCSI command 0xff-- guessing data in;
[  629.533146][T16044]    program syz-executor.5 not setting count and/or reply_len properly
[  629.690512][T16045] IPVS: ftp: loaded support on port[0] = 21
[  630.169110][T16058] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  630.176623][T16058] IPv6: NLM_F_CREATE should be set when creating new route
05:02:27 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x25]}}}}]})

05:02:27 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x1000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:02:27 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0484c39ceb0f958f471ea46695c9db4380b771596729a398339a44a13da2e965c876ef1b8b88bdbac20aa265e214800000000dd", 0x9f)

05:02:27 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={0x0}}, 0x0)

05:02:27 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev}]}, 0x38}}, 0x24000000)

[  630.776859][T16075] sg_write: data in/out 167162/111 bytes for SCSI command 0xff-- guessing data in;
[  630.776859][T16075]    program syz-executor.5 not setting count and/or reply_len properly
[  630.956563][T16084] overlayfs: failed to resolve './file0/../file0': -2
05:02:28 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0484c39ceb0f958f471ea46695c9db4380b771596729a398339a44a13da2e965c876ef1b8b88bdbac20aa265e214800000000dd", 0x9f)

05:02:28 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2800}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  631.175940][T16089] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  631.183540][T16089] IPv6: NLM_F_CREATE should be set when creating new route
[  631.422818][T16095] tmpfs: Bad value for 'mpol'
05:02:28 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x2000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  631.495957][T16095] tmpfs: Bad value for 'mpol'
05:02:28 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x30, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x30}}, 0x24000000)

[  632.046717][T16108] overlayfs: conflicting lowerdir path
[  632.111717][T16108] overlayfs: conflicting lowerdir path
05:02:30 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:02:30 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0484c39ceb0f958f471ea46695c9db4380b771596729a398339a44a13da2e965c876ef1b8b88bdbac20aa265e214800000000dddc48", 0xa1)

05:02:30 executing program 1:
socket(0x1, 0x803, 0x0)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000280)='ethtool\x00')
sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x20000040)
r0 = socket$inet6(0xa, 0x401000000001, 0x0)
close(r0)
r1 = socket$inet6(0xa, 0x3, 0xff)
connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @local, 0x1}, 0x1c)
socket$netlink(0x10, 0x3, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x6bb9}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = open(&(0x7f0000000100)='./bus\x00', 0x11250c2, 0x0)
r3 = creat(&(0x7f0000000040)='./bus\x00', 0x0)
ftruncate(r3, 0x208200)
sendfile(r0, r2, 0x0, 0x800000000007)

05:02:30 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x3000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:02:30 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2800}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

05:02:30 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x30, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x30}}, 0x24000000)

[  633.455954][T16128] sg_write: data in/out 167162/113 bytes for SCSI command 0xff-- guessing data in;
[  633.455954][T16128]    program syz-executor.5 not setting count and/or reply_len properly
[  633.501518][   T29] audit: type=1800 audit(1597294950.682:16): pid=16121 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.1" name="bus" dev="sda1" ino=16291 res=0
[  633.555373][T16123] overlayfs: conflicting lowerdir path
05:02:31 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2800}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

[  633.877408][T16123] overlayfs: conflicting lowerdir path
05:02:31 executing program 1:
write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000000)={{0x1b, 0x5b, 0x32, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, [{}]}, 0x78)
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$TIOCL_SETVESABLANK(r0, 0x541c, &(0x7f0000000000))

[  634.227418][T16137] IPVS: ftp: loaded support on port[0] = 21
05:02:31 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0484c39ceb0f958f471ea46695c9db4380b771596729a398339a44a13da2e965c876ef1b8b88bdbac20aa265e214800000000dddc", 0xa0)

05:02:31 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x4000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:02:32 executing program 1:
perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x7f, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0)
ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000001c0))

[  634.957398][T16167] sg_write: data in/out 167162/112 bytes for SCSI command 0xff-- guessing data in;
[  634.957398][T16167]    program syz-executor.5 not setting count and/or reply_len properly
05:02:32 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x30, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x30}}, 0x24000000)

05:02:32 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:02:32 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

05:02:32 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0484c39ceb0f958f471ea46695c9db4380b771596729a398339a44a13da2e965c876ef1b8b88bdbac20aa265e214800000000dd", 0x9f)

[  635.341698][T16170] overlayfs: conflicting lowerdir path
[  635.516437][T16173] overlayfs: conflicting lowerdir path
[  635.643157][T16182] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  635.661297][T16182] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[  635.669347][T16182] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
05:02:32 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000001c0)='/dev/input/event#\x00', 0x0, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
dup2(r1, r0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = dup(r2)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)

[  635.812469][T16181] IPVS: ftp: loaded support on port[0] = 21
05:02:33 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newlink={0x20, 0x10, 0x801}, 0x20}}, 0x0)

05:02:33 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x5000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:02:33 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  636.108802][T16187] sg_write: data in/out 167162/111 bytes for SCSI command 0xff-- guessing data in;
[  636.108802][T16187]    program syz-executor.5 not setting count and/or reply_len properly
[  636.403137][ T9067] tipc: TX() has been purged, node left!
05:02:33 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0484c39ceb0f958f471ea46695c9db4380b771596729a398339a44a13da2e965c876ef1b8b88bdbac20aa265e214800000000dd", 0x9f)

05:02:33 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000180)=[@text32={0x20, &(0x7f00000000c0)="b9800000c00f322e0f0178000f309a0900000065002ed8ddc74424008fc4bd87c7442402c43a727fc7442406000000000f011424f30f090f013a360f06c4c18d72d683ed", 0x44}], 0x1, 0x0, 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc62]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x7, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000380)=ANY=[@ANYBLOB="020000000080000001000000000005040000020000000033c458f576e1000000000000092a221ce47549bc00000000000a000000000003000019b11792"])
pipe(&(0x7f0000000000))
ioctl$KVM_RUN(r2, 0xae80, 0x0)

05:02:33 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  636.925230][T16216] overlayfs: conflicting lowerdir path
05:02:34 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newlink={0x20, 0x10, 0x801}, 0x20}}, 0x0)

[  636.988348][T16226] sg_write: data in/out 167162/111 bytes for SCSI command 0xff-- guessing data in;
[  636.988348][T16226]    program syz-executor.5 not setting count and/or reply_len properly
[  637.052592][T16218] overlayfs: conflicting lowerdir path
05:02:34 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000080)="b63db85e1e8d020000000000403ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a93edbaf1447ed27f5a19b43e60e0f553fdb2dcde1afd1a6f1365333a608571cda624e45f0ba6f3775945b775f43757bd42cb7ee45a407d1df0385ee0484c39ceb0f958f471ea46695c9db4380b771596729a398339a44a13da2e965c876ef1b8b88bdbac20aa265e214800000000dd", 0x9f)

[  637.321664][T16235] IPVS: ftp: loaded support on port[0] = 21
05:02:34 executing program 1:
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="6653070000053c27bc3376003239405cb4ae24f12f0000001500", 0x1a}], 0x4, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
tkill(r0, 0x3d)
ptrace$cont(0x18, r0, 0x0, 0x0)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x20, r0, 0x0, 0x0)

05:02:34 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x6000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:02:35 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, 0x0, 0x0)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:02:35 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newlink={0x20, 0x10, 0x801}, 0x20}}, 0x0)

05:02:35 executing program 1:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000680)={'gre0\x00', &(0x7f00000005c0)=ANY=[@ANYBLOB='syztnl1\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="2100000000000000000000004500001400000000002f"]})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={<r1=>0xffffffffffffffff})
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000000)={'syztnl1\x00', &(0x7f0000000040)=ANY=[@ANYBLOB="72fd57793ff3062c000000ffcf5ae3c51d938fd032"]})

[  637.961240][T16262] ptrace attach of "/root/syz-executor.1"[16261] was attempted by "/root/syz-executor.1"[16262]
05:02:35 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  638.108373][T16265] sg_write: data in/out 167162/111 bytes for SCSI command 0xff-- guessing data in;
[  638.108373][T16265]    program syz-executor.5 not setting count and/or reply_len properly
[  638.452316][T16267] overlayfs: conflicting lowerdir path
[  638.600943][T16274] IPVS: ftp: loaded support on port[0] = 21
05:02:36 executing program 5:
clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0)
ptrace$setopts(0x4206, r2, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x13a, 0x13a, 0x8, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @enum={0x0, 0x1, 0x0, 0x6, 0x4, [{}]}, @union={0x0, 0x4, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}]}, @datasec={0x0, 0x6, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}, {}], "18"}, @datasec={0x0, 0x5, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}], 'u'}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, 0x0, 0x15c}, 0x20)
process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0)
tkill(r2, 0x40)
ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080))
ptrace$cont(0x7, r2, 0x0, 0x0)

[  638.812443][T16267] overlayfs: conflicting lowerdir path
05:02:36 executing program 3:
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="6653070000053c27bc3376003239405cb4ae24f12f0000001500ae47a8", 0x1d}], 0x4, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
tkill(r0, 0x3d)
ptrace$cont(0x18, r0, 0x0, 0x0)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78, 0x0, 0x0, {0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0xee00}}}, 0x78)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x20, r0, 0x0, 0x0)

05:02:36 executing program 1:
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x88, 0xa, 0x0, 0x0)
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000001580)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000002c3f2cc2b7954244cef7499cde2bbaf4b06d3585a09a87507ebf4e43bc06"], &(0x7f0000000340)='syzkaller\x00'}, 0x48)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r0, 0x18000000000002e0, 0x69, 0x20000000, &(0x7f00000004c0)="b95b03b700030000009e40f086dd1fff060000000000000177fbac141412e0000001c699da153f08e0e6e380f60108f683317585d7473f1cab4439f0f570ff155bc5f73ba3f8bb99a6e8ded1ce485cf058105cd981b42493481cd659416a2e10c9119664f36eb00b333c20c9ec0c222d644bdcb178c1cc53d6960fbb842d6a33dfcde3a1e1848135214baf139753866cadcbe3ce52505e992818cc452bee339d9ab076f484020eaa348a21d7911e4c44905256ec2cc54cca47a198b00c10aff62a4bed43a2ebcad92743fb22c593f28fd4bb7c703cde9cae0569d4c8d9a823f2c12863f7a6c0cf88ed22aae4f6f084508833b61429a25773eedf63dd9f33d430f2a0a30a7761db16fe0f743b95ded898c28aac1256ce2751b3d738899b8b19d9052b7f13ff94", 0x0, 0xfd, 0x6000000000000000, 0xfffffffffffffe7e, 0x1d4}, 0x28)

05:02:36 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x7000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:02:36 executing program 3:
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="6653070000053c27bc3376003239405cb4ae24f12f0000001500ae47a825", 0x1e}], 0x4, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
tkill(r0, 0x3d)
ptrace$cont(0x18, r0, 0x0, 0x0)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78, 0x0, 0x0, {0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xee00}}}, 0x78)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x20, r0, 0x0, 0x0)

[  639.597041][T16312] ptrace attach of "/root/syz-executor.3"[16311] was attempted by "/root/syz-executor.3"[16312]
05:02:36 executing program 5:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = fcntl$dupfd(r0, 0x0, r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="552968034bfa", @dev, @void, {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @multicast, @dev, @empty, @local}}}}, 0x0)

05:02:37 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, 0x0, 0x0)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:02:37 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x24000000)

[  640.046106][T16320] ptrace attach of "/root/syz-executor.3"[16319] was attempted by "/root/syz-executor.3"[16320]
05:02:37 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x3a]}}}, 0x33}]})

[  640.373776][T16325] overlayfs: conflicting lowerdir path
[  640.489696][T16327] overlayfs: conflicting lowerdir path
[  640.601056][T16329] IPVS: ftp: loaded support on port[0] = 21
05:02:37 executing program 5:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = dup2(r0, r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0xa}}}}]})

[  640.759884][T16334] tmpfs: Bad value for 'mpol'
05:02:38 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x8000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  640.942677][T16334] tmpfs: Bad value for 'mpol'
05:02:38 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x3a]}}}, 0x33}]})

05:02:38 executing program 1:
perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
tkill(r0, 0x3c)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000400)={0x3, {{0x2, 0x0, @multicast1}}}, 0x90)
bpf$PROG_LOAD(0x5, 0x0, 0x0)

[  641.446647][T16354] tmpfs: Bad value for 'mpol'
[  641.552193][T16368] tmpfs: Bad value for 'mpol'
05:02:38 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x0)

05:02:38 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, 0x0, 0x0)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:02:39 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x3a]}}}, 0x33}]})

05:02:39 executing program 5:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = dup2(r0, r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0xa}}}}]})

05:02:39 executing program 1:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = dup2(r0, r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x3a]}}}}]})

[  642.147726][ T9067] tipc: TX() has been purged, node left!
[  642.216431][ T9067] tipc: TX() has been purged, node left!
[  642.243989][T16379] overlayfs: conflicting lowerdir path
[  642.505951][T16390] tmpfs: Bad value for 'mpol'
[  642.580161][T16383] IPVS: ftp: loaded support on port[0] = 21
[  642.602868][T16382] overlayfs: conflicting lowerdir path
[  642.729946][T16394] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  642.737656][T16394] IPv6: NLM_F_CREATE should be set when creating new route
[  642.862552][T16397] tmpfs: Bad value for 'mpol'
05:02:40 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x8040000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  642.886139][T16398] tmpfs: Bad value for 'mpol'
05:02:40 executing program 5:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = dup2(r0, r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0xa}}}}]})

05:02:40 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x3a]}}}, 0x33}]})

05:02:40 executing program 1:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = dup2(r0, r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x3a]}}}}]})

05:02:40 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x0)

[  643.731167][T16428] tmpfs: Bad value for 'mpol'
05:02:41 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  643.799281][T16427] overlayfs: conflicting lowerdir path
[  644.001348][T16435] tmpfs: Bad value for 'mpol'
[  644.009156][T16427] overlayfs: conflicting lowerdir path
05:02:41 executing program 5:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = dup2(r0, r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0xa}}}}]})

[  644.128876][T16437] tmpfs: Bad value for 'mpol'
05:02:41 executing program 3:
syz_mount_image$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x3a]}}}, 0x33}]})

05:02:41 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x9000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  644.450846][T16444] IPVS: ftp: loaded support on port[0] = 21
[  644.522951][T16448] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  644.530545][T16448] IPv6: NLM_F_CREATE should be set when creating new route
05:02:42 executing program 1:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = dup2(r0, r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x3a]}}}}]})

05:02:42 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3f)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r4, @ANYBLOB="03000016010000001800120008000100736974000c00020008000300", @ANYRES32=r5], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@ipv6_getroute={0x38, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, [], 0x2d}}]}, 0x38}}, 0x0)

[  645.136984][T16463] tmpfs: Bad value for 'mpol'
[  645.217484][T16471] overlayfs: failed to resolve './file0/../file0': -2
[  645.465776][T16487] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  645.473403][T16487] IPv6: NLM_F_CREATE should be set when creating new route
05:02:42 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  645.521031][T16475] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
[  645.540646][T16471] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
05:02:42 executing program 3:
syz_mount_image$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x3a]}}}, 0x33}]})

05:02:42 executing program 5:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
dup2(r0, r0)
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0xa}}}}]})

05:02:43 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xa000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  645.887051][T16490] tmpfs: Bad value for 'mpol'
[  646.267507][T16494] IPVS: ftp: loaded support on port[0] = 21
05:02:43 executing program 1:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = dup2(r0, r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x3a]}}}}]})

[  646.571026][T16502] tmpfs: Bad value for 'mpol'
05:02:44 executing program 2:
r0 = socket$unix(0x1, 0x1, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup2(r1, r0)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$inet6_group_source_req(r3, 0x29, 0x2e, &(0x7f0000000000)={0x8, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast2}}}, 0x108)
setsockopt$inet6_MCAST_MSFILTER(r3, 0x29, 0x30, &(0x7f00000002c0)=ANY=[@ANYBLOB="08000000000000000a00000000000000ff010000000000000000000000000001"], 0x490)

05:02:44 executing program 3:
syz_mount_image$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x3a]}}}, 0x33}]})

[  647.018369][T16521] overlayfs: conflicting lowerdir path
05:02:44 executing program 5:
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0xa}}}}]})

[  647.115663][T16522] overlayfs: conflicting lowerdir path
[  647.160218][T16526] tmpfs: Bad value for 'mpol'
05:02:44 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xb000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:02:44 executing program 1:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
dup2(r0, r0)
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x3a]}}}}]})

05:02:44 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:02:44 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x3a]}}}, 0x33}]})

[  647.803416][T16543] overlayfs: conflicting lowerdir path
[  647.845607][T16545] tmpfs: Bad value for 'mpol'
[  647.901635][T16542] overlayfs: conflicting lowerdir path
05:02:45 executing program 2:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x187201, 0x0)

05:02:45 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0xa}}}}]})

05:02:45 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xc000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  648.367532][T16552] IPVS: ftp: loaded support on port[0] = 21
[  648.511727][T16555] tmpfs: Bad value for 'mpol'
05:02:46 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x3a]}}}, 0x33}]})

[  648.985154][T16569] tmpfs: Bad value for 'mpol'
05:02:46 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:02:46 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a", 0x30)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

05:02:46 executing program 1:
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x3a]}}}}]})

05:02:46 executing program 5:
syz_mount_image$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0xa}}}}]})

[  649.523086][T16590] overlayfs: conflicting lowerdir path
[  649.638470][T16595] overlayfs: conflicting lowerdir path
05:02:46 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x3a]}}}, 0x33}]})

[  649.727528][T16596] IPVS: ftp: loaded support on port[0] = 21
05:02:47 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xd000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  650.202409][ T9067] tipc: TX() has been purged, node left!
[  650.210824][T16605] tmpfs: Bad value for 'mpol'
05:02:47 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a", 0x30)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

[  650.245252][ T9067] tipc: TX() has been purged, node left!
05:02:47 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x3a]}}}}]})

05:02:47 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)

05:02:47 executing program 5:
syz_mount_image$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0xa}}}}]})

[  650.938141][T16635] overlayfs: conflicting lowerdir path
05:02:48 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a", 0x30)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

[  651.085964][T16638] overlayfs: conflicting lowerdir path
[  651.091685][T16645] tmpfs: Bad value for 'mpol'
05:02:48 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xe000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  651.657742][T16662] overlayfs: conflicting lowerdir path
[  651.722211][T16664] overlayfs: conflicting lowerdir path
05:02:50 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:02:50 executing program 1:
syz_mount_image$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x3a]}}}}]})

05:02:50 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)

05:02:50 executing program 5:
syz_mount_image$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0xa}}}}]})

05:02:50 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a", 0x30)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

05:02:50 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x10000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:02:50 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

05:02:50 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0xa}}}}]})

[  653.363077][T16684] overlayfs: conflicting lowerdir path
05:02:50 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)

[  653.467750][T16688] IPVS: ftp: loaded support on port[0] = 21
[  653.489087][T16686] overlayfs: conflicting lowerdir path
05:02:50 executing program 1:
syz_mount_image$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x3a]}}}}]})

05:02:51 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x11000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:02:51 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:02:51 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0xa}}}}]})

[  654.591288][T16725] IPVS: ftp: loaded support on port[0] = 21
[  654.665588][T16724] overlayfs: conflicting lowerdir path
05:02:52 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

05:02:52 executing program 1:
syz_mount_image$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x3a]}}}}]})

[  655.072244][T16724] overlayfs: conflicting lowerdir path
05:02:52 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040))

05:02:52 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x12000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:02:52 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0xa}}}}]})

05:02:52 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, 0x0)
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  655.685087][ T9067] tipc: TX() has been purged, node left!
05:02:53 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x3a]}}}}]})

05:02:53 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040))

05:02:53 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)

[  656.300067][T16775] overlayfs: conflicting lowerdir path
[  656.474123][T16779] IPVS: ftp: loaded support on port[0] = 21
05:02:53 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

[  656.657948][T16778] overlayfs: conflicting lowerdir path
05:02:54 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x13000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:02:54 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x3a]}}}}]})

05:02:54 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)

05:02:54 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040))

05:02:54 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, 0x0)
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:02:55 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x3a]}}}}]})

[  657.960417][T16824] overlayfs: conflicting lowerdir path
[  658.140007][T16831] IPVS: ftp: loaded support on port[0] = 21
05:02:55 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)

[  658.237675][T16823] overlayfs: conflicting lowerdir path
05:02:55 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38]}}}, 0x33}]})

05:02:55 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x20000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:02:55 executing program 2:
write(0xffffffffffffffff, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a", 0x30)
readv(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

05:02:56 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)

[  659.051275][T16850] tmpfs: Bad value for 'mpol'
05:02:56 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040))

05:02:56 executing program 2:
write(0xffffffffffffffff, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a", 0x30)
readv(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

[  659.338192][T16858] overlayfs: failed to resolve './file0/../file0': -2
05:02:56 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38]}}}, 0x33}]})

[  659.382391][T16861] overlayfs: failed to resolve './file0': -2
05:02:56 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)

[  659.499168][T16861] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
[  659.532509][T16858] overlayfs: conflicting lowerdir path
05:02:56 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, 0x0)
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:02:57 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x20100000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:02:57 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040))

[  660.307978][T16889] tmpfs: Bad value for 'mpol'
[  660.377164][T16892] IPVS: ftp: loaded support on port[0] = 21
05:02:57 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)

05:02:57 executing program 2:
write(0xffffffffffffffff, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a", 0x30)
readv(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

[  660.664664][ T9067] tipc: TX() has been purged, node left!
[  660.699507][ T9067] tipc: TX() has been purged, node left!
05:02:57 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38]}}}, 0x33}]})

[  660.897867][T16898] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
[  661.013317][T16895] overlayfs: conflicting lowerdir path
05:02:58 executing program 2:
r0 = syz_open_dev$sg(0x0, 0x0, 0x10008002)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a", 0x30)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

[  661.301535][T16898] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
[  661.473869][T16895] overlayfs: conflicting lowerdir path
05:02:58 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:02:58 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040))

[  661.738327][T16931] tmpfs: Bad value for 'mpol'
05:02:58 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040))

05:02:59 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x22000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:02:59 executing program 2:
r0 = syz_open_dev$sg(0x0, 0x0, 0x10008002)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a", 0x30)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

05:02:59 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x0]}}}, 0x33}]})

[  662.394516][T16938] IPVS: ftp: loaded support on port[0] = 21
[  662.541428][T16945] tmpfs: Bad value for 'mpol'
05:02:59 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040))

[  662.931916][T16954] overlayfs: conflicting lowerdir path
05:03:00 executing program 2:
r0 = syz_open_dev$sg(0x0, 0x0, 0x10008002)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a", 0x30)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

[  663.134562][T16959] overlayfs: conflicting lowerdir path
05:03:00 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x0]}}}, 0x33}]})

05:03:00 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:03:00 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x24000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:03:00 executing program 5:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/uts\x00')
syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/uts\x00')

[  663.804057][T16986] tmpfs: Bad value for 'mpol'
05:03:01 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x0]}}}, 0x33}]})

05:03:01 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040))

05:03:01 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x0)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a", 0x30)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

[  664.187912][T16993] IPVS: ftp: loaded support on port[0] = 21
05:03:01 executing program 5:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x3a]}}}}]})

[  664.516255][T16996] overlayfs: conflicting lowerdir path
[  664.678559][T16997] overlayfs: conflicting lowerdir path
[  664.787761][T17002] tmpfs: Bad value for 'mpol'
[  664.993847][T17008] tmpfs: Bad value for 'mpol'
[  665.067467][T17008] tmpfs: Bad value for 'mpol'
05:03:02 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:03:02 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x25000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:03:02 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x3a]}}}, 0x33}]})

05:03:02 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38]}}}}]})

05:03:02 executing program 5:
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x86a01780, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup2(r1, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xf5, 0xf5, 0x4, [@datasec={0x0, 0xa, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 'x'}, @datasec={0x0, 0x4, 0x0, 0xf, 0x3, [{}, {}, {}, {}], "1f0000"}, @ptr, @datasec={0x0, 0x2, 0x0, 0xf, 0x1, [{}, {}], '\"'}]}, {0x0, [0x0, 0x0]}}, 0x0, 0x114}, 0x20)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x0, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
tkill(r0, 0x33)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x7, r0, 0x0, 0x0)

05:03:03 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x0)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a", 0x30)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

[  665.806507][T17038] IPVS: ftp: loaded support on port[0] = 21
[  666.147746][T17043] tmpfs: Bad value for 'mpol'
[  666.305859][T17054] overlayfs: conflicting lowerdir path
05:03:03 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x3a]}}}, 0x33}]})

[  666.388719][T17058] tmpfs: Bad value for 'mpol'
[  666.422932][T17056] overlayfs: conflicting lowerdir path
05:03:03 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000180)=[@text32={0x20, &(0x7f00000000c0)="b9800000c00f322e0f0178000f309a0900000065002ed8ddc74424008fc4bd87c7442402c43a727fc7442406000000000f011424f30f090f013a360f06c4c18d72d683ed", 0x44}], 0x1, 0x0, 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xc62]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000380)=ANY=[@ANYBLOB])
ioctl$KVM_RUN(r2, 0xae80, 0x0)

05:03:03 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38]}}}}]})

05:03:03 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x2c000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:03:04 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, 0x0, &(0x7f0000000380))
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  666.997997][T17079] tmpfs: Bad value for 'mpol'
[  667.255352][T17091] tmpfs: Bad value for 'mpol'
05:03:04 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x3a]}}}, 0x33}]})

05:03:04 executing program 5:
socket$vsock_stream(0x28, 0x1, 0x0)
socket$vsock_stream(0x28, 0x1, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000080)=0x1000)
pipe(&(0x7f0000000080))
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0)
socket$nl_route(0x10, 0x3, 0x0)

05:03:04 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38]}}}}]})

[  667.473035][T17093] overlayfs: conflicting lowerdir path
[  667.589435][T17096] overlayfs: conflicting lowerdir path
[  667.693213][T17097] IPVS: ftp: loaded support on port[0] = 21
05:03:04 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x0)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a", 0x30)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

05:03:05 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x2f000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  668.406612][T17121] tmpfs: Bad value for 'mpol'
[  668.412164][ T9067] tipc: TX() has been purged, node left!
[  668.421512][T17118] tmpfs: Bad value for 'mpol'
[  668.457862][ T9067] tipc: TX() has been purged, node left!
[  668.509188][ T9067] tipc: TX() has been purged, node left!
[  668.594329][ T9067] tipc: TX() has been purged, node left!
05:03:05 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x0]}}}}]})

05:03:06 executing program 5:
clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0)
ptrace$setopts(0x4206, r2, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x126, 0x126, 0x8, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x4, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}]}, @datasec={0x0, 0x6, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}, {}], "18"}, @datasec={0x0, 0x5, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}], 'u'}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, 0x0, 0x148}, 0x20)
process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0)
tkill(r2, 0x40)
ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080))
ptrace$cont(0x7, r2, 0x0, 0x0)

05:03:06 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x0, 0x3a]}}}, 0x33}]})

05:03:06 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, 0x0, &(0x7f0000000380))
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  669.064226][T17138] overlayfs: conflicting lowerdir path
[  669.259022][T17138] overlayfs: conflicting lowerdir path
[  669.285020][T17145] tmpfs: Bad value for 'mpol'
[  669.364864][T17147] tmpfs: Bad value for 'mpol'
05:03:06 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x30000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:03:06 executing program 5:
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000280)="6653070000053c27bc3376003639405cb4aed12f0000001500ae47a825d86800278dcff47d010000805acf4f8f36460234432479aed75d492b415bcee00a06dc9d8e99adaf81dcfc6afd983f79e65199615607676f8f9fc0ebf8b0b16d6f2c59957ab364884b3c5d05692e664ebf68e6faa53367f05f4ad6142134b62f11e931e7d62ead037cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f480800b1ed19bca008388e736e518b98d91c22def1125d7b1e821039a9f3e0b5556a985900"/241, 0xf1}], 0x4, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
tkill(r0, 0x3d)
write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78, 0x0, 0x0, {0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}}, 0xb2)
ptrace$cont(0x18, r0, 0x0, 0x0)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x1f, r0, 0x0, 0x0)

[  669.603092][T17152] IPVS: ftp: loaded support on port[0] = 21
05:03:06 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(0xffffffffffffffff, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a", 0x30)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

05:03:07 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x0, 0x3a]}}}, 0x33}]})

05:03:07 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x0]}}}}]})

05:03:07 executing program 5:
r0 = socket$inet6(0xa, 0x401000000001, 0x0)
close(r0)
r1 = socket$inet6(0xa, 0x3, 0xff)
connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @local, 0x1}, 0x1c)
perf_event_open(&(0x7f00000003c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r2 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0)
perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, r2, 0x0)
perf_event_open(0x0, 0x0, 0x0, r2, 0x0)
r3 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(0x0, 0x0, 0x0, r3, 0x0)
perf_event_open(&(0x7f0000000600)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, r3, 0x0)
ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, 0x0)
r4 = open(&(0x7f0000000100)='./bus\x00', 0x11250c2, 0x0)
r5 = creat(&(0x7f0000000040)='./bus\x00', 0x0)
ftruncate(r5, 0x208200)
sendfile(r0, r4, 0x0, 0x800000000007)

[  669.968911][T17157] ptrace attach of "/root/syz-executor.5"[17156] was attempted by "/root/syz-executor.5"[17157]
[  670.336158][T17162] tmpfs: Bad value for 'mpol'
[  670.458183][T17165] overlayfs: conflicting lowerdir path
[  670.475792][T17172] tmpfs: Bad value for 'mpol'
05:03:07 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x0, 0x3a]}}}, 0x33}]})

[  670.685901][T17165] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
[  670.707779][T17173] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
05:03:08 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x38, 0x0]}}}}]})

[  670.848490][   T29] audit: type=1800 audit(1597294988.034:17): pid=17193 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.5" name="bus" dev="sda1" ino=15751 res=0
05:03:08 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(0xffffffffffffffff, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a", 0x30)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

05:03:08 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x3a000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:03:08 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, 0x0, &(0x7f0000000380))
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:03:08 executing program 5:
r0 = socket$inet6(0xa, 0x401000000001, 0x0)
close(r0)
r1 = socket$inet6(0xa, 0x3, 0xff)
connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @local, 0x1}, 0x1c)
perf_event_open(&(0x7f00000003c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r2 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0)
perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, r2, 0x0)
perf_event_open(0x0, 0x0, 0x0, r2, 0x0)
r3 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(0x0, 0x0, 0x0, r3, 0x0)
perf_event_open(&(0x7f0000000600)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, r3, 0x0)
ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, 0x0)
r4 = open(&(0x7f0000000100)='./bus\x00', 0x11250c2, 0x0)
r5 = creat(&(0x7f0000000040)='./bus\x00', 0x0)
ftruncate(r5, 0x208200)
sendfile(r0, r4, 0x0, 0x800000000007)

[  671.330429][T17199] tmpfs: Bad value for 'mpol'
[  671.394726][T17201] tmpfs: Bad value for 'mpol'
05:03:08 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x38, 0x3a]}}}, 0x33}]})

05:03:08 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x3a]}}}}]})

[  671.936192][T17210] IPVS: ftp: loaded support on port[0] = 21
[  671.956961][   T29] audit: type=1800 audit(1597294989.144:18): pid=17212 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.5" name="bus" dev="sda1" ino=15889 res=0
[  672.319287][T17216] tmpfs: Bad value for 'mpol'
05:03:09 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000032000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, &(0x7f0000000140)="b9800000c00f3235010000000f309a090000006500660f3882af724d00002ed8ddc74424008fc4bd87c7442402c43a727fc7442406000000000f011424f30f090f013a360f06c4c18d72d68366baa100ed", 0x51}], 0x1, 0x0, 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
perf_event_open(&(0x7f0000000780)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x40000007, 0x0, 0x0, 0x0, 0x4cb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

[  672.567696][T17221] tmpfs: Bad value for 'mpol'
[  672.571903][T17215] overlayfs: conflicting lowerdir path
[  672.700569][T17220] overlayfs: conflicting lowerdir path
05:03:10 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(0xffffffffffffffff, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a", 0x30)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

05:03:10 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x3a]}}}}]})

05:03:10 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x38, 0x3a]}}}, 0x33}]})

05:03:10 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x3f000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  673.300876][T17254] tmpfs: Bad value for 'mpol'
05:03:10 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, 0x0)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:03:10 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x3a]}}}}]})

[  673.634903][T17259] tmpfs: Bad value for 'mpol'
[  673.997386][T17264] overlayfs: conflicting lowerdir path
[  674.212305][T17269] IPVS: ftp: loaded support on port[0] = 21
[  674.247511][T17264] overlayfs: conflicting lowerdir path
05:03:11 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, 0x0, 0x0)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

05:03:11 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x38, 0x3a]}}}, 0x33}]})

[  674.454301][T17275] tmpfs: Bad value for 'mpol'
05:03:11 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000032000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, &(0x7f0000000140)="b9800000c00f3235010000000f309a090000006500660f3882af724d00002ed8ddc74424008fc4bd87c7442402c43a727fc7442406000000000f011424f30f090f013a360f06c4c18d72d68366baa100ed", 0x51}], 0x1, 0x0, 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
perf_event_open(&(0x7f0000000780)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x40000007, 0x0, 0x0, 0x0, 0x4cb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

05:03:11 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x40000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:03:12 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x0, 0x3a]}}}}]})

[  674.905185][T17284] tmpfs: Bad value for 'mpol'
05:03:12 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x0, 0x38, 0x3a]}}}, 0x33}]})

[  675.510099][T17313] tmpfs: Bad value for 'mpol'
05:03:12 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, 0x0)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  675.624591][ T9067] tipc: TX() has been purged, node left!
[  675.676849][ T9067] tipc: TX() has been purged, node left!
[  675.729964][T17314] overlayfs: conflicting lowerdir path
05:03:13 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x0, 0x3a]}}}}]})

[  675.773472][ T9067] tipc: TX() has been purged, node left!
[  675.835160][T17316] overlayfs: conflicting lowerdir path
[  675.841735][T17321] tmpfs: Bad value for 'mpol'
05:03:13 executing program 5:
recvmmsg(0xffffffffffffffff, &(0x7f0000003000)=[{{&(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, 0x0}}], 0x1, 0x0, 0x0)
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='attr/exec\x00')
preadv(r2, &(0x7f00000017c0), 0x315, 0x0, 0x0)

05:03:13 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, 0x0, 0x0)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

05:03:13 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x0, 0x38, 0x3a]}}}, 0x33}]})

05:03:13 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x40000800, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  676.324089][T17326] IPVS: ftp: loaded support on port[0] = 21
[  676.411962][T17329] tmpfs: Bad value for 'mpol'
05:03:13 executing program 5:
clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = socket$inet6(0xa, 0x2, 0x0)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f0000000040)=@raw={'raw\x00', 0x2, 0x3, 0x248, 0xd0, 0xd0, 0x0, 0xd0, 0xd0, 0x1b0, 0x1b0, 0x1b0, 0x1b0, 0x1b0, 0x3, 0x0, {[{{@ip={@local, @dev, 0x0, 0xffffffff, '\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @dev}}}, {{@uncond, 0x0, 0x98, 0xe0, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x2a8)

05:03:14 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x2d, 0x0, 0x3a]}}}}]})

[  677.037453][T17352] tmpfs: Bad value for 'mpol'
[  677.308316][T17366] tmpfs: Bad value for 'mpol'
[  677.336161][T17363] overlayfs: conflicting lowerdir path
05:03:14 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000032000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, &(0x7f0000000140)="b9800000c00f3235010000000f309a090000006500660f3882af724d00002ed8ddc74424008fc4bd87c7442402c43a727fc7442406000000000f011424f30f090f013a360f06c4c18d72d68366baa100ed", 0x51}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
perf_event_open(&(0x7f0000000780)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x4, 0x0, 0x40000007, 0x0, 0x0, 0x0, 0x4cb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='ns\x00')
sendmsg$IPVS_CMD_GET_DAEMON(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x804}, 0x0)
perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, @perf_bp={0x0, 0xc}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

05:03:14 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, 0x0, 0x0)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

05:03:14 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x0, 0x38, 0x3a]}}}, 0x33}]})

[  677.588074][T17363] overlayfs: conflicting lowerdir path
05:03:14 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, 0x0)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:03:14 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x38, 0x3a]}}}}]})

05:03:15 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x48000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  678.071869][T17383] kvm [17376]: vcpu0, guest rIP: 0x14c Hyper-V unhandled wrmsr: 0x40000040 data 0xf
[  678.088846][T17383] kvm [17376]: vcpu0, guest rIP: 0x14c Hyper-V unhandled wrmsr: 0x4000008d data 0xbb
[  678.107832][T17385] tmpfs: Bad value for 'mpol'
[  678.116486][T17383] kvm [17376]: vcpu0, guest rIP: 0x14c Hyper-V unhandled wrmsr: 0x4000008a data 0x45
[  678.127662][T17383] kvm [17376]: vcpu0, guest rIP: 0x14c Hyper-V unhandled wrmsr: 0x40000017 data 0x77
[  678.306431][T17384] IPVS: ftp: loaded support on port[0] = 21
[  678.384886][T17383] kvm [17376]: vcpu0, guest rIP: 0x14c Hyper-V unhandled wrmsr: 0x4000003b data 0x2f
05:03:15 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x2d, 0x38, 0x3a]}}}, 0x33}]})

[  678.433363][T17383] kvm [17376]: vcpu0, guest rIP: 0x14c Hyper-V unhandled wrmsr: 0x4000008d data 0x77
[  678.496574][T17383] kvm [17376]: vcpu0, guest rIP: 0x14c Hyper-V unhandled wrmsr: 0x4000001b data 0x1b
[  678.558671][T17383] kvm [17376]: vcpu0, guest rIP: 0x14c Hyper-V unhandled wrmsr: 0x4000008a data 0x37
[  678.607078][T17383] kvm [17376]: vcpu0, guest rIP: 0x14c Hyper-V unhandled wrmsr: 0x40000017 data 0xd7
[  678.652471][T17383] kvm [17376]: vcpu0, guest rIP: 0x14c Hyper-V unhandled wrmsr: 0x4000001b data 0x2f
[  678.728315][T17391] overlayfs: conflicting lowerdir path
[  678.790437][T17383] kvm [17376]: vcpu0, guest rIP: 0x145 Hyper-V unhandled rdmsr: 0x4000008d
[  678.969640][T17392] overlayfs: conflicting lowerdir path
05:03:16 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000140), 0x0)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

[  679.351500][T17422] tmpfs: Bad value for 'mpol'
05:03:16 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x4c000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:03:16 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x0, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:03:16 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000032000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, &(0x7f0000000140)="b9800000c00f3235010000000f309a090000006500660f3882af724d00002ed8ddc74424008fc4bd87c7442402c43a727fc7442406000000000f011424f30f090f013a360f06c4c18d72d68366baa100ed", 0x51}], 0x1, 0x0, 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
perf_event_open(&(0x7f0000000780)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x40000007, 0x0, 0x0, 0x0, 0x4cb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
sendmsg$IPVS_CMD_GET_DAEMON(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

05:03:16 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x2d, 0x38, 0x3a]}}}, 0x33}]})

[  680.036548][T17431] IPVS: ftp: loaded support on port[0] = 21
[  680.220297][T17433] overlayfs: conflicting lowerdir path
[  680.310921][T17437] kvm [17428]: vcpu0, guest rIP: 0x145 Hyper-V unhandled rdmsr: 0x40000007
[  680.337421][T17434] overlayfs: conflicting lowerdir path
[  680.369901][T17437] kvm [17428]: vcpu0, guest rIP: 0x145 Hyper-V unhandled rdmsr: 0x40000007
05:03:17 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000140), 0x0)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

[  680.448400][T17437] kvm [17428]: vcpu0, guest rIP: 0x145 Hyper-V unhandled rdmsr: 0x40000007
[  680.475457][T17441] tmpfs: Bad value for 'mpol'
[  680.552990][T17437] kvm [17428]: vcpu0, guest rIP: 0x145 Hyper-V unhandled rdmsr: 0x40000007
[  680.638404][T17437] kvm [17428]: vcpu0, guest rIP: 0x145 Hyper-V unhandled rdmsr: 0x40000007
[  680.712819][T17437] kvm [17428]: vcpu0, guest rIP: 0x145 Hyper-V unhandled rdmsr: 0x40000007
05:03:18 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x2d, 0x38, 0x3a]}}}, 0x33}]})

05:03:18 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x4f820000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:03:18 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x44, 0x0, &(0x7f00000003c0)=[@reply={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x4d, 0x741000, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000180)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, &(0x7f0000000440)="61aff9b8073253ec0c2821e9ae5a5b221624f7a08932e8d0c14952a13f673398d057eb57d716ca1d67ea464c40106787a7ad45f1577d3d5bcb70d80f88b79ba040f24038e40a718c"})

[  681.290224][T17476] tmpfs: Bad value for 'mpol'
[  681.542327][T17480] overlayfs: conflicting lowerdir path
[  681.608655][T17484] binder: 17481:17484 ioctl c0306201 20000140 returned -14
[  681.655227][T17482] overlayfs: conflicting lowerdir path
[  681.746035][T17486] tmpfs: Bad value for 'mpol'
05:03:19 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x38, 0x3a]}}}}]})

05:03:19 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x0, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:03:19 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x0, 0x2d, 0x38, 0x3a]}}}, 0x33}]})

05:03:19 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x55010000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:03:19 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000140), 0x0)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

[  682.176875][T17492] tmpfs: Bad value for 'mpol'
[  682.415899][T17499] IPVS: ftp: loaded support on port[0] = 21
[  682.462969][T17502] tmpfs: Bad value for 'mpol'
05:03:19 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x0, 0x2d, 0x38, 0x3a]}}}, 0x33}]})

[  682.536284][T17504] binder: 17481:17504 ioctl c0306201 20000140 returned -14
[  682.592181][T17505] overlayfs: conflicting lowerdir path
[  682.652799][ T9067] tipc: TX() has been purged, node left!
[  682.671038][ T9067] tipc: TX() has been purged, node left!
[  682.708610][ T9067] tipc: TX() has been purged, node left!
[  682.739817][T17508] overlayfs: conflicting lowerdir path
05:03:20 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x38, 0x3a]}}}}]})

05:03:20 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x44, 0x0, &(0x7f00000003c0)=[@reply={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x4d, 0x741000, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000180)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, &(0x7f0000000440)="61aff9b8073253ec0c2821e9ae5a5b221624f7a08932e8d0c14952a13f673398d057eb57d716ca1d67ea464c40106787a7ad45f1577d3d5bcb70d80f88b79ba040f24038e40a718c"})

05:03:20 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x5c000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  683.072632][T17516] tmpfs: Bad value for 'mpol'
05:03:20 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc", 0x18)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

[  683.328938][T17523] tmpfs: Bad value for 'mpol'
05:03:20 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x0, 0x2d, 0x38, 0x3a]}}}, 0x33}]})

[  683.487524][T17542] binder: 17527:17542 ioctl c0306201 20000140 returned -14
05:03:20 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x0, 0x38, 0x3a]}}}}]})

05:03:20 executing program 5:
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000200)=""/148, 0x94}], 0x1, 0x0, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_tables_targets\x00')
preadv(r0, &(0x7f0000000480), 0x1000000000000104, 0x4000000, 0x0)

[  683.730221][T17548] overlayfs: failed to resolve './file0/../file0': -2
[  683.812885][T17546] overlayfs: conflicting lowerdir path
[  683.890467][T17550] tmpfs: Bad value for 'mpol'
05:03:21 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x0, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:03:21 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x68000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  684.178458][T17556] tmpfs: Bad value for 'mpol'
05:03:21 executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000032000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, &(0x7f0000000140)="b9800000c00f3235010000000f309a090000006500660f3882af724d00002ed8ddc74424008fc4bd87c7442402c43a727fc7442406000000000f011424f30f090f013a360f06c4c18d72d68366baa100ed", 0x51}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x40000007, 0x0, 0x0, 0x0, 0x4cb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, @perf_bp={0x0, 0xc}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

[  684.751667][T17565] overlayfs: conflicting lowerdir path
[  684.795078][T17566] IPVS: ftp: loaded support on port[0] = 21
05:03:22 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x0, 0x38, 0x3a]}}}}]})

05:03:22 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc", 0x18)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

[  684.930739][T17565] overlayfs: conflicting lowerdir path
05:03:22 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket(0x2000000000000021, 0x2, 0x10000000000002)
connect$rxrpc(r0, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10}, 0x24)
sendmmsg(r0, &(0x7f0000005c00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}}], 0x1, 0x0)
r1 = socket(0x2000000000000021, 0x2, 0x10000000000002)
connect$rxrpc(r1, &(0x7f0000000180)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @empty}}, 0x24)
sendmmsg(r1, &(0x7f0000005c00), 0x40000000000037b, 0x0)

05:03:22 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x6c000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:03:22 executing program 3:
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x86a01780, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x79, 0x79, 0x5, [@datasec={0x0, 0x9, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}, {}, {}, {}, {}], 'x'}]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x99}, 0x20)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x0, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
tkill(r0, 0x33)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x7, r0, 0x0, 0x0)

[  685.516351][T17580] tmpfs: Bad value for 'mpol'
05:03:22 executing program 3:
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x86a01780, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r2 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x79, 0x79, 0x4, [@datasec={0x0, 0x9, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}, {}, {}, {}, {}], 'x'}]}, {0x0, [0x0, 0x0]}}, 0x0, 0x98}, 0x20)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x0, 0x0)
ptrace$setopts(0x4206, r2, 0x0, 0x0)
tkill(r2, 0x33)
ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080))
ptrace$cont(0x7, r2, 0x0, 0x0)

05:03:23 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x37, 0x0, 0x38, 0x3a]}}}}]})

05:03:23 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x0, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  686.186486][T17611] overlayfs: conflicting lowerdir path
05:03:23 executing program 5:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
r3 = socket$inet6(0xa, 0x3, 0x7)
connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c)
setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000340)={{{@in=@dev, @in6=@ipv4={[], [], @empty}, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@mcast1, 0x0, 0x33}, 0x0, @in=@empty, 0x0, 0x0, 0x0, 0x4}}, 0xe8)
sendmmsg(r3, &(0x7f0000000480), 0x2e9, 0x0)

05:03:23 executing program 3:
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='sysfs\x00', 0x0, 0x0)
lstat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080))

05:03:23 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc", 0x18)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

05:03:23 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x74000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  686.565092][T17617] tmpfs: Bad value for 'mpol'
[  686.719903][T17619] IPVS: ftp: loaded support on port[0] = 21
05:03:24 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x2d, 0x38, 0x3a]}}}}]})

05:03:24 executing program 3:
r0 = socket(0x40000000015, 0x5, 0x0)
connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10)
bind$inet(r0, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10)
sendmsg$xdp(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="fe", 0x1}, {&(0x7f0000002dc0)="3f1f9548d9ef72fced155ca44aae469f5164820291ce68806ec4e7412ca1490ff673580b18f7ab541e355b9adca6469e5c857096b30296ca62c7a4bfddc6bb4fdbf05343d8bcbac55760899f12bf8bc65f2beea3e0559fe29ed32184f7143ec24c8c78a64fd1f89d8e814974ed53aecaabb8a373eedb7043cb2670cc3a3c92768fc20280750cd4f8e92ff29223d2e497e71112a348bbf23081", 0x99}], 0x2}, 0x0)
recvmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000001d00)=[{&(0x7f0000000840)=""/153, 0x99}], 0x1}}], 0x1, 0x0, 0x0)

[  687.817506][T17655] tmpfs: Bad value for 'mpol'
05:03:25 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffff", 0x24)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

[  688.117958][T17656] overlayfs: conflicting lowerdir path
[  688.226705][T17658] overlayfs: conflicting lowerdir path
05:03:25 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x2d, 0x38, 0x3a]}}}}]})

05:03:25 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x7a000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:03:26 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x0, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:03:26 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(0x0, 0x0, 0x105082)
memfd_create(&(0x7f0000000080)='\xfaIhFlK\x99F\x17\x16\xa5>\xd3\xc0\x93\xb5.\xda\x06_bT\x1cB\xdb\xf8y1\xe7,\x03\x98h\x86(\xa0m\x87+x\x14i\x88\xcd\x89\x81\xfb\x86', 0x0)
r0 = socket$netlink(0x10, 0x3, 0x8000000004)
writev(r0, &(0x7f0000000100)=[{&(0x7f0000000080)="580000001400add427323b472545b45602117fffffff81004e220e227f000001925aa80020007b00090080007f000001e809000000ff0000f03ac7100003ffffffffffffffffffffe7ee0000000000000000020000000000", 0x58}], 0x1)
socket$inet_udplite(0x2, 0x2, 0x88)
fallocate(0xffffffffffffffff, 0x0, 0x2400, 0x100007e00)

[  689.349180][T17669] tmpfs: Bad value for 'mpol'
[  689.697142][T17673] IPVS: ftp: loaded support on port[0] = 21
05:03:27 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffff", 0x24)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

[  690.196503][T17676] overlayfs: conflicting lowerdir path
[  690.338244][T17678] overlayfs: conflicting lowerdir path
05:03:28 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, <r1=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14)
r2 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000100)=@newqdisc={0x54, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa, 0x1, 'netem\x00'}, {0x24, 0x2, {{}, [@TCA_NETEM_DELAY_DIST={0x6, 0x2, 'ey'}]}}}]}, 0x54}}, 0x0)

05:03:28 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x2d, 0x38, 0x3a]}}}}]})

05:03:28 executing program 3:
r0 = socket(0x40000000015, 0x5, 0x0)
connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @loopback}, 0x10)
bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @loopback}, 0x10)
sendmsg$xdp(r0, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0)
recvmmsg(r0, &(0x7f0000000a00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=""/21, 0x15}}], 0x1, 0x0, 0x0)

05:03:28 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x7ee125a7, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:03:28 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x0, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  691.086772][T17712] tmpfs: Bad value for 'mpol'
05:03:28 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffff", 0x24)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

05:03:28 executing program 3:
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x86a01780, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xb6, 0xb6, 0x3, [@func_proto, @datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], "1d"}, @volatile, @union={0x0, 0x3, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}]}, @datasec={0x0, 0x1, 0x0, 0xf, 0x1, [{}], 'M'}, @array]}, {0x0, [0x0]}}, 0x0, 0xd3}, 0x20)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x0, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
tkill(r0, 0x33)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x7, r0, 0x0, 0x0)

05:03:28 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x0, 0x2d, 0x38, 0x3a]}}}}]})

[  691.385299][T17720] overlayfs: conflicting lowerdir path
05:03:28 executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000001d80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=""/42, 0x2a}}], 0x1, 0x0, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x0, 0x0)
r2 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
r3 = openat$cgroup_procs(r2, &(0x7f00000000c0)='cgroup.procs\x00', 0x2, 0x0)
preadv(r3, &(0x7f00000009c0)=[{&(0x7f0000000500)=""/154}, {&(0x7f00000003c0)=""/68}, {&(0x7f00000005c0)=""/214}, {&(0x7f00000006c0)=""/194}, {&(0x7f00000007c0)=""/146}, {&(0x7f0000000880)=""/144}, {&(0x7f0000000480)=""/13}, {&(0x7f0000000940)=""/71}], 0x2a9, 0x0, 0x0)

[  691.531231][T17723] IPVS: ftp: loaded support on port[0] = 21
[  691.544798][T17722] overlayfs: conflicting lowerdir path
[  691.669099][ T1266] tipc: TX() has been purged, node left!
[  691.854926][ T1266] tipc: TX() has been purged, node left!
[  692.057753][ T1266] tipc: TX() has been purged, node left!
05:03:29 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x80040000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  692.272050][T17744] new mount options do not match the existing superblock, will be ignored
[  692.324295][T17755] tmpfs: Bad value for 'mpol'
[  692.405169][T17744] new mount options do not match the existing superblock, will be ignored
05:03:29 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:03:29 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x0, 0x2d, 0x38, 0x3a]}}}}]})

05:03:29 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(0xffffffffffffffff, 0x0, 0x0)
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x86a01780, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xb6, 0xb6, 0x3, [@func_proto, @datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], "1d"}, @volatile, @union={0x0, 0x3, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}]}, @datasec={0x0, 0x1, 0x0, 0xf, 0x1, [{}], 'M'}, @array]}, {0x0, [0x0]}}, 0x0, 0xd3}, 0x20)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x0, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
tkill(r0, 0x33)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x7, r0, 0x0, 0x0)

05:03:29 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b16", 0x2a)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

05:03:30 executing program 5:
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x86a01780, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xcd, 0xcd, 0x5, [@datasec={0x0, 0x9, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}, {}, {}, {}, {}], 'x'}, @struct={0x0, 0x6, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}, {}]}]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0xed}, 0x20)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x0, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
tkill(r0, 0x33)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x7, r0, 0x0, 0x0)

[  692.981746][T17766] overlayfs: failed to resolve './file0/../file0': -2
[  692.992532][T17763] IPVS: ftp: loaded support on port[0] = 21
[  693.159978][T17768] tmpfs: Bad value for 'mpol'
[  693.187823][T17762] overlayfs: conflicting lowerdir path
05:03:30 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6(0xa, 0x800000000000002, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet6(r0, &(0x7f0000000400)={0xa, 0x0, 0x0, @remote, 0x1}, 0x1c)
sendmmsg(r0, &(0x7f0000006d00)=[{{0x0, 0x10020fc, 0x0}}], 0xc6, 0x0)

05:03:30 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x8bffffff, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:03:30 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @val={0x3a, [0x0, 0x2d, 0x38, 0x3a]}}}}]})

05:03:30 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:03:30 executing program 5:
r0 = socket(0x40000000015, 0x5, 0x0)
connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @loopback}, 0x10)
bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @loopback}, 0x10)
sendmsg$xdp(r0, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0)
recvmmsg(r0, &(0x7f0000000a00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=""/21, 0x15}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup2(r1, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)

[  693.967185][T17802] not chained 10000 origins
[  693.971749][T17802] CPU: 1 PID: 17802 Comm: syz-executor.3 Not tainted 5.8.0-rc5-syzkaller #0
[  693.980425][T17802] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  693.990494][T17802] Call Trace:
[  693.993806][T17802]  dump_stack+0x21c/0x280
[  693.998167][T17802]  kmsan_internal_chain_origin+0x6f/0x130
[  694.003907][T17802]  ? kmsan_get_shadow_origin_ptr+0x81/0xb0
[  694.009760][T17802]  ? __msan_poison_alloca+0xf0/0x120
[  694.015066][T17802]  ? kmsan_get_metadata+0x116/0x180
[  694.020278][T17802]  ? kmsan_set_origin_checked+0x95/0xf0
[  694.025838][T17802]  ? kmsan_internal_unpoison_shadow+0x2f/0x40
[  694.031986][T17802]  ? _copy_from_user+0x201/0x310
[  694.036951][T17802]  ? kmsan_get_metadata+0x116/0x180
[  694.042166][T17802]  __msan_chain_origin+0x50/0x90
[  694.047188][T17802]  __get_compat_msghdr+0x6db/0x9d0
[  694.052359][T17802]  get_compat_msghdr+0x108/0x2b0
[  694.057357][T17802]  __sys_sendmmsg+0x755/0xf70
[  694.062083][T17802]  ? kmsan_internal_check_memory+0xb1/0x3d0
[  694.067991][T17802]  ? __msan_poison_alloca+0xf0/0x120
[  694.073309][T17802]  ? kmsan_copy_to_user+0x81/0x90
[  694.078342][T17802]  ? _copy_to_user+0x1bf/0x260
[  694.083185][T17802]  ? put_old_timespec32+0x231/0x2d0
[  694.088399][T17802]  ? kmsan_get_metadata+0x116/0x180
[  694.093633][T17802]  ? kmsan_get_metadata+0x116/0x180
[  694.098868][T17802]  ? kmsan_get_metadata+0x116/0x180
[  694.104087][T17802]  __se_compat_sys_sendmmsg+0xcd/0xf0
[  694.109491][T17802]  __ia32_compat_sys_sendmmsg+0x56/0x70
[  694.115069][T17802]  __do_fast_syscall_32+0x2af/0x480
[  694.120301][T17802]  do_fast_syscall_32+0x6b/0xd0
[  694.125176][T17802]  do_SYSENTER_32+0x73/0x90
[  694.129697][T17802]  entry_SYSENTER_compat_after_hwframe+0x4d/0x5c
[  694.136041][T17802] RIP: 0023:0xf7fbf549
[  694.140109][T17802] Code: Bad RIP value.
[  694.144180][T17802] RSP: 002b:00000000f55b90cc EFLAGS: 00000296 ORIG_RAX: 0000000000000159
[  694.152603][T17802] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000020006d00
[  694.160581][T17802] RDX: 00000000000000c6 RSI: 0000000000000000 RDI: 0000000000000000
[  694.168555][T17802] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[  694.176553][T17802] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[  694.184533][T17802] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[  694.192529][T17802] Uninit was stored to memory at:
[  694.197571][T17802]  kmsan_internal_chain_origin+0xad/0x130
[  694.203298][T17802]  __msan_chain_origin+0x50/0x90
[  694.208249][T17802]  __get_compat_msghdr+0x6db/0x9d0
[  694.213396][T17802]  get_compat_msghdr+0x108/0x2b0
[  694.218427][T17802]  __sys_sendmmsg+0x755/0xf70
[  694.223115][T17802]  __se_compat_sys_sendmmsg+0xcd/0xf0
[  694.228540][T17802]  __ia32_compat_sys_sendmmsg+0x56/0x70
[  694.234099][T17802]  __do_fast_syscall_32+0x2af/0x480
[  694.239309][T17802]  do_fast_syscall_32+0x6b/0xd0
[  694.244267][T17802]  do_SYSENTER_32+0x73/0x90
[  694.248794][T17802]  entry_SYSENTER_compat_after_hwframe+0x4d/0x5c
[  694.255112][T17802] 
[  694.257459][T17802] Uninit was stored to memory at:
[  694.262499][T17802]  kmsan_internal_chain_origin+0xad/0x130
[  694.268255][T17802]  __msan_chain_origin+0x50/0x90
[  694.273205][T17802]  __get_compat_msghdr+0x6db/0x9d0
[  694.278338][T17802]  get_compat_msghdr+0x108/0x2b0
[  694.283284][T17802]  __sys_sendmmsg+0x755/0xf70
[  694.287984][T17802]  __se_compat_sys_sendmmsg+0xcd/0xf0
[  694.293367][T17802]  __ia32_compat_sys_sendmmsg+0x56/0x70
[  694.298926][T17802]  __do_fast_syscall_32+0x2af/0x480
[  694.304135][T17802]  do_fast_syscall_32+0x6b/0xd0
[  694.309012][T17802]  do_SYSENTER_32+0x73/0x90
[  694.313523][T17802]  entry_SYSENTER_compat_after_hwframe+0x4d/0x5c
[  694.319948][T17802] 
[  694.322300][T17802] Uninit was stored to memory at:
[  694.327348][T17802]  kmsan_internal_chain_origin+0xad/0x130
[  694.333075][T17802]  __msan_chain_origin+0x50/0x90
[  694.338022][T17802]  __get_compat_msghdr+0x6db/0x9d0
[  694.343155][T17802]  get_compat_msghdr+0x108/0x2b0
[  694.348104][T17802]  __sys_sendmmsg+0x755/0xf70
[  694.352797][T17802]  __se_compat_sys_sendmmsg+0xcd/0xf0
[  694.358177][T17802]  __ia32_compat_sys_sendmmsg+0x56/0x70
[  694.363740][T17802]  __do_fast_syscall_32+0x2af/0x480
[  694.368969][T17802]  do_fast_syscall_32+0x6b/0xd0
[  694.373827][T17802]  do_SYSENTER_32+0x73/0x90
[  694.378338][T17802]  entry_SYSENTER_compat_after_hwframe+0x4d/0x5c
[  694.384658][T17802] 
[  694.386987][T17802] Uninit was stored to memory at:
[  694.392034][T17802]  kmsan_internal_chain_origin+0xad/0x130
[  694.397765][T17802]  __msan_chain_origin+0x50/0x90
[  694.402712][T17802]  __get_compat_msghdr+0x6db/0x9d0
[  694.407831][T17802]  get_compat_msghdr+0x108/0x2b0
[  694.412776][T17802]  __sys_sendmmsg+0x755/0xf70
[  694.417489][T17802]  __se_compat_sys_sendmmsg+0xcd/0xf0
[  694.422870][T17802]  __ia32_compat_sys_sendmmsg+0x56/0x70
[  694.428424][T17802]  __do_fast_syscall_32+0x2af/0x480
[  694.433631][T17802]  do_fast_syscall_32+0x6b/0xd0
[  694.438498][T17802]  do_SYSENTER_32+0x73/0x90
[  694.443020][T17802]  entry_SYSENTER_compat_after_hwframe+0x4d/0x5c
[  694.449342][T17802] 
[  694.451678][T17802] Uninit was stored to memory at:
[  694.456714][T17802]  kmsan_internal_chain_origin+0xad/0x130
[  694.462443][T17802]  __msan_chain_origin+0x50/0x90
[  694.467388][T17802]  __get_compat_msghdr+0x6db/0x9d0
[  694.472509][T17802]  get_compat_msghdr+0x108/0x2b0
[  694.477456][T17802]  __sys_sendmmsg+0x755/0xf70
[  694.482141][T17802]  __se_compat_sys_sendmmsg+0xcd/0xf0
[  694.487694][T17802]  __ia32_compat_sys_sendmmsg+0x56/0x70
[  694.493253][T17802]  __do_fast_syscall_32+0x2af/0x480
[  694.498461][T17802]  do_fast_syscall_32+0x6b/0xd0
[  694.503327][T17802]  do_SYSENTER_32+0x73/0x90
[  694.507843][T17802]  entry_SYSENTER_compat_after_hwframe+0x4d/0x5c
[  694.514164][T17802] 
[  694.516491][T17802] Uninit was stored to memory at:
[  694.521526][T17802]  kmsan_internal_chain_origin+0xad/0x130
[  694.527267][T17802]  __msan_chain_origin+0x50/0x90
[  694.532217][T17802]  __get_compat_msghdr+0x6db/0x9d0
[  694.537347][T17802]  get_compat_msghdr+0x108/0x2b0
[  694.543252][T17802]  __sys_sendmmsg+0x755/0xf70
[  694.547935][T17802]  __se_compat_sys_sendmmsg+0xcd/0xf0
[  694.553315][T17802]  __ia32_compat_sys_sendmmsg+0x56/0x70
[  694.558876][T17802]  __do_fast_syscall_32+0x2af/0x480
[  694.564081][T17802]  do_fast_syscall_32+0x6b/0xd0
[  694.568940][T17802]  do_SYSENTER_32+0x73/0x90
[  694.573485][T17802]  entry_SYSENTER_compat_after_hwframe+0x4d/0x5c
[  694.579808][T17802] 
[  694.582149][T17802] Uninit was stored to memory at:
[  694.587198][T17802]  kmsan_internal_chain_origin+0xad/0x130
[  694.592927][T17802]  __msan_chain_origin+0x50/0x90
[  694.597873][T17802]  __get_compat_msghdr+0x6db/0x9d0
[  694.602995][T17802]  get_compat_msghdr+0x108/0x2b0
[  694.607939][T17802]  __sys_sendmmsg+0x755/0xf70
[  694.612628][T17802]  __se_compat_sys_sendmmsg+0xcd/0xf0
[  694.618007][T17802]  __ia32_compat_sys_sendmmsg+0x56/0x70
[  694.623563][T17802]  __do_fast_syscall_32+0x2af/0x480
[  694.628775][T17802]  do_fast_syscall_32+0x6b/0xd0
[  694.633633][T17802]  do_SYSENTER_32+0x73/0x90
[  694.638142][T17802]  entry_SYSENTER_compat_after_hwframe+0x4d/0x5c
[  694.644461][T17802] 
[  694.646789][T17802] Local variable ----msg_sys@__sys_sendmmsg created at:
[  694.653733][T17802]  __sys_sendmmsg+0xbb/0xf70
[  694.658546][T17802]  __sys_sendmmsg+0xbb/0xf70
[  694.767636][T17804] tmpfs: Bad value for 'mpol'
05:03:32 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b16", 0x2a)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

[  694.968154][T17806] overlayfs: conflicting lowerdir path
[  695.107226][T17809] overlayfs: conflicting lowerdir path
05:03:32 executing program 1:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8}]}, 0x1c}}, 0x0)

05:03:32 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x8cffffff, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:03:33 executing program 5:
clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f0000000040)=@raw={'raw\x00', 0x2, 0x3, 0x248, 0xd0, 0xd0, 0x0, 0xd0, 0xd0, 0x1b0, 0x1b0, 0x1b0, 0x1b0, 0x1b0, 0x3, 0x0, {[{{@ip={@local, @dev, 0x0, 0xffffffff, '\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @dev}}}, {{@uncond, 0x0, 0x98, 0xe0, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x2a8)

05:03:33 executing program 1:
r0 = socket$inet6(0xa, 0x1, 0x0)
mmap(&(0x7f00009ff000/0x600000)=nil, 0x600000, 0x0, 0x12, r0, 0x0)
sendto$inet6(r0, 0x0, 0x0, 0xfffffeffffff7ffe, &(0x7f000006ffe4)={0xa, 0x0, 0x0, @loopback}, 0x1c)
getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000200)={&(0x7f0000e2d000/0x4000)=nil, 0x4000}, &(0x7f0000000340)=0x10)

[  696.185546][T17823] overlayfs: conflicting lowerdir path
[  696.316319][T17824] overlayfs: conflicting lowerdir path
05:03:33 executing program 5:
r0 = open(&(0x7f0000000000)='./bus\x00', 0x141a42, 0x0)
mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x0, 0x2812, r0, 0x0)
perf_event_open(&(0x7f00000000c0)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1081}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="c8"])
write$FUSE_DIRENTPLUS(r0, &(0x7f0000000200)=ANY=[], 0x5)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

05:03:33 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b16", 0x2a)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

[  697.455255][T17843] IPVS: ftp: loaded support on port[0] = 21
05:03:35 executing program 3:
syz_emit_ethernet(0x4a, &(0x7f0000000180)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd"], 0x0)

05:03:35 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x9061bf00, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:03:35 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000032000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, &(0x7f0000000140)="b9800000c00f3235010000000f309a090000006500660f3882af724d00002ed8ddc74424008fc4bd87c7442402c43a727fc7442406000000000f011424f30f090f013a360f06c4c18d72d68366baa100ed", 0x51}], 0x1, 0x0, 0x0, 0x0)
ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000080))
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
perf_event_open(&(0x7f0000000780)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x4, 0x0, 0x40000007, 0x0, 0x0, 0x0, 0x4cb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='ns\x00')
sendmsg$IPVS_CMD_GET_INFO(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, @perf_bp={0x0, 0xc}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

05:03:35 executing program 5:
r0 = socket(0x1000000010, 0x80002, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@gettaction={0x2c, 0x32, 0x309, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x18, 0x1, [{0x14, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0xd, 0x1, 'connmark\x00'}}]}]}, 0x2c}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

05:03:35 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:03:35 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa", 0x2d)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

[  698.253363][T17872] IPVS: ftp: loaded support on port[0] = 21
[  698.409782][T17876] overlayfs: conflicting lowerdir path
[  698.489612][T17878] overlayfs: conflicting lowerdir path
05:03:35 executing program 1:
syz_open_procfs(0xffffffffffffffff, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$TIPC_NL_SOCK_GET(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe2000/0x18000)=nil, &(0x7f0000000180)=[@textreal={0x8, &(0x7f0000000000)="baf80c432c9187f01766efbafc0cb8bd00ef0f320f624e10bad104ec26660ff85f50361b0f20c0663502000080f26eb800088ec00fae470b", 0x38}], 0x1, 0x51, 0x0, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xa120}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

05:03:36 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xa1ffffff, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:03:36 executing program 3:
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x86a01780, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x119, 0x119, 0x4, [@datasec={0x0, 0xa, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 'x'}, @func_proto={0x0, 0x3, 0x0, 0xd, 0x0, [{}, {}, {}]}, @datasec={0x0, 0x4, 0x0, 0xf, 0x3, [{}, {}, {}, {}], "1f0000"}, @ptr, @datasec={0x0, 0x2, 0x0, 0xf, 0x1, [{}, {}], '\"'}]}, {0x0, [0x0, 0x0]}}, 0x0, 0x138}, 0x20)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x0, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
tkill(r0, 0x33)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x7, r0, 0x0, 0x0)

05:03:36 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:03:36 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa", 0x2d)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

[  699.405085][T17914] overlayfs: conflicting lowerdir path
05:03:36 executing program 1:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001})
ppoll(&(0x7f0000000000)=[{r0}, {}], 0x51, 0x0, 0x0, 0x0)

05:03:36 executing program 3:
syz_open_dev$loop(0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(0x0, 0x0, 0x0)
sched_setscheduler(0x0, 0x0, 0x0)
syz_open_procfs$namespace(0x0, &(0x7f0000000280)='ns/cgroup\x00')

[  699.553180][T17918] overlayfs: conflicting lowerdir path
05:03:36 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xa725e17e, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  699.790937][T17925] IPVS: ftp: loaded support on port[0] = 21
05:03:37 executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
getsockopt$EBT_SO_GET_INIT_INFO(r0, 0x0, 0x82, &(0x7f0000000180)={'nat\x00'}, &(0x7f0000000100)=0x78)

[  700.533225][T17960] overlayfs: conflicting lowerdir path
[  700.674812][T17960] overlayfs: conflicting lowerdir path
05:03:38 executing program 5:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0)

05:03:38 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:03:38 executing program 1:
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
chdir(&(0x7f00000003c0)='./file0\x00')
symlink(&(0x7f0000000140)='..', &(0x7f00000000c0)='./file0\x00')
symlink(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380)='./file1\x00')
open(&(0x7f0000000100)='./file1/file0\x00', 0x0, 0x0)

05:03:38 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa", 0x2d)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

05:03:38 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xaa020000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:03:38 executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000032000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, &(0x7f0000000140)="b9800000c00f3235010000000f309a090000006500660f3882af724d00002ed8ddc74424008fc4bd87c7442402c43a727fc7442406000000000f011424f30f090f013a360f06c4c18d72d68366baa100ed", 0x51}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
perf_event_open(&(0x7f0000000780)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x4, 0x0, 0x40000007, 0x0, 0x0, 0x0, 0x4cb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
syz_open_procfs(0xffffffffffffffff, 0x0)
sendmsg$IPVS_CMD_GET_DAEMON(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x804}, 0x0)
perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, @perf_bp={0x0, 0xc}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

[  701.163164][T17970] IPVS: ftp: loaded support on port[0] = 21
05:03:38 executing program 1:
socket$vsock_stream(0x28, 0x1, 0x0)
socket$vsock_stream(0x28, 0x1, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000080)=0x1000)
pipe(&(0x7f0000000080))
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0)

05:03:38 executing program 5:
clock_gettime(0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0)
socket$netlink(0x10, 0x3, 0x0)
timer_create(0x0, 0x0, 0x0)
timer_settime(0x0, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x6}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
pipe(&(0x7f0000000140)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
prctl$PR_GET_TIMERSLACK(0x1e)
sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, 0x0, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r1, &(0x7f0000000080)={0xa, 0x8000002, 0x0, @empty}, 0x1c)
sendmsg$IPSET_CMD_GET_BYINDEX(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x20000800}, 0x0)
sendto$inet6(r1, 0x0, 0x0, 0x240408d1, &(0x7f0000000040)={0xa, 0x2, 0x0, @rand_addr, 0x400}, 0x1c)
splice(r1, 0x0, r0, 0x0, 0xffffffff, 0x0)
setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, 0x0, 0x0)
sendmsg$IPVS_CMD_SET_CONFIG(0xffffffffffffffff, 0x0, 0x0)
sendto$packet(r1, &(0x7f0000000340), 0xfffffffffffffd4d, 0x0, 0x0, 0x4f)

[  701.758179][T17988] overlayfs: conflicting lowerdir path
[  701.785466][T17985] kvm [17975]: vcpu0, guest rIP: 0x145 Hyper-V unhandled rdmsr: 0x40000040
05:03:39 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  701.875553][T17985] kvm [17975]: vcpu0, guest rIP: 0x145 Hyper-V unhandled rdmsr: 0x40000024
05:03:39 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae", 0x2f)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

05:03:39 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xc0ed0000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:03:39 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000032000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, &(0x7f0000000140)="b9800000c00f3235010000000f309a090000006500660f3882af724d00002ed8ddc74424008fc4bd87c7442402c43a727fc7442406000000000f011424f30f090f013a360f06c4c18d72d68366baa100ed", 0x51}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x4, 0x0, 0x40000007, 0x0, 0x0, 0x0, 0x4cb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='ns\x00')
sendmsg$IPVS_CMD_GET_DAEMON(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x804}, 0x0)
perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xc}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

[  702.339979][T18013] IPVS: ftp: loaded support on port[0] = 21
[  702.386442][T18014] kvm [17975]: vcpu0, guest rIP: 0x145 Hyper-V unhandled rdmsr: 0x4000005c
[  702.423743][T18014] kvm [17975]: vcpu0, guest rIP: 0x145 Hyper-V unhandled rdmsr: 0x40000028
05:03:39 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:03:40 executing program 3:
syz_open_dev$char_raw(0x0, 0x1, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000280)='net/dev_mcast\x00')
preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000000)=""/34, 0x22}], 0x1, 0x3f00, 0x0)

[  702.948275][T18048] overlayfs: conflicting lowerdir path
[  703.022500][T18050] kvm [18047]: vcpu0, guest rIP: 0x14c Hyper-V unhandled wrmsr: 0x40000040 data 0xf
[  703.069983][T18050] kvm [18047]: vcpu0, guest rIP: 0x14c Hyper-V unhandled wrmsr: 0x4000008f data 0xf7
[  703.095042][T18050] kvm [18047]: vcpu0, guest rIP: 0x14c Hyper-V unhandled wrmsr: 0x40000025 data 0x1
[  703.127474][T18050] kvm [18047]: vcpu0, guest rIP: 0x14c Hyper-V unhandled wrmsr: 0x40000011 data 0x4b
[  703.130462][T18048] overlayfs: conflicting lowerdir path
[  703.164183][T18054] IPVS: ftp: loaded support on port[0] = 21
[  703.185487][T18050] kvm [18047]: vcpu0, guest rIP: 0x14c Hyper-V unhandled wrmsr: 0x4000005c data 0x9f
[  703.200403][T18050] kvm [18047]: vcpu0, guest rIP: 0x14c Hyper-V unhandled wrmsr: 0x40000050 data 0xb9
[  703.212954][T18050] kvm [18047]: vcpu0, guest rIP: 0x14c Hyper-V unhandled wrmsr: 0x40000079 data 0xa1
[  703.272770][T18050] kvm [18047]: vcpu0, guest rIP: 0x14c Hyper-V unhandled wrmsr: 0x40000011 data 0xf3
05:03:40 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xc3ffffff, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:03:40 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae", 0x2f)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

05:03:40 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:03:40 executing program 3:
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0)
ptrace$setopts(0x4206, r2, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xf1, 0xf1, 0x8, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @enum={0x0, 0x1, 0x0, 0x6, 0x4, [{}]}, @union={0x0, 0x4, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}]}, @datasec={0x0, 0x6, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}, {}], "18"}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, 0x0, 0x114}, 0x20)
process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0)
tkill(r2, 0x40)
ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080))
ptrace$cont(0x7, r2, 0x0, 0x0)

05:03:41 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000032000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, &(0x7f0000000140)="b9800000c00f3235010000000f309a090000006500660f3882af724d00002ed8ddc74424008fc4bd87c7442402c43a727fc7442406000000000f011424f30f090f013a360f06c4c18d72d68366baa100ed", 0x51}], 0x1, 0x0, 0x0, 0x0)
ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000080))
ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
perf_event_open(&(0x7f0000000780)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x4, 0x0, 0x40000007, 0x0, 0x0, 0x0, 0x4cb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='ns\x00')
sendmsg$IPVS_CMD_GET_DAEMON(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x804}, 0x0)
sendmsg$IPVS_CMD_GET_INFO(0xffffffffffffffff, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x48, 0x0, 0x0, 0x70bd27, 0x0, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_WEIGHT={0x8}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e23}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}]}, 0x48}}, 0x0)
perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, @perf_bp={0x0, 0xc}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

[  704.023124][T18089] overlayfs: conflicting lowerdir path
[  704.062579][T18089] overlayfs: conflicting lowerdir path
[  704.230203][T18094] IPVS: ftp: loaded support on port[0] = 21
[  704.394071][T18097] kvm [18095]: vcpu0, guest rIP: 0x14c Hyper-V unhandled wrmsr: 0x40000040 data 0xa3
05:03:42 executing program 5:
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0)
ptrace$setopts(0x4206, r2, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x13a, 0x13a, 0x8, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @enum={0x0, 0x1, 0x0, 0x6, 0x4, [{}]}, @union={0x0, 0x4, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}]}, @datasec={0x0, 0x6, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}, {}], "18"}, @datasec={0x0, 0x5, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}], 'u'}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, 0x0, 0x15c}, 0x20)
process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0)
tkill(r2, 0x40)
ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080))
ptrace$cont(0x7, r2, 0x0, 0x0)

05:03:42 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xcb352cee, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:03:42 executing program 3:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = fcntl$dupfd(r0, 0x0, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0)
sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=ANY=[@ANYBLOB="0204a30002"], 0x10}}, 0x0)
sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x10}}, 0x0)
sendmsg$key(0xffffffffffffffff, &(0x7f0000000040)={0xffffffffa0018000, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="020a000007000000000000000000000005001a00ac"], 0x38}}, 0x0)
r3 = socket$key(0xf, 0x3, 0x2)
sendmmsg(r3, &(0x7f0000000180), 0x32bc45944b084a6, 0x0)

05:03:42 executing program 1:
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x86a01780, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000002c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x121, 0x121, 0x9, [@enum={0x0, 0x1, 0x0, 0x6, 0x4, [{}]}, @datasec={0x0, 0x3, 0x0, 0xf, 0x3, [{}, {}, {}], 'R.M'}, @array, @datasec={0x0, 0x7, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}, {}, {}], '<'}, @ptr, @datasec={0x0, 0x6, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}, {}], 'M'}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, 0x0, 0x145}, 0x20)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x0, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
tkill(r0, 0x33)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x7, r0, 0x0, 0x0)

05:03:42 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:03:42 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae", 0x2f)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

[  705.171789][T18136] IPVS: ftp: loaded support on port[0] = 21
[  705.261461][T18137] overlayfs: conflicting lowerdir path
05:03:42 executing program 3:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000003e00)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)={{0x14}, [@NFT_MSG_NEWCHAIN={0x20, 0x3, 0xa, 0x401, 0x0, 0x0, {}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x10}}, 0x48}}, 0x0)

[  705.448194][T18141] overlayfs: conflicting lowerdir path
05:03:42 executing program 1:
clone(0x20002044dfc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={{0x14, 0x2}, [], {0x14}}, 0x28}}, 0x0)

05:03:42 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xd8260000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:03:43 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:03:43 executing program 1:
r0 = socket(0x40000000015, 0x5, 0x0)
recvmmsg(r0, &(0x7f0000000a00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)

05:03:43 executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000032000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, &(0x7f0000000140)="b9800000c00f3235010000000f309a090000006500660f3882af724d00002ed8ddc74424008fc4bd87c7442402c43a727fc7442406000000000f011424f30f090f013a360f06c4c18d72d68366baa100ed", 0x51}], 0x1, 0x0, 0x0, 0x0)
ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000080))
ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
perf_event_open(&(0x7f0000000780)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x4, 0x0, 0x40000007, 0x0, 0x0, 0x0, 0x4cb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='ns\x00')
sendmsg$IPVS_CMD_GET_DAEMON(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x804}, 0x0)
sendmsg$IPVS_CMD_GET_INFO(0xffffffffffffffff, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x50, 0x0, 0x0, 0x70bd27, 0x0, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_WEIGHT={0x8}, @IPVS_DEST_ATTR_TUN_PORT={0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}]}, 0x50}}, 0x0)
perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, @perf_bp={0x0, 0xc}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

05:03:43 executing program 5:
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0)
ptrace$setopts(0x4206, r2, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x12e, 0x12e, 0x8, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @enum={0x0, 0x1, 0x0, 0x6, 0x4, [{}]}, @union={0x0, 0x4, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}]}, @datasec={0x0, 0x6, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}, {}], "18"}, @datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], 'u'}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, 0x0, 0x150}, 0x20)
process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0)
tkill(r2, 0x40)
ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080))
ptrace$cont(0x7, r2, 0x0, 0x0)

05:03:43 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a", 0x30)
readv(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

[  706.438145][T18183] overlayfs: conflicting lowerdir path
[  706.824611][T18181] IPVS: ftp: loaded support on port[0] = 21
[  707.245236][T18183] overlayfs: conflicting lowerdir path
05:03:44 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a", 0x30)
readv(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

05:03:44 executing program 1:
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x86a01780, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r2 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x79, 0x79, 0x5, [@datasec={0x0, 0x9, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}, {}, {}, {}, {}], 'x'}]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x99}, 0x20)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x0, 0x0)
ptrace$setopts(0x4206, r2, 0x0, 0x0)
tkill(r2, 0x33)
ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080))
ptrace$cont(0x7, r2, 0x0, 0x0)

05:03:44 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xd8ffffff, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:03:44 executing program 5:
r0 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyprintk\x00', 0xc0001, 0x0)
write$binfmt_elf32(r0, &(0x7f0000001340)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38}, [{}]}, 0x58)

05:03:44 executing program 3:
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x86a01780, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000002c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x12b, 0x12b, 0x9, [@enum={0x0, 0x1, 0x0, 0x6, 0x4, [{}]}, @datasec={0x0, 0x3, 0x0, 0xf, 0x1, [{}, {}, {}], 'R'}, @array, @datasec={0x0, 0x7, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}, {}, {}], '<'}, @ptr, @datasec={0x0, 0x7, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}, {}, {}], 'M'}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, 0x0, 0x14d}, 0x20)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x0, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
tkill(r0, 0x33)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x7, r0, 0x0, 0x0)

[  707.754106][ T1266] tipc: TX() has been purged, node left!
05:03:45 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:03:45 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000003000)=[{{&(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, 0x0}}], 0x1, 0x0, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='attr/exec\x00')
preadv(r0, &(0x7f00000017c0), 0x315, 0x0, 0x0)

05:03:45 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a", 0x30)
readv(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000040)=""/52, 0x24}], 0x1)

[  708.144264][T18230] [U] ELF
[  708.240083][T18232] overlayfs: conflicting lowerdir path
[  708.342144][T18236] overlayfs: conflicting lowerdir path
05:03:45 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001})
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
ioctl$BLKPG(0xffffffffffffffff, 0x1269, &(0x7f0000000100)={0x3, 0x0, 0x0, 0x0})
ppoll(&(0x7f0000000040)=[{r0}], 0xba, 0x0, 0x0, 0xfffffd5e)

05:03:45 executing program 5:
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x86a01780, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r2 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xad, 0xad, 0x5, [@datasec={0x0, 0x9, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}, {}, {}, {}, {}], 'x'}, @func_proto={0x0, 0x5, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}]}]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0xcd}, 0x20)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x0, 0x0)
ptrace$setopts(0x4206, r2, 0x0, 0x0)
tkill(r2, 0x33)
ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080))
ptrace$cont(0x7, r2, 0x0, 0x0)

05:03:45 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xdb260000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  708.740734][T18242] IPVS: ftp: loaded support on port[0] = 21
05:03:46 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000032000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, &(0x7f0000000140)="b9800000c00f3235010000000f309a090000006500660f3882af724d00002ed8ddc74424008fc4bd87c7442402c43a727fc7442406000000000f011424f30f090f013a360f06c4c18d72d68366baa100ed", 0x51}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
perf_event_open(&(0x7f0000000780)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x4, 0x0, 0x40000007, 0x0, 0x0, 0x0, 0x4cb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
sendmsg$IPVS_CMD_GET_DAEMON(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x804}, 0x0)
perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, @perf_bp={0x0, 0xc}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

05:03:46 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a", 0x30)
readv(r0, 0x0, 0x0)

05:03:47 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000032000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, &(0x7f0000000140)="b9800000c00f3235010000000f309a090000006500660f3882af724d00002ed8ddc74424008fc4bd87c7442402c43a727fc7442406000000000f011424f30f090f013a360f06c4c18d72d68366baa100ed", 0x51}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
perf_event_open(&(0x7f0000000780)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x4, 0x0, 0x40000007, 0x0, 0x0, 0x0, 0x4cb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
sendmsg$IPVS_CMD_GET_DAEMON(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x804}, 0x0)
perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, @perf_bp={0x0, 0xc}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

[  709.866282][T18275] overlayfs: conflicting lowerdir path
05:03:47 executing program 3:

[  710.030405][T18284] kvm [18270]: vcpu0, guest rIP: 0x145 Hyper-V unhandled rdmsr: 0x40000040
[  710.124502][T18284] kvm [18270]: vcpu0, guest rIP: 0x145 Hyper-V unhandled rdmsr: 0x40000024
05:03:47 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a", 0x30)
readv(r0, 0x0, 0x0)

05:03:47 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xe4ffffff, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  711.205557][T18315] overlayfs: conflicting lowerdir path
[  711.296644][T18316] overlayfs: conflicting lowerdir path
05:03:49 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:03:49 executing program 5:

05:03:49 executing program 3:

05:03:49 executing program 1:

05:03:49 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a", 0x30)
readv(r0, 0x0, 0x0)

05:03:49 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xeaffffff, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:03:49 executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000032000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, &(0x7f0000000140)="b9800000c00f3235010000000f309a090000006500660f3882af724d00002ed8ddc74424008fc4bd87c7442402c43a727fc7442406000000000f011424f30f090f013a360f06c4c18d72d68366baa100ed", 0x51}], 0x1, 0x0, 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x4, 0x0, 0x40000007, 0x0, 0x0, 0x0, 0x4cb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='ns\x00')
sendmsg$IPVS_CMD_GET_DAEMON(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x804}, 0x0)
perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xc}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

[  712.405500][T18329] overlayfs: conflicting lowerdir path
05:03:49 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a", 0x30)
readv(r0, &(0x7f0000000000), 0x0)

05:03:49 executing program 5:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f0000000440)="496a734c6b225a22de51b7ec08421b42", 0x10)

05:03:49 executing program 1:

[  712.521303][T18330] overlayfs: conflicting lowerdir path
[  712.804223][T18333] IPVS: ftp: loaded support on port[0] = 21
05:03:50 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xee2c35cb, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  713.429531][T18351] overlayfs: conflicting lowerdir path
05:03:51 executing program 5:

[  713.910232][T18342] overlayfs: conflicting lowerdir path
[  713.953766][ T9067] tipc: TX() has been purged, node left!
05:03:51 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:03:51 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a", 0x30)
readv(r0, &(0x7f0000000000), 0x0)

05:03:51 executing program 1:

05:03:51 executing program 3:

05:03:51 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xf4ffffff, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:03:51 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a", 0x30)
readv(r0, &(0x7f0000000000), 0x0)

05:03:51 executing program 5:

[  714.708855][T18381] IPVS: ftp: loaded support on port[0] = 21
05:03:51 executing program 3:

05:03:52 executing program 1:

[  715.082102][T18383] overlayfs: conflicting lowerdir path
05:03:52 executing program 5:

05:03:52 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a", 0x30)
readv(r0, &(0x7f0000000000)=[{0x0}], 0x1)

05:03:52 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xf5040000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:03:53 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:03:53 executing program 3:

05:03:53 executing program 5:

05:03:53 executing program 1:

05:03:53 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a", 0x30)
readv(r0, &(0x7f0000000000)=[{0x0}], 0x1)

05:03:53 executing program 3:

05:03:53 executing program 5:
ioctl$F2FS_IOC_WRITE_CHECKPOINT(0xffffffffffffffff, 0xf507, 0x0)
perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x7f, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0xd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = creat(&(0x7f0000000280)='./file0\x00', 0x1)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
close(r0)
r1 = creat(&(0x7f0000000280)='./file0\x00', 0x0)
write$binfmt_script(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="2302"], 0x3e)
close(r1)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
linkat(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0)

[  716.240815][T18418] overlayfs: conflicting lowerdir path
[  716.382798][T18419] overlayfs: conflicting lowerdir path
05:03:53 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xf6ffffff, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  716.844551][ T9067] tipc: TX() has been purged, node left!
05:03:54 executing program 1:

[  717.500755][T18433] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
[  717.513655][T18431] overlayfs: conflicting lowerdir path
[  717.565429][T18432] IPVS: ftp: loaded support on port[0] = 21
05:03:54 executing program 5:

[  717.663049][T18433] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
[  717.744924][T18431] overlayfs: conflicting lowerdir path
05:03:55 executing program 3:

05:03:55 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002)
write(r0, &(0x7f0000000140)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a", 0x30)
readv(r0, &(0x7f0000000000)=[{0x0}], 0x1)

05:03:55 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
set_mempolicy(0x0, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:03:55 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xfeffffff, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:03:55 executing program 1:

05:03:55 executing program 3:

05:03:55 executing program 2:

05:03:55 executing program 5:

[  718.874015][T18465] IPVS: ftp: loaded support on port[0] = 21
[  719.251100][T18478] overlayfs: failed to resolve './file0/../file0': -2
05:03:56 executing program 1:

[  719.517281][T18474] overlayfs: conflicting lowerdir path
05:03:56 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
set_mempolicy(0x0, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:03:56 executing program 3:

05:03:56 executing program 2:

05:03:57 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xff000000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:03:57 executing program 5:

05:03:57 executing program 1:

[  720.176998][T18499] IPVS: ftp: loaded support on port[0] = 21
05:03:57 executing program 3:

05:03:57 executing program 2:

05:03:57 executing program 5:

[  720.619620][T18515] overlayfs: conflicting lowerdir path
[  720.717287][T18503] overlayfs: conflicting lowerdir path
05:03:58 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
set_mempolicy(0x0, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:03:58 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xff010000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:03:58 executing program 1:

05:03:58 executing program 3:

05:03:58 executing program 2:

05:03:58 executing program 5:

[  721.495141][T18533] IPVS: ftp: loaded support on port[0] = 21
05:03:59 executing program 1:

05:03:59 executing program 2:

[  722.093637][T18544] overlayfs: conflicting lowerdir path
05:03:59 executing program 5:

05:03:59 executing program 1:

05:03:59 executing program 3:

05:03:59 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xff030000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  722.474080][ T9067] tipc: TX() has been purged, node left!
05:03:59 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, 0x0, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:03:59 executing program 2:

05:04:00 executing program 1:

05:04:00 executing program 5:

05:04:00 executing program 3:

[  723.154302][T18570] overlayfs: conflicting lowerdir path
[  723.247876][T18575] IPVS: ftp: loaded support on port[0] = 21
[  723.278496][T18573] overlayfs: conflicting lowerdir path
05:04:00 executing program 2:

05:04:00 executing program 1:

05:04:00 executing program 3:

05:04:00 executing program 5:

05:04:01 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xff0f0000, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:04:01 executing program 1:

05:04:01 executing program 5:

05:04:01 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, 0x0, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:04:01 executing program 2:

05:04:01 executing program 3:

[  724.637565][T18607] overlayfs: conflicting lowerdir path
[  724.778837][T18607] overlayfs: conflicting lowerdir path
05:04:02 executing program 1:

05:04:02 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xffff1f00, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  725.021597][T18613] IPVS: ftp: loaded support on port[0] = 21
05:04:02 executing program 5:

05:04:02 executing program 2:

05:04:02 executing program 3:

05:04:02 executing program 1:

05:04:02 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, 0x0, 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

[  725.756253][T18640] overlayfs: conflicting lowerdir path
05:04:03 executing program 2:

[  725.928234][T18643] overlayfs: conflicting lowerdir path
05:04:03 executing program 5:

05:04:03 executing program 3:

05:04:03 executing program 1:

[  726.230639][T18647] IPVS: ftp: loaded support on port[0] = 21
05:04:03 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xffffff7f, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:04:03 executing program 2:

[  726.915173][T18662] overlayfs: conflicting lowerdir path
05:04:04 executing program 5:

05:04:04 executing program 3:

05:04:04 executing program 1:

[  727.263854][T18662] overlayfs: conflicting lowerdir path
05:04:04 executing program 2:

[  727.307197][ T9067] tipc: TX() has been purged, node left!
[  727.329344][ T9067] tipc: TX() has been purged, node left!
05:04:04 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140), 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:04:04 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xffffff8b, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:04:05 executing program 5:

05:04:05 executing program 1:

05:04:05 executing program 3:

05:04:05 executing program 2:

[  728.122915][T18684] IPVS: ftp: loaded support on port[0] = 21
[  728.316834][T18686] overlayfs: conflicting lowerdir path
[  728.515367][T18687] overlayfs: conflicting lowerdir path
05:04:06 executing program 5:

05:04:06 executing program 3:

05:04:06 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xffffff8c, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:04:06 executing program 1:

05:04:06 executing program 2:

05:04:06 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140), 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:04:06 executing program 5:

05:04:06 executing program 3:

05:04:06 executing program 1:

[  729.699377][T18721] overlayfs: conflicting lowerdir path
05:04:07 executing program 2:

[  729.790379][T18722] overlayfs: conflicting lowerdir path
[  729.935042][T18726] IPVS: ftp: loaded support on port[0] = 21
05:04:07 executing program 5:

05:04:07 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xffffffa1, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:04:07 executing program 3:

05:04:07 executing program 2:

05:04:07 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140), 0x2)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:04:07 executing program 1:

[  730.853051][T18754] overlayfs: conflicting lowerdir path
05:04:08 executing program 5:

[  731.140346][T18760] IPVS: ftp: loaded support on port[0] = 21
05:04:08 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xffffffc3, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:04:08 executing program 2:

05:04:08 executing program 1:

05:04:08 executing program 3:

05:04:09 executing program 5:

[  732.083413][T18788] overlayfs: conflicting lowerdir path
05:04:09 executing program 1:

05:04:09 executing program 2:

[  732.178933][T18789] overlayfs: conflicting lowerdir path
05:04:09 executing program 3:

05:04:09 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x0)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:04:09 executing program 5:

05:04:09 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xffffffd8, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:04:09 executing program 1:

05:04:10 executing program 2:

05:04:10 executing program 3:

[  732.869355][T18798] IPVS: ftp: loaded support on port[0] = 21
05:04:10 executing program 5:

[  733.082312][ T9067] tipc: TX() has been purged, node left!
[  733.087088][T18800] overlayfs: conflicting lowerdir path
[  733.150953][T18807] overlayfs: conflicting lowerdir path
05:04:10 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xffffffe4, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:04:10 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x0)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:04:10 executing program 1:

05:04:10 executing program 2:

05:04:10 executing program 3:

05:04:10 executing program 5:

[  734.003385][T18834] overlayfs: conflicting lowerdir path
[  734.043324][T18832] IPVS: ftp: loaded support on port[0] = 21
05:04:11 executing program 1:

05:04:11 executing program 2:

[  734.187590][T18835] overlayfs: conflicting lowerdir path
05:04:11 executing program 3:

05:04:11 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xffffffea, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:04:12 executing program 5:

05:04:12 executing program 1:

05:04:12 executing program 3:

[  735.421137][T18867] overlayfs: conflicting lowerdir path
[  735.523310][T18868] overlayfs: conflicting lowerdir path
05:04:12 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x0)
clone(0x4412c580, 0x0, 0x0, 0x0, 0x0)

05:04:12 executing program 2:

05:04:12 executing program 5:

05:04:12 executing program 1:

05:04:13 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xfffffff4, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:04:13 executing program 3:

05:04:13 executing program 2:

[  736.111284][T18877] IPVS: ftp: loaded support on port[0] = 21
05:04:13 executing program 5:

05:04:13 executing program 1:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000080)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x3}]}, 0x10)
r3 = socket$inet_udp(0x2, 0x2, 0x0)
fcntl$setpipe(r0, 0x407, 0x0)
write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0)
bind$inet(r3, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x19}}, 0x10)
connect$inet(r3, &(0x7f0000000140)={0x2, 0x0, @multicast1}, 0x10)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xfdffffffffffffff, 0xffffffffffffffff, 0x0)
splice(r0, 0x0, r3, 0x0, 0x30001, 0x0)

[  736.549338][T18882] overlayfs: conflicting lowerdir path
05:04:13 executing program 3:
openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$inet6(0xa, 0x401000000001, 0x0)
close(r0)
r1 = socket$inet6(0xa, 0x3, 0xff)
connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x83, @empty}, 0x1c)
r2 = open(&(0x7f0000000100)='./bus\x00', 0x11250c2, 0x0)
r3 = creat(&(0x7f0000000040)='./bus\x00', 0x0)
ftruncate(r3, 0x208200)
r4 = socket(0x10, 0x3, 0x0)
r5 = socket(0x11, 0x800000003, 0x0)
syncfs(r4)
bind(r5, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0)
setsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f0000000000)={@initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010101}, 0xc)
sendfile(r0, r2, 0x0, 0x8000fffffffe)

[  736.856710][T18889] overlayfs: conflicting lowerdir path
05:04:14 executing program 2:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$GIO_SCRNMAP(r0, 0x4b40, &(0x7f0000000040)=""/52)

05:04:14 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xfffffff6, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  737.414738][   T29] audit: type=1800 audit(1597295054.577:19): pid=18911 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.3" name="bus" dev="sda1" ino=16130 res=0
05:04:14 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x0, 0x0, 0x0, 0x0, 0x0)

05:04:14 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$GIO_SCRNMAP(r0, 0x4b4c, &(0x7f0000000040)=""/52)

05:04:15 executing program 3:

05:04:15 executing program 5:

[  738.093943][ T9067] tipc: TX() has been purged, node left!
05:04:15 executing program 2:
syz_mount_image$tmpfs(&(0x7f00000002c0)='tmpfs\x00', &(0x7f0000000400)='./bus\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[])
chdir(&(0x7f0000000380)='./bus\x00')
close(0xffffffffffffffff)
r0 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r0, 0x200004)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, r1, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)

[  738.212724][T18929] overlayfs: conflicting lowerdir path
[  738.326094][T18931] overlayfs: conflicting lowerdir path
05:04:15 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x0, 0x0, 0x0, 0x0, 0x0)

05:04:15 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xfffffffe, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:04:15 executing program 3:
perf_event_open(&(0x7f00000002c0)={0x2, 0x70, 0xab, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$netlink(0x10, 0x3, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0)
writev(r0, &(0x7f0000000280)=[{&(0x7f0000000140)="39000000130009006900000000000000ab008000200000004600010707000014190001001000000800005068000000000000ef38bf461e59d7", 0x39}], 0x1)
writev(r0, &(0x7f0000000100)=[{&(0x7f0000000180)="3900000010002f0468ee0700230000fe0100ee0020000000450001070307001404001800120003000e040000000351f8000000000000000000", 0x39}], 0x1)

[  738.943259][T18937] tmpfs: Unknown parameter './bus'
05:04:16 executing program 1:
syz_mount_image$tmpfs(&(0x7f00000002c0)='tmpfs\x00', &(0x7f0000000400)='./bus\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[])
chdir(&(0x7f0000000380)='./bus\x00')
close(0xffffffffffffffff)
r0 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r0, 0x200004)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, r1, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)

05:04:16 executing program 5:
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
timer_create(0x0, &(0x7f0000000140)={0x0, 0x12}, &(0x7f0000000080))
timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0)
timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000200)=<r0=>0x0)
timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x3938700}, {0x0, 0x1c9c380}}, 0x0)
socket(0x0, 0x0, 0x0)
poll(0x0, 0x0, 0x207)
pause()

05:04:16 executing program 2:
syz_mount_image$tmpfs(&(0x7f00000002c0)='tmpfs\x00', &(0x7f0000000400)='./bus\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[])
chdir(&(0x7f0000000380)='./bus\x00')
close(0xffffffffffffffff)
r0 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r0, 0x200004)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, r1, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)

[  739.475008][T18954] overlayfs: conflicting lowerdir path
05:04:16 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, 0x0, 0x0)
openat$bsg(0xffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x200200, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/bnep\x00')
sendfile(r1, 0xffffffffffffffff, 0x0, 0x5)
write$P9_RREMOVE(r1, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x23, 0x0, 0x0)
setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000001c0), 0x8)
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000))
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00')
getpeername$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000380)=0x1c)
socket(0x11, 0x800000003, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
set_mempolicy(0x4002, &(0x7f0000000140)=0x10000101, 0x2)
clone(0x0, 0x0, 0x0, 0x0, 0x0)

[  739.678898][T18956] overlayfs: conflicting lowerdir path
[  739.900835][T18952] bridge0: port 2(bridge_slave_1) entered disabled state
05:04:17 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0xffffffff, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:04:17 executing program 2:
syz_mount_image$tmpfs(&(0x7f00000002c0)='tmpfs\x00', &(0x7f0000000400)='./bus\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[])
chdir(&(0x7f0000000380)='./bus\x00')
close(0xffffffffffffffff)
r0 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r0, 0x200004)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, r1, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)

[  740.382093][T18953] netlink: 1 bytes leftover after parsing attributes in process `syz-executor.3'.
[  740.391589][T18953] : renamed from bridge_slave_1
[  740.435224][T18953] A link change request failed with some changes committed already. Interface  may have been left with an inconsistent configuration, please check.
[  740.451442][T12255] IPv6: ADDRCONF(NETDEV_CHANGE): : link becomes ready
[  740.460801][T12255] bridge0: port 2() entered blocking state
[  740.467004][T12255] bridge0: port 2() entered forwarding state
05:04:17 executing program 1:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
bind$inet(r0, &(0x7f0000000440)={0x2, 0x4e23, @broadcast}, 0x10)
sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10)
shutdown(r0, 0x1)
ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000040))

05:04:18 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0)
r0 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$GIO_SCRNMAP(r0, 0x4b52, &(0x7f0000000040)=""/52)

05:04:18 executing program 3:
perf_event_open(&(0x7f00000002c0)={0x2, 0x70, 0xab, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$netlink(0x10, 0x3, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0)
writev(r0, &(0x7f0000000280)=[{&(0x7f0000000140)="39000000130009006900000000000000ab008000200000004600010707000014190001001000000800005068000000000000ef38bf461e59d7", 0x39}], 0x1)
writev(r0, &(0x7f0000000100)=[{&(0x7f0000000180)="3900000010002f0468ee0700230000fe0100ee0020000000450001070307001404001800120003000e040000000351f8000000000000000000", 0x39}], 0x1)

[  741.216029][T18997] bridge0: port 2() entered disabled state
[  741.296338][T18998] overlayfs: conflicting lowerdir path
[  741.776526][T19000] netlink: 1 bytes leftover after parsing attributes in process `syz-executor.3'.
[  741.788697][T19000] A link change request failed with some changes committed already. Interface  may have been left with an inconsistent configuration, please check.
[  741.807783][ T8721] IPv6: ADDRCONF(NETDEV_CHANGE): : link becomes ready
[  741.817023][ T8721] bridge0: port 2() entered blocking state
[  741.823397][ T8721] bridge0: port 2() entered forwarding state
[  741.885458][T18991] overlayfs: conflicting lowerdir path
05:04:19 executing program 1:
r0 = socket$xdp(0x2c, 0x3, 0x0)
setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, 0x0, 0x0)
getsockopt$XDP_STATISTICS(0xffffffffffffffff, 0x11b, 0x7, 0x0, &(0x7f0000000180))
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0)
pipe(&(0x7f0000000000)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700)
splice(r1, 0x0, r3, 0x0, 0x88000cc, 0x0)
fcntl$setpipe(r2, 0x407, 0x100000)
write$eventfd(r2, &(0x7f0000000240), 0xffffff14)

05:04:19 executing program 2:
syz_mount_image$tmpfs(&(0x7f00000002c0)='tmpfs\x00', &(0x7f0000000400)='./bus\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[])
chdir(&(0x7f0000000380)='./bus\x00')
close(0xffffffffffffffff)
r0 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r0, 0x200004)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, r1, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)

05:04:19 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0)
r0 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$GIO_SCRNMAP(r0, 0x4b52, &(0x7f0000000040)=""/52)

05:04:19 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:04:19 executing program 3:

05:04:19 executing program 0:
r0 = socket$packet(0x11, 0x2, 0x300)
getsockopt$packet_int(r0, 0x107, 0x12, 0x0, &(0x7f0000000140))

05:04:20 executing program 3:
perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0xce7c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffbfffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10)
mremap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil)
sendto$inet(r0, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)
sendto$inet(r0, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x14280000003075)

05:04:20 executing program 0:
perf_event_open(&(0x7f0000000300)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x6}, 0x4)
setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x16}]}, 0x10)
r1 = socket$inet6(0xa, 0x80003, 0x7)
connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @empty}, 0x1c)
sendmmsg(r1, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0)
ioctl$BLKPG(0xffffffffffffffff, 0x1269, &(0x7f0000000240)={0x1, 0x0, 0x0, &(0x7f0000000180)})

[  743.166937][T19026] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
[  743.181540][T19023] overlayfs: conflicting lowerdir path
05:04:20 executing program 2:
syz_mount_image$tmpfs(&(0x7f00000002c0)='tmpfs\x00', &(0x7f0000000400)='./bus\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[])
chdir(&(0x7f0000000380)='./bus\x00')
close(0xffffffffffffffff)
r0 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r0, 0x200004)
open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)

[  743.364333][T19026] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
[  743.440756][T19023] overlayfs: conflicting lowerdir path
05:04:20 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0)
r0 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$GIO_SCRNMAP(r0, 0x4b52, &(0x7f0000000040)=""/52)

05:04:21 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x2, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:04:21 executing program 1:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001})
r1 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}})
write$tun(r0, &(0x7f0000001180)={@void, @val={0x0, 0x0, 0x2}, @ipv6=@gre_packet={0x0, 0x6, "bc7d94", 0xf98, 0x3a, 0x0, @local, @mcast2={0x0}, {[@routing], {{}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, [], "81cd44586548be63b79b144c491dac3d1e89060154af20b7904d2cc8716d8f959b67c117bf7bef54d3d3768d255d198e295d14f331c8e0333f52138c0aa2c1363713181273607e7f39049a36d5d9a58275bcbfb6f19358b1f34b18a67a3b8c071ed8201e0b5c375de88cef4651b1466e118442fd3f54bc7551b96b605842ef42eab6"}, {}, {}, {0x8, 0x6558, 0x0, "9a5e8a3859d51c179dad4eb37af3371bd4249a3c714664ada735de75d895be2d84ba0cc598a8815c00805abdd8e80cd9cdb868e691838144f469616915bd349f138b30bf9b336d9ad555627777038b4ce03d963b8eda1dfdd192dda312b255dfdf27e269bff8eff200fa00cd02ed8741a38091bdff60643d904671eb6228baf4909538c1efef170b3cedf8f3887195ebf287d99407a35c3b9db2ff6497e3cdaeac5c81daa73e7ed3bfdc35cecc828485ba01707fbcc08fbb37aa4b5bfb221f5216adb8898f40c2de2d2f890772fe3e829cc95f3908bdf20225daeb4c7557706e72a64c58d3f738a1bda80a77d5c16adea2b6051ee729389b2cc811aa5aca1ddfc15c167381c194f6fae9a74e9319c61279da5fa3d84c9199ac51bac5c8690e25c96e9a0d584859187f3de240ef1b8f6d8491e64c22b0ddf385bedfe6337750677460005dabb45fbf45ce9866cabc72ce24bc833b6f849da9a211d63e23446aafb51067eaaa6a80d44343cf664b6753a1be9849bc121baedb2772e0069fe0da951b7129ee0cb06664f9c2fd6e1d6460b8ea1db66ad4d031f6e082f27331958ab98a5e700dcf72c18b7fbd0403ba9d557c02cbe673fc7ec74291bbb7f571c63e64d40dc03ce3e842b16d9440e38d60f3269f5782de77526323a3d937d93dbd6a1c0c4e10a0928124c3008fb27e9854a16f1c7944631339b925b793f80c629448cd34fe2e80a68ffce951b89aaa87184653f8b2d8281d1e59cf9b601ead0955509e5ecdf36fdf9251c1813b01145e43f040a2fdf88e71bc9224d847dbea35dd74b8fb429de9f2dfa2908b25c44142234cba0e00d00c055eae4af08e7a850268180c2caff4dd108c9c3a57f1c550325a603fd44f4dd8300e18280a21b8a8fb0a94d85bcb5ee1649378ae5c8230b8eeacbaa84e8357ba728ef55ace5b2b132c510374441bdc529d426b074b43fa6a77bde16bf72199ffe8ec70921e5c6016b6107c34a4e435a66cec71c83d9288b9e3f808e1e466cabf9c4825d3f7df7fa20c475583bcd81871cd8f5d9f109cccbf4ad2a85ca3e6e21844eebcc276fff4496166024ecc9e54eca2920c7801ec62c48ee71903cea47dea41364a33939c1496cda66b5c01b13c6869e0fc86fe246790ac47d7ec68bd07fc2cd194779b6c87766bceb162e6ee55cc86a95d50cde3beb0ac9fbb166e016184132a7acf599dd01e0c60020d17257451ce9a54a83498dc0d9ec87a91e78b52cd2aa126488b11b78eb940802aad6f5da5218a279765ed62a7c48a771969411780924286fd6d3c6864303f132e094fe1036fd14e3a2967c2f5cf9e1f2730c8564cd63bec0e1921821dafe26d977b5e0b446968c1b3d6eec2ac7e0ab13acdeda147c11bc7993b1e98289abd8e23520e54d77003ad1f95f54d9c066c003fa17243ed42fe853e21030ffe54d58c32bb14f3b18b057a3c7f7a03afe6b6e3041ab312506a6ad59d33b9e2d38bcd4cee108ee161d383e7b7c8d47fa1f6c0cd0ab3838fb4bacc03a05f35fda54d1663e43a795d997d519594074dea20cb0d3ecedc2b5269053fcf15e3c5ef2144f46cef149c8107140f13cb87f348573752b4fbc0ef4e916f2769f0095246e663ef67d95fdafb325f7b62a7848c2615d1a9802227a6fdce62b4ae00de40d797853842735c062b095f35d31223317dab877cf9222fd95be7611e1b3ec8a3ecc45ee8aa4bd625a567d8727543ffdf72b478102141e7c8373c528291cbd58e96beb613e20d052bcf05da39ca241b6bd687d45566dda7aac8c766655e7b7ac1087aee09e1445b7dc5e02fad06d1811b6d86bc364084545413db9efb979899e091b9bf63eb87e94f597e3cdc32132fbc73c5cc94ae3054db4e7ea9f856df9747768be94b4489e3ccf55c43186b133c2bf44777f67207ca1d91a1873a130b94fc974c86ce5b0a6c3017f4fc11b8d002458a7e095ef73a949187c23e5e43a7679c8915fea2afb5adfd57b7716bad671471e2f22d3bdbd09666d62803f4f3fe140b0392e4830c67107d728478c0047be39df18437404eb175bd8b3e34da042cb0f34f8a0c8a8a1048a32a2981b6c74fd6a5b18b8cd97991d729f2cf08febb0054b76d2cf4f83acfb0446e59c67919f6b837365b492d2c4b4f1dac61476137376084d006c6e8846f2c89ad3898b4a087e23cb7d8180d31120db1ca9b1c1cbb1ff303391d6829cdbce360997d4460ae6e865c8c0fc3709eb8758a961a9904756d31c7e50e825bb8003fa9b2bf815718ecd5e5e47df8ea8be5fc26ba385bc9568d174c29491c04292d1bbecf1ca60276938598ab7d026ad375bd7e81825ed1aeec8ae419164b554d07c975f35a4626160b7be73d80d5cbad63393cb11283740c0d9d12163008911f1649f40054799889fb4bff2bce9f2251e89363e677c447d5e740d3bf3578a32f634ef6c49f4e48a58c1ff84a87ddc0864bff96359951eaa6d0a21d8b147af4b2d96cd25b524b6ba63f8d7acc3fd6751a6275ae12d10d747af83790cfbb938ba188527a270b961a745a68de305883bf0bb34988700e57b4f2682ace0115c0c2590837b219a30e915fbbfe65b7b12d8a6bb4851b9ceb00d52c83fc1d1a4222a67ea3e444907154632991d9074fb963e93860aa07701924dfd293adde5fd287d92fe663c107eae6619ad7a985d2e67f5d887d822f9a6e183e9a107416526ae1eef1bcc516fdbe5e91e5dea9fda9e5aafa86a1e318f39d539d05ad53f27327cb1a5590302e99f52aef88483892598e277b98ea33db96888e8da31ef7e24bb29dfb2cbe19ab57e3887c18d72dca51c89470dec3f5d5b902fe91ef0d28a90d48298c753349574da605fe52ba41850fb94f55c4494043fa5f473f69ba4b900cb0c2e2dd2bdfe7338a9111f05d96281507fbe23d1645ddb95be69a47244db8683de20ed0535774b2f1c51e04c90edc5a8eee3a5431312a8221a1ca92b4726c92acaa67591cf8f474636519cce5bb327863704ff1cdc190a5d8d38b9a8916a90e15a2e75865e9584009cdc567b4d064b777e0b8eb3c982d5d2306a2818ddbe2a23b0f4c196bdd1baddecec6ad206c002615db7fa666475c3197c3d4ff16a68e0b2b4062fac54b96d775f46c89db92376f6b1257ff51b6ea67f4be817ca09462dc769250a9b4a803f83d8a052129b6a3604e1d7070ea3d9b2db6b53768a2bb47e09d1ee178a839e8300029149d6bf46629e314d6efaf70fa69d11b110befcc58b5174a6f6c0e3e409774f7d13bb5ba775facd214cb708ec65ef7d166f93030555e8daa2b468b0d0a7d07a38b26661d983f45fd695ad0e98c0d03dc6befa6e699f0d482a114c0048c7dce8d48091f2e3fab6822c5cacfca0ac582d7df1204768bee0bef12d74447e89c3cf347e50368460192d5ad9ba2ee596797bdc02d9183d179773a3ac023efb1d06bb4665d7ff39294cfc67b019f877a07adb4fa4aa93e874349bb59238babd7cd85fbec65d81ef5486e1579c2a5cdbcaffc55c6ff36b9f20af644413e6213bdd44d565859252567485bd41bce2be44271107c25169540080e423c0e2d35003a598c489a15129f642c8b97a4835bc12d85849d2fc2f05d688df5fd696620de09ef94c0a45a448226e6dc93e359a0e9d5c926029bef3398052afda7ffd2e41be6aae773e93e27fb821ef2fd89ef3b61c70d7b9993994e102ae068d1739da327373313022e26312bf653402a46eb5404ffebc40df70355b03bef6e4afff0aab7fd945694c83da82d8b92eaee2c281c21004482d63a6c33bbd084e4a1a501f216a04b2cb6c1893c6ede5f68b28f6bf14d71d37235461ad0eb853f3e372097f993fbdd6dc781df06dcb6ebb498ad27e41c50afa11096767c822d0bea566edeacfe0ec57cc1bc7bcf9a7069eaae307dd69070e0dbefd7e63408c7a358a8ed87ab47912140d729458296661eeac1e375749131d21d6047b0bba0ab906ded926acef198a279f0260a5527cdd39f4cfdbb1c0a45fead153d44eea75e9d792d3c9801a3e112542c23c5a6d6f953476d18e90f7f499d5f1edc8cfa6edc1f3dd47531282491c7368f36fe8db5390ef43fc1220d9d91094e250e1ef289e10d9daf965429959b73e39548acbdcc10e8c28215707f7016f566bd8ef86dfe8b193d1534b835269e08e80efda189cbfb15814dfb75ea7f24a42797a56770d65fb2e10ac6506f7ecb4061ba3f66490f97ed610301ef6103587db54dd9865592cac2dac66ff16ecdb88da2e9f699dfc384bfe098f110cc0665a5823cef4effa014e8a4246f536c8861dc94414d57d9c69c9669d3a98c0e264f3fd63a22d3840ad9afda44e46e204c5fb6cd09c620ceb1e81aa5e6b038378aa095f840f05dc44732c318e18b5fcedadf9355066e626956f0ba7194fb687c4415f18f7942b805afe43b90569b4eea4ad9d5e5f934ee2b5f9b67b7e157d1f256a915646552265cf6422f0b5da5e201168d25caf37f52a11970bda08108363efe5ec2767f857b44c2f60d8fc255fa8c661bfd6950fcb5f4ef1d7e17c6047019fd3319a17ba74cb1b4ab64e7f5ea9e9d22b338a656bdd79266299fdd28f51a546e6a904d58be941684ff053861f4aba65f98ae127d8a82b3e125b5b007ef8c136f113b63dd552955af4768618699e4266d51915c43c62bbcdd007d9b339061a1de5cd312db5b1e435f06dace896aa2200903bd06581a29b03af58e48886bc98a71fc01c7648042a3fcbcd27014c45d3645501d57b4bbbff835b01c72495e61f03fbaba822deca26b30f948625f1ca7af0d6555c9b9bfc54e6ccecefc73cb10e01c1cf6362daaef8fd7ef08554a4b25c28bf823068b6fa74e29c9e27c0919c2ec46153b3b07376efaffb6eaebdd190ada1f11b2ee99442b523e163e7aa8ac657ad6037a1c45dcf624d00f5a528df82d94abc469a9d87a3501ebc2a0a3a918f83c2e2b015db475b0617374c64f747d1fb0f0e24d2696057b61266dc2884ed2731cbc55fe6ca076f8813ffa62cae5c025b3b277f949617edef451c5c8b65cfc83644b11792802ab37011c90e2876183ffdf6d1ebd8e5141a42dda4c68ddcf79cca67887b80ae0de70bb7bfcd055b779da9643fe9feabdfd5f0627bb9c6b622491639bebd25a4702ba600c1e5441e29ccbea511c4ffcd084c66907c7621c0cec2acdff4d3c90eb8c43cf281ca812e1e2ec5c3fd3ea00fd4e79a177f195ee068283b06321f063f6e933ee80ede2c30768e89cccd96a41a96aa0c4eab9287ee745954eef11a12c31524adb3779a79416f696af53abe87450340855bf38c73ba95eeb833ec029cffbfed62b441acefe498b191fc953f5f4dc0716c9d131"}}}}}, 0xfca)

05:04:21 executing program 3:
prctl$PR_SET_NAME(0xf, 0x0)
lstat(0x0, 0x0)
chown(0x0, 0xee01, 0x0)
socket$inet_udplite(0x2, 0x2, 0x88)
openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0)
openat(0xffffffffffffffff, 0x0, 0x0, 0x0)
pwritev(0xffffffffffffffff, &(0x7f0000000600), 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000380)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x12000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000ec0)=ANY=[@ANYBLOB="b702000006000000bfa300000000000007030000007effff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000496cf2827fb43a431ca711fcd0cdfa146ed3d09a6175037958e271b60d25b7937f02008b5e5a076d83928226df412bfecf5cc0ac77db96753dd29c03404ed47dafe6c8dc3d5d78c07f34e4d5b31b5b310efd4989147a09000000f110026e6d2ef831ab7ea0c34f17e3adeef3bb622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b0a341a2d7cbdb9cd38bdb2ca8e050000003a14817ac61e4dd11183a13477bf7e060e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c21476619f28d9961b626c57c2691208173656d60a17e3c184b751c51160fbcbbdb5b1e7be6148ba532e6ea09c346dfebd31a08b32808b80200000000000000334d83239dd27080e71113610e10d858e8327ef01fb6c86adac12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3d74ca891c4594e8a4399e01eadd3964663e88535c133f7130856f756436303767d2e24f29e5dad9796edb697a6ea0182bab9818b0a83dede495d754dc128cae2ed4b4390af9a9ffefd07e002cab5ebf8aad34732181feb215139f15ea7e8cb0c7cbe31fbae7c34d5ac5e7e64c21add9191eadd6e1795ad6a0f7f88345d4f71af3cbf781c0a99bd50499ccc421ace5e85efb17c7beba3da8223fe5308e4e65eebaace04f4087c4f0da0d9a88f9dbb593ddebf70132563e47e2de0406edd09ee3a4d0175b989b8eccf707882042e716df9b57b290c661d4e85031086e97bcc5ca0e221a0e34323c12910296b7a643e82e88a1940b3c02ed9c92d6f24b1282dc519b00159830d7617001154c46bd3ca96318c570f0721fc7aa2a5809000000065ad624f45bd40000000094f22cdf550ef091a78098534f0d973058594119d06d5ea9a8d0857382ec6e28071474cfc12346e47ad97f4ead7cf754a52e4b2d0f22d428bd705414888761a30e2366c6a06bf55785052f95441a87790017b00100173db9c24db65c1e00015c1d573dab18fd0600885f1ea8f2453dcb6a2bfd299fc3cdafda323e9c7080397bc49d70c060d57bc88fbe3bbaa058b040362ab9261503def363fb099408885afc2bf9a4f8c35070669ea69f5e4be1b8e0d6697e98b26fc51439d670dba6623279f73db9dec75070cd9ab0fd96b069ef6d2857b6bf955012cf7fe50d133d541da86e0477e4a6cc999dc21c3ef408e633dfa35f14d6e734837d365e63845f3c1092f8dde8af3904ea0f4b82649b83ed4fa0f873339c4cad4ead134847425a6da2c8067ab743c1d82a5687f2ed690700000000000000000000000000000000000000000093fc7a82b98f99d9dedf7ba17f5f0b6d15e552fbd21f7eecff102b5243af03eea84c4304a5d3f93c3fc74c00000000000043e1ed82b9960ae92a499984a082776eb0937523f5292d126599d4345cde64f903c3415c618a32c2318f0858f19c6def80e1481e8e1c0098fc3f38b7a57211adb15d824cfdcf229628c0de49860a442863d6e257cfa4ce50f3d163d442824414a7da26cc86d7e18631c2061b1c8a8e3c06837fe08de62f8710ca977960a70685eace73da6022a8671d1a3575b4e18c28c73203bf134686dd65808452cb6b76fcb134252c78de9b240de7b4cd015a77f76b3f964f432a4bf6cddd6222c2da006b6fdb9c8468ae1d986a893b95195b4d16a6dfa92c04331a6698507048fab5ae402acd05fe621f22712dfd09ea4770b4278fa14547d8ce3c21188e5e4e2baacd98e8e443d6aaafe80053636ed1d99346c2468dd952595d78e9583bf4ea5de36099e3cddcb23aefd124b0ab85580f4ebb6eddb9e87c9ece874be869b3abe1c67788b247695533cc662ea09fea55887dfa18d0aea13625895db90e237157a34ea9447237ea5b391bddd1290f7ce987a0e36b8e0400779b253e49d21836e4b3220616aafbe7a3a18375ae593eb58fd5004262d31f7a4dd5b3b0f1cfb55dadf450d7a5e087171ca0209d6444dbecac8d5dd3600873ec8d013f158f503e8347e91d890c0c585457bca7017cf2201458e8f709af01134ef16e5b31ce4ce49bf09cd01af73b3aa23e55934e9aba90a1f91f47c9cd13528e516d07b0b8fe3a08f8da0a5a0eca8e382122610aa1e41f37c8087d99b002d3c1af0bcd77a7995e6424129958485f711e1f14ae295360a84c9b20aec3618cbace6e18727914fa217a9582ebd94321669c63f576027ed5036dc3b9df41a12d7a60930693da768a814db21dc81695b8760f788760090000000000e7731f107c4f64de2305573e188e3de879991c9baad0b1eb783d2ca57f5258a23bf549c125b94cf3a6f3e9ed13bf074a8ce8ccdd015105f92239bebba7c81d1106e28f0608cfe0f10af485dc38ef32e5886b9c964353c1e793dab1809ec59661288ae7f7977bb05f41f60b98f393e737eda199ab4287045f5f80f686d3013d54c2a4d46b6113ef65f2c4d6df"], &(0x7f0000000340)='syzkaller\x00'}, 0x48)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r0, 0x18000000000002a0, 0x43, 0x6000, &(0x7f0000000280)="b9ff0300600d698c389e14f065581fffffff000040006321000e08060001080006040062050000002fbd53039e6aab84181aa5feffff07000000fe0000000000000000", 0x0, 0xfc, 0x60000000, 0x0, 0x0, &(0x7f0000000140)="486e90decd837f7e62c4f903a15a12d35c31c761c1da726b54ccd47736cdde536c0b3e75ef5c913757491df3e38f5cc44e6847bdc594358967964f76aa9f31a6", &(0x7f0000000e00)="e2cf5bb7e5746a6740aebad755a0c2f42d131e1493afc9154aeae4ff8916e84fae2dbac6ba23acee58596467b1d68d886cf44ae164800edec75a809bcc514384c499930e5c18337dcbedb8e326b8b42e4ba1acb01b73cdcef9b719fb5ce7b547f9324fbebb24d0fd464fa10fd1fccf19f0f42441b5b27a5c93b29874c85ae55fd3cce1e8b903601c"}, 0x29)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)

05:04:21 executing program 5:
prctl$PR_SET_NAME(0xf, 0x0)
lstat(0x0, 0x0)
chown(&(0x7f00000000c0)='./bus\x00', 0xee01, 0x0)
socket$inet_udplite(0x2, 0x2, 0x88)
openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0)
r0 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0)
pwritev(r0, 0x0, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000380)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x1, 0xffffffffffffffff, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000ec0)=ANY=[@ANYBLOB="b702000006000000bfa300000000000007030000007effff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000496cf2827fb43a431ca711fcd0cdfa146ed3d09a6175037958e271b60d25b7937f02008b5e5a076d83928226df412bfecf5cc0ac77db96753dd29c03404ed47dafe6c8dc3d5d78c07f34e4d5b31b5b310efd4989147a09000000f110026e6d2ef831ab7ea0c34f17e3adeef3bb622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b0a341a2d7cbdb9cd38bdb2ca8e050000003a14817ac61e4dd11183a13477bf7e060e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c21476619f28d9961b626c57c2691208173656d60a17e3c184b751c51160fbcbbdb5b1e7be6148ba532e6ea09c346dfebd31a08b32808b80200000000000000334d83239dd27080e71113610e10d858e8327ef01fb6c86adac12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3d74ca891c4594e8a4399e01eadd3964663e88535c133f7130856f756436303767d2e24f29e5dad9796edb697a6ea0182bab9818b0a83dede495d754dc128cae2ed4b4390af9a9ffefd07e002cab5ebf8aad34732181feb215139f15ea7e8cb0c7cbe31fbae7c34d5ac5e7e64c21add9191eadd6e1795ad6a0f7f88345d4f71af3cbf781c0a99bd50499ccc421ace5e85efb17c7beba3da8223fe5308e4e65eebaace04f4087c4f0da0d9a88f9dbb593ddebf70132563e47e2de0406edd09ee3a4d0175b989b8eccf707882042e716df9b57b290c661d4e85031086e97bcc5ca0e221a0e34323c12910296b7a643e82e88a1940b3c02ed9c92d6f24b1282dc519b00159830d7617001154c46bd3ca96318c570f0721fc7aa2a5809000000065ad624f45bd40000000094f22cdf550ef091a78098534f0d973058594119d06d5ea9a8d0857382ec6e28071474cfc12346e47ad97f4ead7cf754a52e4b2d0f22d428bd705414888761a30e2366c6a06bf55785052f95441a87790017b00100173db9c24db65c1e00015c1d573dab18fd0600885f1ea8f2453dcb6a2bfd299fc3cdafda323e9c7080397bc49d70c060d57bc88fbe3bbaa058b040362ab9261503def363fb099408885afc2bf9a4f8c35070669ea69f5e4be1b8e0d6697e98b26fc51439d670dba6623279f73db9dec75070cd9ab0fd96b069ef6d2857b6bf955012cf7fe50d133d541da86e0477e4a6cc999dc21c3ef408e633dfa35f14d6e734837d365e63845f3c1092f8dde8af3904ea0f4b82649b83ed4fa0f873339c4cad4ead134847425a6da2c8067ab743c1d82a5687f2ed690700000000000000000000000000000000000000000093fc7a82b98f99d9dedf7ba17f5f0b6d15e552fbd21f7eecff102b5243af03eea84c4304a5d3f93c3fc74c00000000000043e1ed82b9960ae92a499984a082776eb0937523f5292d126599d4345cde64f903c3415c618a32c2318f0858f19c6def80e1481e8e1c0098fc3f38b7a57211adb15d824cfdcf229628c0de49860a442863d6e257cfa4ce50f3d163d442824414a7da26cc86d7e18631c2061b1c8a8e3c06837fe08de62f8710ca977960a70685eace73da6022a8671d1a3575b4e18c28c73203bf134686dd65808452cb6b76fcb134252c78de9b240de7b4cd015a77f76b3f964f432a4bf6cddd6222c2da006b6fdb9c8468ae1d986a893b95195b4d16a6dfa92c04331a6698507048fab5ae402acd05fe621f22712dfd09ea4770b4278fa14547d8ce3c21188e5e4e2baacd98e8e443d6aaafe80053636ed1d99346c2468dd952595d78e9583bf4ea5de36099e3cddcb23aefd124b0ab85580f4ebb6eddb9e87c9ece874be869b3abe1c67788b247695533cc662ea09fea55887dfa18d0aea13625895db90e237157a34ea9447237ea5b391bddd1290f7ce987a0e36b8e0400779b253e49d21836e4b3220616aafbe7a3a18375ae593eb58fd5004262d31f7a4dd5b3b0f1cfb55dadf450d7a5e087171ca0209d6444dbecac8d5dd3600873ec8d013f158f503e8347e91d890c0c585457bca7017cf2201458e8f709af01134ef16e5b31ce4ce49bf09cd01af73b3aa23e55934e9aba90a1f91f47c9cd13528e516d07b0b8fe3a08f8da0a5a0eca8e382122610aa1e41f37c8087d99b002d3c1af0bcd77a7995e6424129958485f711e1f14ae295360a84c9b20aec3618cbace6e18727914fa217a9582ebd94321669c63f576027ed5036dc3b9df41a12d7a60930693da768a814db21dc81695b8760f788760090000000000e7731f107c4f64de2305573e188e3de879991c9baad0b1eb783d2ca57f5258a23bf549c125b94cf3a6f3e9ed13bf074a8ce8ccdd015105f92239bebba7c81d1106e28f0608cfe0f10af485dc38ef32e5886b9c964353c1e793dab1809ec59661288ae7f7977bb05f41f60b98f393e737eda199ab4287045f5f80f686d3013d54c2a4d46b6113ef65f2c4d6df"], &(0x7f0000000340)='syzkaller\x00'}, 0x48)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x18000000000002a0, 0x43, 0x6000, &(0x7f0000000280)="b9ff0300600d698c389e14f065581fffffff000040006321000e08060001080006040062050000002fbd53039e6aab84181aa5feffff07000000fe0000000000000000", 0x0, 0xfc, 0x60000000, 0x0, 0x0, &(0x7f0000000140)="486e90decd837f7e62c4f903a15a12d35c31c761c1da726b54ccd47736cdde536c0b3e75ef5c913757491df3e38f5cc44e6847bdc594358967964f76aa9f31a6", &(0x7f0000000e00)="e2cf5bb7e5746a6740aebad755a0c2f42d131e1493afc9154aeae4ff8916e84fae2dbac6ba23acee58596467b1d68d886cf44ae164800edec75a809bcc514384c499930e5c18337dcbedb8e326b8b42e4ba1acb01b73cdcef9b719fb5ce7b547f9324fbebb24d0fd464fa10fd1fccf19f0f42441b5b27a5c93b29874c85ae55fd3cce1e8b903601c"}, 0x29)
socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)

05:04:21 executing program 2:
syz_mount_image$tmpfs(&(0x7f00000002c0)='tmpfs\x00', &(0x7f0000000400)='./bus\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[])
chdir(&(0x7f0000000380)='./bus\x00')
close(0xffffffffffffffff)
r0 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r0, 0x200004)
open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)

[  744.923436][T19052] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
[  745.055492][T19051] overlayfs: conflicting lowerdir path
[  745.384907][T19051] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
05:04:22 executing program 3:
setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0)
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0)
pipe(&(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700)
splice(r0, 0x0, r2, 0x0, 0x88000cc, 0x0)
fcntl$setpipe(r1, 0x407, 0x100000)
write$eventfd(r1, &(0x7f0000000240), 0xffffff14)

05:04:23 executing program 5:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x3}, 0x0, 0x2000, 0x0, 0x2, 0x3, 0x80000001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
syz_genetlink_get_family_id$batadv(&(0x7f0000000000)='batadv\x00')
sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000300)=ANY=[@ANYBLOB="d00400670880", @ANYRESDEC=r0, @ANYBLOB="a789d81e8af0c5f773a8f033cd60", @ANYRESHEX], 0x14}}, 0x0)
sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000004c0)={&(0x7f00000007c0)=ANY=[@ANYBLOB, @ANYRESDEC, @ANYBLOB="00002bbd7000fedbdf250200000008002b000400000004f47f5d4e7c47c0ac5fbd698e18a222deb49116352eb2354772bbbe61e04b562da7e94a85df3b6b2aa05cd0f1d3f4f10931a7372085711aacc778e5dc6ec88feb3d278e4694b03ef3265c2b67e13dd4e8bb88f16fe5dc45db45ce0cda463cc07d7cd71ce93ef4bf76505e081cf3b32ed28bccc36ddf47092fa83ec0d9c3b4e3cc9b1de48737ded5a9d9928f6bf6619d2277595add6d889689845024c7e9a4f6614785e78d2a0824c233acb68369c1f1baba5508"], 0x1c}, 0x1, 0x0, 0x0, 0x48000}, 0x800)
syz_emit_ethernet(0x76, &(0x7f0000000080)={@broadcast=[0xff, 0xff, 0xff, 0x0], @random="f674049167a6", @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "a4f008", 0x40, 0x3a, 0x0, @empty={[0x3, 0x3c]}, @mcast2, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "0004e6", 0x0, 0x0, 0x0, @remote, @remote, [@routing={0x2f}], "000022ebffff0400"}}}}}}}, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0)
getsockname$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, <r1=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, r1, 0x0, 0x10144}, [@IFLA_AF_SPEC={0x1c, 0x1a, 0x0, 0x1, [@AF_INET6={0x18, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @initdev={0xfe, 0x88, [], 0x0, 0x0}}]}]}]}, 0x3c}}, 0x0)
sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x208c8}, 0xc, &(0x7f0000000240)={&(0x7f0000000640)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00082bbd7000fddbdf250700000008003900ff070000050029000000000000000300", @ANYRES32=r1, @ANYBLOB="06fdd85c", @ANYRES32=r1, @ANYBLOB="00003800000000000500330001000000"], 0x44}, 0x1, 0x0, 0x0, 0x4004810}, 0x20000000)
syz_emit_ethernet(0x8e, &(0x7f00000000c0)={@broadcast, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "42bf00", 0x58, 0x3a, 0x0, @local={0xfe, 0x80, [0x3, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd]}, @mcast2, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x7c, {0x0, 0x6, "7f112d", 0x0, 0x29, 0x0, @mcast1, @remote, [@dstopts={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x3a], [@enc_lim]}, @srh={0x0, 0x2, 0x4, 0x1, 0x0, 0x0, 0x0, [@mcast2]}]}}}}}}}, 0x0)
sendmsg$RDMA_NLDEV_CMD_DELLINK(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000005c0)={&(0x7f0000000500)={0x18, 0x1404, 0x4, 0x70bd25, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}, 0x1, 0x0, 0x0, 0x4004040}, 0x800)
connect$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @empty}, 0x10)
r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0)
sendfile(0xffffffffffffffff, r2, 0x0, 0x8000fffffffe)
ioctl$BLKROGET(0xffffffffffffffff, 0x125e, &(0x7f0000000000))
ioctl$SIOCSIFHWADDR(r2, 0x8924, &(0x7f0000000280)={'vlan1\x00', @local})
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x811, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x410, 0xf0ffff}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

05:04:23 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x3, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:04:23 executing program 2:
syz_mount_image$tmpfs(&(0x7f00000002c0)='tmpfs\x00', &(0x7f0000000400)='./bus\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[])
chdir(&(0x7f0000000380)='./bus\x00')
close(0xffffffffffffffff)
r0 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r0, 0x200004)
open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)

[  747.792859][T19088] overlayfs: conflicting lowerdir path
[  747.795474][T19090] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
[  748.008169][T19091] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
[  748.038868][T19090] overlayfs: conflicting lowerdir path
05:04:25 executing program 0:
perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0xce7c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffbfffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10)
mremap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil)
sendmsg$NFT_MSG_GETTABLE(0xffffffffffffffff, 0x0, 0x0)
sendto$inet(r0, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)
sendto$inet(r0, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x14280000003075)

05:04:25 executing program 5:
perf_event_open(&(0x7f00000002c0)={0x2, 0x70, 0xac, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
setpriority(0x0, 0x0, 0x0)

05:04:25 executing program 1:
openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6(0xa, 0x401000000001, 0x0)
close(r0)
r1 = socket$inet6(0xa, 0x3, 0xff)
connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x83, @empty}, 0x1c)
r2 = open(&(0x7f0000000100)='./bus\x00', 0x11250c2, 0x0)
r3 = creat(&(0x7f0000000040)='./bus\x00', 0x0)
ftruncate(r3, 0x208200)
r4 = socket(0x10, 0x3, 0x0)
r5 = socket(0x11, 0x800000003, 0x0)
syncfs(r4)
bind(r5, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
sendfile(r0, r2, 0x0, 0x8000fffffffe)

05:04:25 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0)
r0 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$GIO_SCRNMAP(r0, 0x4b69, &(0x7f0000000040)=""/52)

05:04:25 executing program 2:
syz_mount_image$tmpfs(&(0x7f00000002c0)='tmpfs\x00', &(0x7f0000000400)='./bus\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[])
chdir(&(0x7f0000000380)='./bus\x00')
close(0xffffffffffffffff)
r0 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r0, 0x200004)
mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)

05:04:25 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x4, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  748.706207][T19096] overlayfs: conflicting lowerdir path
[  748.933751][T19103] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
[  748.955272][   T29] audit: type=1800 audit(1597295066.147:20): pid=19105 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.1" name="bus" dev="sda1" ino=15782 res=0
05:04:26 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x5, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:04:26 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000380)={'syz_tun\x00', &(0x7f0000000180)=ANY=[@ANYBLOB="0f000000000000000000000000000000000000000000000000000000000000000000000000000000070000000000000000000000000000000000008e3e"]})

05:04:26 executing program 2:
syz_mount_image$tmpfs(&(0x7f00000002c0)='tmpfs\x00', &(0x7f0000000400)='./bus\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[])
chdir(&(0x7f0000000380)='./bus\x00')
close(0xffffffffffffffff)
r0 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r0, 0x200004)
mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)

05:04:27 executing program 3:
perf_event_open(&(0x7f00000002c0)={0x2, 0x70, 0xab, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00000001c0))

05:04:27 executing program 1:
openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6(0xa, 0x401000000001, 0x0)
close(r0)
r1 = socket$inet6(0xa, 0x3, 0xff)
connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x83, @empty}, 0x1c)
r2 = open(&(0x7f0000000100)='./bus\x00', 0x11250c2, 0x0)
r3 = creat(&(0x7f0000000040)='./bus\x00', 0x0)
ftruncate(r3, 0x208200)
r4 = socket(0x10, 0x3, 0x0)
r5 = socket(0x11, 0x800000003, 0x0)
syncfs(r4)
bind(r5, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
sendfile(r0, r2, 0x0, 0x8000fffffffe)

05:04:27 executing program 5:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip={{0x9, 0x1, 'ipip\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x11, @multicast1=0xe0000005}]}}}]}, 0x3c}}, 0x0)

[  750.263167][T19122] overlayfs: conflicting lowerdir path
[  750.397967][T19125] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
[  750.400533][T19132] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
05:04:27 executing program 0:
syz_mount_image$tmpfs(&(0x7f00000002c0)='tmpfs\x00', &(0x7f0000000400)='./bus\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[])
chdir(&(0x7f0000000380)='./bus\x00')
r0 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r0, 0x200004)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, r1, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)

[  750.677764][   T29] audit: type=1800 audit(1597295067.867:21): pid=19137 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.1" name="bus" dev="sda1" ino=15841 res=0
05:04:27 executing program 2:
syz_mount_image$tmpfs(&(0x7f00000002c0)='tmpfs\x00', &(0x7f0000000400)='./bus\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[])
chdir(&(0x7f0000000380)='./bus\x00')
close(0xffffffffffffffff)
r0 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r0, 0x200004)
mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)

[  750.778071][T19140] netlink: 'syz-executor.5': attribute type 17 has an invalid length.
05:04:28 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x6, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:04:28 executing program 3:
r0 = socket$inet6(0xa, 0x401000000001, 0x0)
close(r0)
close(0xffffffffffffffff)
r1 = socket$inet6(0xa, 0x3, 0xff)
connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c)
r2 = open(&(0x7f0000000100)='./bus\x00', 0x11250c2, 0x0)
r3 = creat(&(0x7f0000000040)='./bus\x00', 0x0)
setsockopt$inet6_opts(r0, 0x29, 0x37, &(0x7f0000000000)=@fragment, 0x8)
ftruncate(r3, 0x208200)
sendfile(r0, r2, 0x0, 0x8000fffffffe)

05:04:28 executing program 5:
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000ec0)=ANY=[@ANYBLOB="b702000006000000bfa300000000000007030000007effff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000496cf2827fb43a431ca711fcd0cdfa146ed3d09a6175037958e271b60d25b7937f02008b5e5a076d83928226df412bfecf5cc0ac77db96753dd29c03404ed47dafe6c8dc3d5d78c07f34e4d5b31b5b310efd4989147a09000000f110026e6d2ef831ab7ea0c34f17e3adeef3bb622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b0a341a2d7cbdb9cd38bdb2ca8e050000003a14817ac61e4dd11183a13477bf7e060e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c21476619f28d9961b626c57c2691208173656d60a17e3c184b751c51160fbcbbdb5b1e7be6148ba532e6ea09c346dfebd31a08b32808b80200000000000000334d83239dd27080e71113610e10d858e8327ef01fb6c86adac12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3d74ca891c4594e8a4399e01eadd3964663e88535c133f7130856f756436303767d2e24f29e5dad9796edb697a6ea0182bab9818b0a83dede495d754dc128cae2ed4b4390af9a9ffefd07e002cab5ebf8aad34732181feb215139f15ea7e8cb0c7cbe31fbae7c34d5ac5e7e64c21add9191eadd6e1795ad6a0f7f88345d4f71af3cbf781c0a99bd50499ccc421ace5e85efb17c7beba3da8223fe5308e4e65eebaace04f4087c4f0da0d9a88f9dbb593ddebf70132563e47e2de0406edd09ee3a4d0175b989b8eccf707882042e716df9b57b290c661d4e85031086e97bcc5ca0e221a0e34323c12910296b7a643e82e88a1940b3c02ed9c92d6f24b1282dc519b00159830d7617001154c46bd3ca96318c570f0721fc7aa2a5809000000065ad624f45bd40000000094f22cdf550ef091a78098534f0d973058594119d06d5ea9a8d0857382ec6e28071474cfc12346e47ad97f4ead7cf754a52e4b2d0f22d428bd705414888761a30e2366c6a06bf55785052f95441a87790017b00100173db9c24db65c1e00015c1d573dab18fd0600885f1ea8f2453dcb6a2bfd299fc3cdafda323e9c7080397bc49d70c060d57bc88fbe3bbaa058b040362ab9261503def363fb099408885afc2bf9a4f8c35070669ea69f5e4be1b8e0d6697e98b26fc51439d670dba6623279f73db9dec75070cd9ab0fd96b069ef6d2857b6bf955012cf7fe50d133d541da86e0477e4a6cc999dc21c3ef408e633dfa35f14d6e734837d365e63845f3c1092f8dde8af3904ea0f4b82649b83ed4fa0f873339c4cad4ead134847425a6da2c8067ab743c1d82a5687f2ed690700000000000000000000000000000000000000000093fc7a82b98f99d9dedf7ba17f5f0b6d15e552fbd21f7eecff102b5243af03eea84c4304a5d3f93c3fc74c00000000000043e1ed82b9960ae92a499984a082776eb0937523f5292d126599d4345cde64f903c3415c618a32c2318f0858f19c6def80e1481e8e1c0098fc3f38b7a57211adb15d824cfdcf229628c0de49860a442863d6e257cfa4ce50f3d163d442824414a7da26cc86d7e18631c2061b1c8a8e3c06837fe08de62f8710ca977960a70685eace73da6022a8671d1a3575b4e18c28c73203bf134686dd65808452cb6b76fcb134252c78de9b240de7b4cd015a77f76b3f964f432a4bf6cddd6222c2da006b6fdb9c8468ae1d986a893b95195b4d16a6dfa92c04331a6698507048fab5ae402acd05fe621f22712dfd09ea4770b4278fa14547d8ce3c21188e5e4e2baacd98e8e443d6aaafe80053636ed1d99346c2468dd952595d78e9583bf4ea5de36099e3cddcb23aefd124b0ab85580f4ebb6eddb9e87c9ece874be869b3abe1c67788b247695533cc662ea09fea55887dfa18d0aea13625895db90e237157a34ea9447237ea5b391bddd1290f7ce987a0e36b8e0400779b253e49d21836e4b3220616aafbe7a3a18375ae593eb58fd5004262d31f7a4dd5b3b0f1cfb55dadf450d7a5e087171ca0209d6444dbecac8d5dd3600873ec8d013f158f503e8347e91d890c0c585457bca7017cf2201458e8f709af01134ef16e5b31ce4ce49bf09cd01af73b3aa23e55934e9aba90a1f91f47c9cd13528e516d07b0b8fe3a08f8da0a5a0eca8e382122610aa1e41f37c8087d99b002d3c1af0bcd77a7995e6424129958485f711e1f14ae295360a84c9b20aec3618cbace6e18727914fa217a9582ebd94321669c63f576027ed5036dc3b9df41a12d7a60930693da768a814db21dc81695b8760f788760090000000000e7731f107c4f64de2305573e188e3de879991c9baad0b1eb783d2ca57f5258a23bf549c125b94cf3a6f3e9ed13bf074a8ce8ccdd015105f92239bebba7c81d1106e28f0608cfe0f10af485dc38ef32e5886b9c964353c1e793dab1809ec59661288ae7f7977bb05f41f60b98f393e737eda199ab4287045f5f80f686d3013d54c2a4d46b6113ef65f2c4d6df"], &(0x7f0000000340)='syzkaller\x00'}, 0x48)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r0, 0x18000000000002a0, 0x43, 0x6000, &(0x7f0000000280)="b9ff0300600d698c389e14f065581fffffff000040006321000e08060001080006040062fc0000002fbd53039e6aab84181aa5feffff07000000fe0000000000000000", 0x0, 0xfc, 0x60000000, 0x0, 0x0, &(0x7f0000000140)="486e90decd837f7e62c4f903a15a12d35c31c761c1da726b54ccd47736cdde536c0b3e75ef5c913757491df3e38f5cc44e6847bdc594358967964f76aa9f31a6", &(0x7f0000000e00)="e2cf5bb7e5746a6740aebad755a0c2f42d131e1493afc9154aeae4ff8916e84fae2dbac6ba23acee58596467b1d68d886cf44ae164800edec75a809bcc514384c499930e5c18337dcbedb8e326b8b42e4ba1acb01b73cdcef9b719fb5ce7b547f9324fbebb24d0fd464fa10fd1fccf19f0f42441b5b27a5c93b29874c85ae55fd3cce1e8b903601c"}, 0x29)

[  751.612730][   T29] audit: type=1800 audit(1597295068.807:22): pid=19151 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.3" name="bus" dev="sda1" ino=15787 res=0
[  751.664037][T19145] tmpfs: Unknown parameter './bus'
[  751.817699][T19161] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
[  751.856278][T19157] overlayfs: conflicting lowerdir path
05:04:29 executing program 2:
syz_mount_image$tmpfs(&(0x7f00000002c0)='tmpfs\x00', &(0x7f0000000400)='./bus\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[])
chdir(&(0x7f0000000380)='./bus\x00')
close(0xffffffffffffffff)
open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, r0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)

[  751.984628][T19157] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
05:04:29 executing program 0:
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x6}, 0x4)
setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x16}]}, 0x10)
r1 = socket$inet6(0xa, 0x80003, 0x7)
connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @empty}, 0x1c)
sendmmsg(r1, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0)
ioctl$BLKPG(0xffffffffffffffff, 0x1269, 0x0)
setsockopt$inet_msfilter(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x1)

05:04:29 executing program 1:
openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6(0xa, 0x401000000001, 0x0)
close(r0)
r1 = socket$inet6(0xa, 0x3, 0xff)
connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x83, @empty}, 0x1c)
r2 = open(&(0x7f0000000100)='./bus\x00', 0x11250c2, 0x0)
r3 = creat(&(0x7f0000000040)='./bus\x00', 0x0)
ftruncate(r3, 0x208200)
r4 = socket(0x10, 0x3, 0x0)
r5 = socket(0x11, 0x800000003, 0x0)
syncfs(r4)
bind(r5, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
sendfile(r0, r2, 0x0, 0x8000fffffffe)

05:04:29 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x7, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:04:29 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0)
execve(0x0, 0x0, 0x0)
r0 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$GIO_SCRNMAP(r0, 0x4b40, &(0x7f0000000040)=""/52)
openat$full(0xffffff9c, 0x0, 0x0, 0x0)
syz_genetlink_get_family_id$nl80211(0x0)

05:04:30 executing program 3:
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
r0 = open(&(0x7f0000000000)='./bus\x00', 0x103042, 0x0)
mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800006, 0x11, r0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9)
getrusage(0x0, &(0x7f0000000080))

[  752.854457][   T29] audit: type=1800 audit(1597295070.047:23): pid=19171 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.1" name="bus" dev="sda1" ino=15805 res=0
05:04:30 executing program 2:
syz_mount_image$tmpfs(&(0x7f00000002c0)='tmpfs\x00', &(0x7f0000000400)='./bus\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[])
chdir(&(0x7f0000000380)='./bus\x00')
close(0xffffffffffffffff)
open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, r0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)

[  753.672779][T19183] overlayfs: failed to resolve './file0/../file0': -2
[  753.873988][T19185] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
[  753.874513][T19183] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
05:04:31 executing program 1:
setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0)
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x3}, 0x0, 0x2000, 0x0, 0x2, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0)
pipe(&(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700)
splice(r0, 0x0, r2, 0x0, 0x88000cc, 0x0)
fcntl$setpipe(r1, 0x407, 0x100000)
write$eventfd(r1, &(0x7f0000000240), 0xffffff14)

05:04:31 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0x2, &(0x7f0000000080)=0x10000, 0x4)

05:04:31 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x8, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:04:31 executing program 2:
syz_mount_image$tmpfs(&(0x7f00000002c0)='tmpfs\x00', &(0x7f0000000400)='./bus\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[])
chdir(&(0x7f0000000380)='./bus\x00')
close(0xffffffffffffffff)
open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, r0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)

05:04:32 executing program 5:
openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$inet6(0xa, 0x401000000001, 0x0)
close(r0)
r1 = socket$inet6(0xa, 0x3, 0xff)
connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c)
r2 = open(&(0x7f0000000100)='./bus\x00', 0x11250c2, 0x0)
r3 = creat(&(0x7f0000000040)='./bus\x00', 0x0)
ftruncate(r3, 0x208200)
sendfile(r0, r2, 0x0, 0x8000fffffffe)

05:04:32 executing program 1:
socket$inet_udp(0x2, 0x2, 0x0)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f00000002c0)={0x2, 0x70, 0xab, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0), 0x4)
bind$inet(r0, &(0x7f0000000440)={0x2, 0x4e23, @broadcast}, 0x10)
sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10)

[  755.716877][T19210] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
[  755.784481][T19206] overlayfs: conflicting lowerdir path
[  755.931978][   T29] audit: type=1800 audit(1597295073.117:24): pid=19211 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.5" name="bus" dev="sda1" ino=16212 res=0
[  755.989547][T19210] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
[  756.027685][T19206] overlayfs: conflicting lowerdir path
05:04:33 executing program 0:
openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$inet6(0xa, 0x401000000001, 0x0)
close(r0)
r1 = socket$inet6(0xa, 0x3, 0xff)
connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c)
r2 = open(&(0x7f0000000100)='./bus\x00', 0x11250c2, 0x0)
r3 = creat(&(0x7f0000000040)='./bus\x00', 0x0)
ftruncate(r3, 0x208200)
sendfile(r0, r2, 0x0, 0x8000fffffffe)

05:04:33 executing program 2:
syz_mount_image$tmpfs(&(0x7f00000002c0)='tmpfs\x00', &(0x7f0000000400)='./bus\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[])
chdir(&(0x7f0000000380)='./bus\x00')
close(0xffffffffffffffff)
ftruncate(0xffffffffffffffff, 0x200004)
r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, r0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)

05:04:33 executing program 5:
openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$inet6(0xa, 0x401000000001, 0x0)
close(r0)
r1 = socket$inet6(0xa, 0x3, 0xff)
connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c)
r2 = open(&(0x7f0000000100)='./bus\x00', 0x11250c2, 0x0)
r3 = creat(&(0x7f0000000040)='./bus\x00', 0x0)
ftruncate(r3, 0x208200)
sendfile(r0, r2, 0x0, 0x8000fffffffe)

05:04:33 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x9, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

[  757.081459][   T29] audit: type=1800 audit(1597295074.267:25): pid=19223 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.5" name="bus" dev="sda1" ino=15770 res=0
05:04:34 executing program 3:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000080)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x3}]}, 0x10)
r3 = socket$inet_udp(0x2, 0x2, 0x0)
fcntl$setpipe(r0, 0x407, 0x0)
write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0)
bind$inet(r3, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x19}}, 0x10)
connect$inet(r3, &(0x7f0000000140)={0x2, 0x0, @multicast1}, 0x10)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xfdffffffffffffff, 0xffffffffffffffff, 0x0)
splice(r0, 0x0, r3, 0x0, 0x32400, 0x0)

05:04:34 executing program 1:
openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$inet6(0xa, 0x401000000001, 0x0)
close(r0)
r1 = socket$inet6(0xa, 0x3, 0xff)
connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c)
r2 = open(&(0x7f0000000100)='./bus\x00', 0x11250c2, 0x0)
r3 = creat(&(0x7f0000000040)='./bus\x00', 0x0)
ftruncate(r3, 0x208200)
sendfile(r0, r2, 0x0, 0x8000fffffffe)

[  757.148628][   T29] audit: type=1800 audit(1597295074.337:26): pid=19229 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.0" name="bus" dev="sda1" ino=15772 res=0
[  757.372679][T19233] overlayfs: conflicting lowerdir path
05:04:34 executing program 2:
syz_mount_image$tmpfs(&(0x7f00000002c0)='tmpfs\x00', &(0x7f0000000400)='./bus\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[])
chdir(&(0x7f0000000380)='./bus\x00')
close(0xffffffffffffffff)
ftruncate(0xffffffffffffffff, 0x200004)
r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, r0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)

05:04:34 executing program 5:
openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$inet6(0xa, 0x401000000001, 0x0)
close(r0)
r1 = socket$inet6(0xa, 0x3, 0xff)
connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c)
r2 = open(&(0x7f0000000100)='./bus\x00', 0x11250c2, 0x0)
r3 = creat(&(0x7f0000000040)='./bus\x00', 0x0)
ftruncate(r3, 0x208200)
sendfile(r0, r2, 0x0, 0x8000fffffffe)

05:04:34 executing program 0:
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
socket(0x0, 0x0, 0x0)
poll(0x0, 0x0, 0x204)
timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @tid=0xffffffffffffffff}, &(0x7f0000000240))
timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0)
timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @tid=0xffffffffffffffff}, &(0x7f0000000200)=<r0=>0x0)
timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0)
rt_sigsuspend(&(0x7f0000000280), 0x8)

[  757.630090][T19234] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
[  757.652525][T19233] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
[  757.958244][   T29] audit: type=1800 audit(1597295075.147:27): pid=19237 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.1" name="bus" dev="sda1" ino=16383 res=0
05:04:35 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0xa, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:04:35 executing program 1:
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000400)=ANY=[@ANYBLOB="b702000006000000bfa300000000000007030000007effff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000001c00006a0a00fe00000000850000000d000000b7000000000000009500000000000000496cf2827fb43a431ca711fcd0cdfa146ed3d09a6175037958e271b60d25b793cf5cc0ac77db96753dd29c03404ed47dafe6c8dc3d5d78c07f34e4d5b31b5b310efd4989147a09000000f110026e6d2ef831ab7ea0c34f17e3adeef3bb622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b0a341a2d7cbdb9cd38bdb2ca8e050000003a14817ac61e4dd11183a13477bf7e060e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2179fb19f28d9961b626c57c2691208173656d60a17e3c184b751c51160fbcbbdb5b1e7be6148ba532e6ea09c346dfebd31a08b32808b80200000000000000334d83239dd27080e71113610e10d858e8327ef01fb6c86adac12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3d74ca891c4594e8a4399e01eadd3964663e88535c133f7130856f756436303767d2e24f29e5dad9596edb697a6ea0182bab9818b0a83dede495d754dc128cae2ed4b4390af9a9ffefd07e002cab5ebf8aad34732181feb215139f15ea7e8cb0c7cbe31fbae7c34d5ac5e7e64c21add9191eadd6e1795ad6a0f7f88345d4f71af3cbf781c0a99bd50499ccc421ace5e85efb17c7beba3da8223fe5308e4e65eebaace04f4087c4f0da0d9a88f9dbb593ddebf70132563e47e2de0406edd09ee3a4d0175b989b8eccf707882042e716df9b57b290c661d4e85031086e97bcc5ca0e221a0e34323c12910296b7a643e82e88a1940b3c02ed9c92d6f24b1282dc519b00159830d7617001154c46bd3ca96318c570f0721fc7aa2a5809000000065ad624f45bd40000000094f22cdf550ef091a78098534f0d973058594119d06d5ea9a8d0857382ec6e28071474cfc12346e47ad97f4ead7cf754a52e4b2d0f22d428bd705414888761a30e2366c6a06bf55785052f95441a87790017b00100173db9c24db65c1e00015c1d573dab18fd0600885f1ea8f2453dcb6a2bfd299fc3cdafda323e9c7080397bc49d70c060d57bc88fbe3bbaa058b040362ab9261503def363fb099408885afc2bf9a4f8c35070669ea69f5e4be1b8e0d6697e98b26fc51439d670dba6623279f73db9dec75070cd9ab0fd96b069ef6d2857b6bf955012cf7fe50d133d541da86e0477e4a6cc999dc21c3ef408e633dfa35f14d6e734837d365e63845f3c1092f8dde8af3904ea0f4b82649b83ed4fa0f873339c4cad4ead134847425a6da2c8067ab743c1d82a5687f2ed690700000000000000000000000000000000000000000093fc7a82b98f99d9dedf7ba17f5f0b6d15e552fbd21f7eecff102b5243af03eea84c4304a5d3f93c3fc74c00000000000043e1ed82b9960ae92a499984a082776eb0937523f5292d126599d4345cde64f903c3415c618a32c2318f0858f19c6def80e1481e8e1c0098fc3f38b7a57211adb15d824cfdcf229628c0de49860a442863d6e257cfa4ce50f3d163d442824414a7da26cc86d7e18631c2061b1c8a8e3c06837fe08de62f8710ca977960a70685eace73da6022a8671d1a3575b4e18c28c73203bf134686dd65808452cb6b76fcb134252c78de9b240de7b4cd015a77f76b3f964f432a4bf6cddd6222c2da006b6fdb9c8468ae1d986a893b95195b4d16a6dfa92c04331a6698507048fab5ae402acd05fe621f22712dfd09ea4770b4278fa14547d8ce3c21188e5e4e2baacd98e8e443d6aaafe80053636ed1d99346c2468dd952595d78e9583bf4ea5de36099e3cddcb23aefd124b0ab85580f4ebb6eddb9e87c9ece874be869b3abe1c67788b247695533cc662ea09fea55887dfa18d0aea13625895db90e237157a34ea9447237ea5b391bddd1290f7ce987a0e36b8e0400779b253e49d21836e4b3220616aafbe7a3a18375ae593eb58fd5004262d31f7a4dd5b3b0f1cfb55dadf450d7a5e087171ca0209d6444dbecac8d5dd3600873ec8d013f158f503e8347e91d890c0c585457bca7017cf2201458e8f709af01134ef16e5b31ce4ce49bf09cd01af73b3aa23e55934e9aba90a1f91f47c9cd13528e516d07b0b8fe3a08f8da0a5a0eca8e38214000000000000000087d99b002d3c1af0bcd77a7995e6424129958485f711e1f14ae295360a84c9b20aec3618cbace6e18727914fa217a9582ebd94321669c63f576027ed5036dc3b9df41a12d7a60930693da768a814db21dc81695b8760f788760090000000000e7731f107c4f64de2305573e188e3de879991c9baad0b1eb783d2ca57f5258a23bf549c125b94cf3a6f3e9ed13bf074a8ce8ccdd015105f92239bebba7c81d1106e28f0608cfe0f10af485dc38ef32e5886b9c964a53c1e793dab1809ec59661288ae7f7977bb05f41f60b98f393e737eda199ab4287045f5f80f686d3013d54c2a4d46b6113ef65f2c4d6df00000000000000000000000000000000bbf502527b35c708f771cc557a7d8bea097ac5c904a7338d1e26a8f5bf66231e08cb6ebdd6a82dded6767411b7ee06cf15fe830da6c1b92c73aef22d901f989d90df5caf702d28234ed358254c901cb8799c6fdd2e2cdc595e5b5c03f117b539fd268002c0b3b9f6f4a7b2a0894491660d06334d9ec4217d085c0e69301b38ebffb7071d80c36995beeae6851aa96b198216b6c89a42e1f6448141ce5923a02ff4c6b4f4f980897d8e54df0611cc650a7ba2fa1b0bca7d2f6fe9be81c3ddbe6b168f1a0ee5ed20"], &(0x7f0000000340)='syzkaller\x00'}, 0x48)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r0, 0x18000000000002a0, 0x43, 0x6000, &(0x7f0000000280)="b9ff0300600d698c389e14f065581fffffff000040006321000e08060001080006040062050000002fbd53039e6aab84181aa5feffff07000000fe0000000000000000", 0x0, 0xfc, 0x60000000, 0x0, 0x0, &(0x7f0000000140)="486e90decd837f7e62c4f903a15a12d35c31c761c1da726b54ccd47736cdde536c0b3e75ef5c913757491df3e38f5cc44e6847bdc594358967964f76aa9f31a6", &(0x7f0000000e00)="e2cf5bb7e5746a6740aebad755a0c2f42d131e1493afc9154aeae4ff8916e84fae2dbac6ba23acee58596467b1d68d886cf44ae164800edec75a809bcc514384c499930e5c18337dcbedb8e326b8b42e4ba1acb01b73cdcef9b719fb5ce7b547f9324fbebb24d0fd464fa10fd1fccf19f0f42441b5b27a5c93b29874c85ae55fd3cce1e8b903601c"}, 0x29)

[  758.484891][T19257] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
[  758.499933][   T29] audit: type=1800 audit(1597295075.687:28): pid=19249 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.5" name="bus" dev="sda1" ino=16355 res=0
[  758.538776][T19255] overlayfs: conflicting lowerdir path
[  758.721407][T19257] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
05:04:36 executing program 2:
syz_mount_image$tmpfs(&(0x7f00000002c0)='tmpfs\x00', &(0x7f0000000400)='./bus\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[])
chdir(&(0x7f0000000380)='./bus\x00')
close(0xffffffffffffffff)
ftruncate(0xffffffffffffffff, 0x200004)
r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, r0, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)

[  758.784952][T19255] overlayfs: conflicting lowerdir path
05:04:36 executing program 5:
openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$inet6(0xa, 0x401000000001, 0x0)
close(r0)
r1 = socket$inet6(0xa, 0x3, 0xff)
connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c)
r2 = open(&(0x7f0000000100)='./bus\x00', 0x11250c2, 0x0)
r3 = creat(&(0x7f0000000040)='./bus\x00', 0x0)
ftruncate(r3, 0x208200)
sendfile(r0, r2, 0x0, 0x8000fffffffe)

05:04:36 executing program 0:
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x6}, 0x4)
setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x16}]}, 0x10)
r1 = socket$inet6(0xa, 0x80003, 0x7)
connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @empty}, 0x1c)
sendmmsg(r1, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0)
ioctl$BLKPG(0xffffffffffffffff, 0x1269, &(0x7f0000000240)={0x1, 0x0, 0x0, &(0x7f0000000180)})
setsockopt$inet_msfilter(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x1)

05:04:36 executing program 3:
bpf$ENABLE_STATS(0x20, 0x0, 0x0)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f0000000d00)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000007000000b70000000000000095000000000000003faf4f2aa3d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a286cecc93e64c227ffff000000000000f07a72c2918451ebdcf4cef809606056fe5c34664c0af9360a1f7a5e6b607130c89f18c0c1083a30369d8b8588d72ec29c48b45ef4adf634be763289d01aa27ae8b09e00e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468972089b302d7bf6023cdcedb5e0125ebbcebdde510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cfd7c3a1d37a6ab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660580800dbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd80a504cea9542e62d7f69667e3ddcd567b3aa3926b81e3b59c9b081d6a08000000ea2b1a52496dfcaf99431412fd134a000082a1a04d5bb924cfe5f3185418d60532af9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae616b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf58351d564beb61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326efa31ae4e0f7505ebf6c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f695c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc22941330000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b6c4a000000002b435ac15fc0288d9b2a169cdcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad897ef3b7cda42013d53046da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b2633398631c7771429d120000de3241bf4a00fcffffffffffffffe09fec2271fe01589646efd1cf870cd7bb2366fde4a59429738fcc917a57f94f6c453cea793cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcb32c8ed1dbd9d10a64c108285e71b5565b1768fb40fe418ce970275d5bc8955778567bc79e13b78249788f11f761038b75d4fa32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ecbbc55bf404e4e1f74b7eed82571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d1d4b405c37feaf3dd95f6ef2acd1fe582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3542c9062ece84c99a061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e76003b4ad05573af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3e90e5c708ce65cd6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f895778cb26e22a2a998de44aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e089b862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27de8f2a4ebb04b0c485b72d538ba4958ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250df98674152f94e32409e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e87306703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d1a8fe64680b0a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7d58c08acaf30235b928a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e600263d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854356cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466ac96e0d4b3bb49faa5449209b085f3c334b47f067bbab40743b2a428f1da1f68df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c7868c6da7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c000000000000000000000000009bff5348dd9639a9f34b5f92b7646000e3053358f55cb9f97c269eaf7327c32ab116a303ae64c9c714217c"], &(0x7f0000000100)='GPL\x00'}, 0x48)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="e3d0e9d6d9d18e5f39868de363d3", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40)

05:04:36 executing program 4:
mkdir(&(0x7f0000000240)='./file1\x00', 0x0)
mkdir(&(0x7f0000000180)='./bus\x00', 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0/../file0'}}]})
mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0xb, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './bus'}}]})

05:04:36 executing program 1:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0)
r1 = socket$kcm(0x10, 0x2, 0x0)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0xc, 0x0, 0xc}, 0x40)
bpf$OBJ_GET_MAP(0x7, &(0x7f0000000180)={&(0x7f00000000c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00'}, 0x10)
recvmsg$kcm(0xffffffffffffffff, &(0x7f00000030c0)={&(0x7f0000001f00)=@xdp={0x2c, 0x0, <r3=>0x0}, 0x80, &(0x7f0000002080)=[{&(0x7f0000001f80)=""/134, 0x86}, {&(0x7f0000002040)=""/42, 0x2a}], 0x2, &(0x7f00000020c0)=""/4096, 0x1000}, 0x10000)
bpf$MAP_CREATE(0x0, &(0x7f0000003100)={0x7, 0x0, 0x2, 0x2, 0x0, 0xffffffffffffffff, 0x101, [], r3, 0xffffffffffffffff, 0x5, 0x0, 0x5}, 0x40)
r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000b00)=ANY=[@ANYBLOB="b702000031000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000002000109500000000000000e3a333a0daf2f73451c0e17a606fe530cb7d7f933e997015c0d814886d2a403918da02ba18ad181867514fe60077e085fbdfd43307c529a4ce6be614c2e31789e70233bfd8115efd90c8c48238f8dbe82e16cf8db95f5b068a9e00000000000000000061b1f03422dd5123d1301200000000000000e707fa8bd50540ad7f83cecb1100000000000000000000000000000018287b87d8807c2877cc420efca65f5deb269dff9198560276c69e4403266b08506e7f295d4bacb4b8eece9e0a49b72dfcf359d16b1e153e7a5c9df18367809c71dc79c2b2832d167bb643ad70ee492468e584e464fb521a0b5a61b8770824212b72fe39f28cea1c96cb879e61f8f10051495538776b974754f218000000000000872b7a73d91c95f501460642f3f482f334366c1f23367fb30d8fbcfde1114429bcf86f1e8b838fea8342dcf3dccc5383ae84e562c00608196cdfa16a43bd5db9de77760955586134ecdeafb4481dcb742fa4610000000000000000000000fc50ea9abcbd0aa3bae559a1521a7848e56a04006c2dc066a8acbeac3cea19b49495d8ac0b7177ba765c"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x3d}, 0x48)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000740)={r4, 0x4000a0, 0xe, 0x5ac484bb51fa106a, &(0x7f0000000040)="4d50b441e692763513ef874565020007000112bbf3159fd0880f892fd398e4020a00001375bc847d142d1523389037a1d4f5631813cf7037fd584b4af7507a849ce80deea1a57733a5e3730fbef42ab9bedd390775bf809fbcf2a71f32d41a1f7ff3b5483107766a8bd0033d44e6ef7b526c8c67aa9847e283c6cdccbd627ad1094342b1840b506814cb319132533f6d740d9643d0c6dc8481d0c9643dd3e0aa6e1be581aca3ea9377136ce8dd480207fba7af225672c63802beb9647a5fbe90781e147e92eae8d9d79d0d", 0x0, 0x23, 0x0, 0x22d, 0x1000000}, 0x28)
bpf$PROG_LOAD(0x5, &(0x7f0000001140)={0xc, 0x8, &(0x7f0000000f00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d4}, [@func={0x85, 0x0, 0x1, 0x0, 0x4}, @call={0x85, 0x0, 0x0, 0x62}, @generic={0x3, 0x1, 0x1, 0x3, 0x4}, @map={0x18, 0x3}]}, &(0x7f0000000f40)='GPL\x00', 0x151, 0xd2, &(0x7f0000000f80)=""/210, 0x41100, 0x8, [], r3, 0x10, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r4}, 0x78)
bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x16, 0x0, 0x8, 0x100, 0x0, r2, 0xfff, [], r3, 0xffffffffffffffff, 0x3, 0x0, 0x1}, 0x40)
r5 = socket$kcm(0x11, 0x200000000000002, 0x300)
sendmsg(r1, &(0x7f0000000e40)={&(0x7f0000000400)=@in={0x2, 0x0, @broadcast}, 0x80, &(0x7f0000000700)=[{&(0x7f0000000480)="4e85b3b407139efe93ec5ddf2f9fd4ffb920016948b50978af0b6abfce8e692d62e2867252183a79e0363c18e970d363574dabfb6be4530fe8e28fda44794e4f7108f5e871e69348ab28deb3e07e54cb0fb045", 0x53}, {&(0x7f0000000500)="0971a331f40aabe11c02ab4bef86e92fdc7e389dc659e73630ce616450cc06705524bdabb7f80dd50e48e6452af077e8243c40cf8d7aa3b0c7b7362d1ca5257ae8abfe0b8c7154a260", 0x49}, {&(0x7f0000000580)="bfd990fe53cd80cdfdd288898c12ef2f403e92a1906e6dd1c68628b1ab9d77fc071678596276715c8b1b38bb9fd24c9ff071a675154d395b6ad9269b6088a049f5", 0x41}, {&(0x7f0000000380)="476c78f5a940c5cb2fee7d00ee14d4c270907a", 0x13}, {&(0x7f0000000600)="27cbfc27fcf391f6de3d5fb0c9a573658c7bcdba8a61f878a424de50fd2a85d6df09305a87ad4a787144e20ff9c15c9e2b7191e03f4c9bed5d5799b4863d5740570decf0741479abdd4c6472c171e620410f8397ddbd3c85f1d02180b55f832821eb4f9e98b824e679abc8aab17fe1a1ec1ad02485437c6488ea05cf237a36eb10d95015ef43a4dcfdc633a15e54f0cfafc4433f83bce1fd297019786f47c830710697b7ae2b3c98757e47209f112b701a6efc40eb2bd836ffe140c441844e48058f28bda573c2bb47328312caf6", 0xce}], 0x5}, 0x4004041)
r6 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000780)=ANY=[@ANYBLOB="b7000000a5517f5fbfa30000000000000703000028feffff720af0fff8ffffff71a4f0ff00000000b7060000000000012e400300000000006506020001ed00007118540000000000c3640000000000006a0a00fe00000000850000002e000000b7000000000000009500000000000000023bc065b7a379d179fc9e94af69912435ecb6a693172e61917ae4b2ee1cdb10050000000beca090f32050e436fe275daf51efd601b6a719c8e88f16d036f3bef7054815ae98743d1ace4c46631256dd19aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc646cb779299abc6dac46aa712f2e6388f3286c69669622208266f896ba2c9673c2efeec2dc565fef9ab79ff8abaa8a08f54a063d07e9bb3e980bff675c8d3e91dfaa8f8d36c43a3ff4722b3ed22abcb63ed53d21c4e168ed59815db662aed089207711f0cbb9c06018d21bf3f87b8eb65323b4267a786d53442db8e48dbc5ce47d67d07441a70033ce06822092620100000000000020d3d3783e2ab82d3afc9135d678287b96cf607689e96f0caed51bc2542e6e5f4c70cd7d066cd750f83e65d06397df37c8"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x78)
ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000ec0)={0x5, &(0x7f0000000e80)=[{0x62d, 0x2e, 0x60, 0x6}, {0x0, 0x0, 0xd9, 0x1}, {0x9, 0x0, 0x6, 0xd86}, {0x8, 0x6, 0x9, 0xfff}, {0x2, 0x6d, 0x0, 0xffffffff}]})
setsockopt$sock_attach_bpf(r5, 0x1, 0x32, &(0x7f00000003c0)=r6, 0x4)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000300)={r6, 0xc0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={0x3, 0x1}, 0x0, 0x0, &(0x7f0000000080)={0x3, 0xd, 0x81, 0xd}, &(0x7f0000000180)=0x5, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=0x3}}, 0x10)
sendmsg$kcm(r1, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0)

[  759.574702][   T29] audit: type=1800 audit(1597295076.767:29): pid=19270 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.5" name="bus" dev="sda1" ino=16373 res=0
05:04:36 executing program 2:
syz_mount_image$tmpfs(&(0x7f00000002c0)='tmpfs\x00', &(0x7f0000000400)='./bus\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[])
chdir(&(0x7f0000000380)='./bus\x00')
r0 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r0, 0x200004)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, r1, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)

[  759.856767][T19283] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
[  759.906187][T19282] overlayfs: conflicting lowerdir path
[  760.055376][T19283] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
05:04:37 executing program 3:
bpf$ENABLE_STATS(0x20, 0x0, 0x0)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f0000000d00)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000007000000b70000000000000095000000000000003faf4f2aa3d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a286cecc93e64c227ffff000000000000f07a72c2918451ebdcf4cef809606056fe5c34664c0af9360a1f7a5e6b607130c89f18c0c1083a30369d8b8588d72ec29c48b45ef4adf634be763289d01aa27ae8b09e00e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468972089b302d7bf6023cdcedb5e0125ebbcebdde510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cfd7c3a1d37a6ab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660580800dbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd80a504cea9542e62d7f69667e3ddcd567b3aa3926b81e3b59c9b081d6a08000000ea2b1a52496dfcaf99431412fd134a000082a1a04d5bb924cfe5f3185418d60532af9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae616b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf58351d564beb61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326efa31ae4e0f7505ebf6c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f695c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc22941330000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b6c4a000000002b435ac15fc0288d9b2a169cdcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad897ef3b7cda42013d53046da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b2633398631c7771429d120000de3241bf4a00fcffffffffffffffe09fec2271fe01589646efd1cf870cd7bb2366fde4a59429738fcc917a57f94f6c453cea793cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcb32c8ed1dbd9d10a64c108285e71b5565b1768fb40fe418ce970275d5bc8955778567bc79e13b78249788f11f761038b75d4fa32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ecbbc55bf404e4e1f74b7eed82571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d1d4b405c37feaf3dd95f6ef2acd1fe582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3542c9062ece84c99a061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e76003b4ad05573af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3e90e5c708ce65cd6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f895778cb26e22a2a998de44aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e089b862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27de8f2a4ebb04b0c485b72d538ba4958ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250df98674152f94e32409e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e87306703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d1a8fe64680b0a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7d58c08acaf30235b928a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e600263d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854356cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466ac96e0d4b3bb49faa5449209b085f3c334b47f067bbab40743b2a428f1da1f68df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c7868c6da7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c000000000000000000000000009bff5348dd9639a9f34b5f92b7646000e3053358f55cb9f97c269eaf7327c32ab116a303ae64c9c714217c"], &(0x7f0000000100)='GPL\x00'}, 0x48)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="e3d0e9d6d9d18e5f39868de363d3", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40)

[  760.128241][T19282] overlayfs: conflicting lowerdir path
05:04:37 executing program 5:
bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8)
socketpair(0x1, 0x2000000003, 0x0, &(0x7f00000005c0)={<r0=>0xffffffffffffffff})
r1 = gettid()
r2 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x78, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, r2, 0x0)
perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x2, 0x8, 0x1, 0x1, 0x0, 0x3, 0x22880, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, @perf_bp={&(0x7f0000000040), 0x1}, 0x20, 0x0, 0x1, 0x8, 0x1, 0x5, 0x401}, r1, 0x0, r2, 0x8)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0)
bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000840)={r3, 0x0, 0x0, 0x0, 0x0}, 0x20)
write$cgroup_int(r3, &(0x7f0000000000), 0x12)
ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r3, 0x6611, 0x0)
perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x3, 0x0, 0xb3, 0x3, 0x0, 0x10001, 0x4201, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x2, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x400, 0x4, @perf_bp={&(0x7f0000000080), 0x2}, 0x40, 0x0, 0x14e, 0x5, 0x101, 0x5}, r1, 0x1, r3, 0x0)
sendmsg$kcm(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000100)="20f83508f5", 0x5}], 0x1}, 0x0)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000000c0), 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff8, 0x0, 0x0}, 0x40)
ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x89f1, &(0x7f0000000000)='ip6gre0\x00')
r4 = socket$kcm(0x2b, 0x1, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
socketpair(0x1, 0x2000000003, 0x0, &(0x7f00000005c0))

[  760.537275][T19287] =====================================================
[  760.544358][T19287] BUG: KMSAN: uninit-value in hsr_addr_subst_dest+0x4f7/0x760
[  760.551832][T19287] CPU: 1 PID: 19287 Comm: syz-executor.1 Not tainted 5.8.0-rc5-syzkaller #0
[  760.560502][T19287] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  760.570559][T19287] Call Trace:
[  760.573866][T19287]  dump_stack+0x21c/0x280
[  760.578311][T19287]  kmsan_report+0xf7/0x1e0
[  760.582763][T19287]  __msan_warning+0x58/0xa0
[  760.587289][T19287]  hsr_addr_subst_dest+0x4f7/0x760
[  760.592416][T19287]  ? __do_softirq+0x7f5/0x7f5
[  760.597128][T19287]  hsr_forward_skb+0x22a2/0x3600
[  760.602135][T19287]  hsr_dev_xmit+0x133/0x230
[  760.606652][T19287]  ? is_hsr_master+0xb0/0xb0
[  760.611317][T19287]  xmit_one+0x3cf/0x750
[  760.615496][T19287]  ? kmsan_get_metadata+0x116/0x180
[  760.620724][T19287]  __dev_queue_xmit+0x3aad/0x4470
[  760.625797][T19287]  dev_queue_xmit+0x4b/0x60
[  760.630396][T19287]  __bpf_redirect+0x1479/0x16b0
[  760.635282][T19287]  ? skb_ensure_writable+0x4d1/0x590
[  760.640594][T19287]  bpf_clone_redirect+0x498/0x650
[  760.645716][T19287]  ___bpf_prog_run+0x4498/0x98e0
[  760.650703][T19287]  ? kmsan_get_shadow_origin_ptr+0x81/0xb0
[  760.656539][T19287]  ? bpf_csum_level+0x780/0x780
[  760.661423][T19287]  __bpf_prog_run512+0x12e/0x190
[  760.666389][T19287]  ? __msan_get_context_state+0x9/0x20
[  760.671866][T19287]  ? idtentry_exit_cond_rcu+0x12/0x50
[  760.677350][T19287]  ? sysvec_apic_timer_interrupt+0x11e/0x130
[  760.683346][T19287]  ? asm_sysvec_apic_timer_interrupt+0x12/0x20
[  760.689517][T19287]  ? __do_softirq+0x7f5/0x7f5
[  760.694210][T19287]  ? kmsan_get_metadata+0x116/0x180
[  760.699425][T19287]  ? kmsan_internal_set_origin+0x75/0xb0
[  760.705075][T19287]  ? __msan_poison_alloca+0xf0/0x120
[  760.710372][T19287]  ? kmsan_get_metadata+0x116/0x180
[  760.715585][T19287]  ? kmsan_get_shadow_origin_ptr+0x81/0xb0
[  760.721410][T19287]  ? __msan_metadata_ptr_for_load_4+0x10/0x20
[  760.727492][T19287]  ? ktime_get+0x384/0x470
[  760.731931][T19287]  ? kmsan_get_metadata+0x4f/0x180
[  760.737068][T19287]  ? kmsan_get_shadow_origin_ptr+0x81/0xb0
[  760.742976][T19287]  ? __bpf_prog_run480+0x190/0x190
[  760.748185][T19287]  bpf_test_run+0x52d/0xed0
[  760.752740][T19287]  ? kmsan_get_shadow_origin_ptr+0x81/0xb0
[  760.758565][T19287]  bpf_prog_test_run_skb+0x1053/0x2ad0
[  760.764084][T19287]  ? bpf_prog_test_run_tracing+0xa00/0xa00
[  760.769901][T19287]  __do_sys_bpf+0xb364/0x1a4c0
[  760.774695][T19287]  ? kmsan_get_metadata+0x116/0x180
[  760.779915][T19287]  ? kmsan_get_metadata+0x116/0x180
[  760.785133][T19287]  ? kmsan_get_metadata+0x116/0x180
[  760.790349][T19287]  ? kmsan_internal_check_memory+0xb1/0x3d0
[  760.796252][T19287]  ? __msan_poison_alloca+0xf0/0x120
[  760.801592][T19287]  ? put_old_timespec32+0x231/0x2d0
[  760.806807][T19287]  ? kmsan_get_metadata+0x116/0x180
[  760.812022][T19287]  ? kmsan_get_metadata+0x116/0x180
[  760.817236][T19287]  ? kmsan_get_metadata+0x116/0x180
[  760.822447][T19287]  __se_sys_bpf+0x8e/0xa0
[  760.826809][T19287]  __ia32_sys_bpf+0x4a/0x70
[  760.831329][T19287]  __do_fast_syscall_32+0x2af/0x480
[  760.836552][T19287]  do_fast_syscall_32+0x6b/0xd0
[  760.841421][T19287]  do_SYSENTER_32+0x73/0x90
[  760.845944][T19287]  entry_SYSENTER_compat_after_hwframe+0x4d/0x5c
[  760.852278][T19287] RIP: 0023:0xf7f04549
[  760.856345][T19287] Code: Bad RIP value.
[  760.860414][T19287] RSP: 002b:00000000f54fe0cc EFLAGS: 00000296 ORIG_RAX: 0000000000000165
[  760.868833][T19287] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 0000000020000740
[  760.876813][T19287] RDX: 0000000000000028 RSI: 0000000000000000 RDI: 0000000000000000
[  760.884796][T19287] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[  760.892792][T19287] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[  760.900795][T19287] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[  760.908795][T19287] 
[  760.911122][T19287] Uninit was stored to memory at:
[  760.916167][T19287]  kmsan_internal_chain_origin+0xad/0x130
[  760.921928][T19287]  kmsan_memcpy_memmove_metadata+0x272/0x2e0
[  760.927931][T19287]  kmsan_memmove_metadata+0xe/0x10
[  760.933054][T19287]  __msan_memmove+0x43/0x50
[  760.937566][T19287]  hsr_forward_skb+0x2ae1/0x3600
[  760.942513][T19287]  hsr_dev_xmit+0x133/0x230
[  760.947028][T19287]  xmit_one+0x3cf/0x750
[  760.951189][T19287]  __dev_queue_xmit+0x3aad/0x4470
[  760.956216][T19287]  dev_queue_xmit+0x4b/0x60
[  760.960733][T19287]  __bpf_redirect+0x1479/0x16b0
[  760.965591][T19287]  bpf_clone_redirect+0x498/0x650
[  760.970626][T19287]  ___bpf_prog_run+0x4498/0x98e0
[  760.975580][T19287]  __bpf_prog_run512+0x12e/0x190
[  760.980527][T19287]  bpf_test_run+0x52d/0xed0
[  760.985040][T19287]  bpf_prog_test_run_skb+0x1053/0x2ad0
[  760.990508][T19287]  __do_sys_bpf+0xb364/0x1a4c0
[  760.995278][T19287]  __se_sys_bpf+0x8e/0xa0
[  760.999630][T19287]  __ia32_sys_bpf+0x4a/0x70
[  761.004140][T19287]  __do_fast_syscall_32+0x2af/0x480
[  761.009364][T19287]  do_fast_syscall_32+0x6b/0xd0
[  761.014226][T19287]  do_SYSENTER_32+0x73/0x90
[  761.018742][T19287]  entry_SYSENTER_compat_after_hwframe+0x4d/0x5c
[  761.025077][T19287] 
[  761.027404][T19287] Uninit was created at:
[  761.031669][T19287]  kmsan_internal_poison_shadow+0x66/0xd0
[  761.037409][T19287]  kmsan_slab_alloc+0x8a/0xe0
[  761.042097][T19287]  __kmalloc_node_track_caller+0xeab/0x12e0
[  761.047999][T19287]  __alloc_skb+0x35f/0xb30
[  761.052424][T19287]  __pskb_copy_fclone+0x173/0x1940
[  761.057561][T19287]  hsr_forward_skb+0x1ee8/0x3600
[  761.062503][T19287]  hsr_dev_xmit+0x133/0x230
[  761.067021][T19287]  xmit_one+0x3cf/0x750
[  761.071186][T19287]  __dev_queue_xmit+0x3aad/0x4470
[  761.076215][T19287]  dev_queue_xmit+0x4b/0x60
[  761.080726][T19287]  __bpf_redirect+0x1479/0x16b0
[  761.085582][T19287]  bpf_clone_redirect+0x498/0x650
[  761.090619][T19287]  ___bpf_prog_run+0x4498/0x98e0
[  761.095562][T19287]  __bpf_prog_run512+0x12e/0x190
[  761.100508][T19287]  bpf_test_run+0x52d/0xed0
[  761.105021][T19287]  bpf_prog_test_run_skb+0x1053/0x2ad0
[  761.110492][T19287]  __do_sys_bpf+0xb364/0x1a4c0
[  761.115262][T19287]  __se_sys_bpf+0x8e/0xa0
[  761.119597][T19287]  __ia32_sys_bpf+0x4a/0x70
[  761.124132][T19287]  __do_fast_syscall_32+0x2af/0x480
[  761.129355][T19287]  do_fast_syscall_32+0x6b/0xd0
[  761.134239][T19287]  do_SYSENTER_32+0x73/0x90
[  761.138767][T19287]  entry_SYSENTER_compat_after_hwframe+0x4d/0x5c
[  761.145092][T19287] =====================================================
[  761.152021][T19287] Disabling lock debugging due to kernel taint
[  761.158179][T19287] Kernel panic - not syncing: panic_on_warn set ...
[  761.164784][T19287] CPU: 1 PID: 19287 Comm: syz-executor.1 Tainted: G    B             5.8.0-rc5-syzkaller #0
[  761.174855][T19287] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  761.185032][T19287] Call Trace:
[  761.188353][T19287]  dump_stack+0x21c/0x280
[  761.192783][T19287]  panic+0x4d7/0xef7
[  761.196717][T19287]  ? add_taint+0x17c/0x210
[  761.201158][T19287]  kmsan_report+0x1df/0x1e0
[  761.205701][T19287]  __msan_warning+0x58/0xa0
[  761.210229][T19287]  hsr_addr_subst_dest+0x4f7/0x760
[  761.215353][T19287]  ? __do_softirq+0x7f5/0x7f5
[  761.220092][T19287]  hsr_forward_skb+0x22a2/0x3600
[  761.225101][T19287]  hsr_dev_xmit+0x133/0x230
[  761.230681][T19287]  ? is_hsr_master+0xb0/0xb0
[  761.235303][T19287]  xmit_one+0x3cf/0x750
[  761.239485][T19287]  ? kmsan_get_metadata+0x116/0x180
[  761.244704][T19287]  __dev_queue_xmit+0x3aad/0x4470
[  761.249787][T19287]  dev_queue_xmit+0x4b/0x60
[  761.254310][T19287]  __bpf_redirect+0x1479/0x16b0
[  761.259188][T19287]  ? skb_ensure_writable+0x4d1/0x590
[  761.264499][T19287]  bpf_clone_redirect+0x498/0x650
[  761.269560][T19287]  ___bpf_prog_run+0x4498/0x98e0
[  761.274514][T19287]  ? kmsan_get_shadow_origin_ptr+0x81/0xb0
[  761.280341][T19287]  ? bpf_csum_level+0x780/0x780
[  761.285220][T19287]  __bpf_prog_run512+0x12e/0x190
[  761.290194][T19287]  ? __msan_get_context_state+0x9/0x20
[  761.295676][T19287]  ? idtentry_exit_cond_rcu+0x12/0x50
[  761.301063][T19287]  ? sysvec_apic_timer_interrupt+0x11e/0x130
[  761.307059][T19287]  ? asm_sysvec_apic_timer_interrupt+0x12/0x20
[  761.313246][T19287]  ? __do_softirq+0x7f5/0x7f5
[  761.317946][T19287]  ? kmsan_get_metadata+0x116/0x180
[  761.323169][T19287]  ? kmsan_internal_set_origin+0x75/0xb0
[  761.328826][T19287]  ? __msan_poison_alloca+0xf0/0x120
[  761.334129][T19287]  ? kmsan_get_metadata+0x116/0x180
[  761.339348][T19287]  ? kmsan_get_shadow_origin_ptr+0x81/0xb0
[  761.345285][T19287]  ? __msan_metadata_ptr_for_load_4+0x10/0x20
[  761.351377][T19287]  ? ktime_get+0x384/0x470
[  761.355836][T19287]  ? kmsan_get_metadata+0x4f/0x180
[  761.361061][T19287]  ? kmsan_get_shadow_origin_ptr+0x81/0xb0
[  761.366894][T19287]  ? __bpf_prog_run480+0x190/0x190
[  761.372025][T19287]  bpf_test_run+0x52d/0xed0
[  761.376669][T19287]  ? kmsan_get_shadow_origin_ptr+0x81/0xb0
[  761.382504][T19287]  bpf_prog_test_run_skb+0x1053/0x2ad0
[  761.388033][T19287]  ? bpf_prog_test_run_tracing+0xa00/0xa00
[  761.393859][T19287]  __do_sys_bpf+0xb364/0x1a4c0
[  761.398653][T19287]  ? kmsan_get_metadata+0x116/0x180
[  761.403880][T19287]  ? kmsan_get_metadata+0x116/0x180
[  761.409096][T19287]  ? kmsan_get_metadata+0x116/0x180
[  761.414310][T19287]  ? kmsan_internal_check_memory+0xb1/0x3d0
[  761.420220][T19287]  ? __msan_poison_alloca+0xf0/0x120
[  761.425560][T19287]  ? put_old_timespec32+0x231/0x2d0
[  761.430772][T19287]  ? kmsan_get_metadata+0x116/0x180
[  761.435983][T19287]  ? kmsan_get_metadata+0x116/0x180
[  761.441212][T19287]  ? kmsan_get_metadata+0x116/0x180
[  761.446428][T19287]  __se_sys_bpf+0x8e/0xa0
[  761.450781][T19287]  __ia32_sys_bpf+0x4a/0x70
[  761.455304][T19287]  __do_fast_syscall_32+0x2af/0x480
[  761.460529][T19287]  do_fast_syscall_32+0x6b/0xd0
[  761.465395][T19287]  do_SYSENTER_32+0x73/0x90
[  761.469917][T19287]  entry_SYSENTER_compat_after_hwframe+0x4d/0x5c
[  761.476256][T19287] RIP: 0023:0xf7f04549
[  761.480325][T19287] Code: Bad RIP value.
[  761.484429][T19287] RSP: 002b:00000000f54fe0cc EFLAGS: 00000296 ORIG_RAX: 0000000000000165
[  761.492848][T19287] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 0000000020000740
[  761.500832][T19287] RDX: 0000000000000028 RSI: 0000000000000000 RDI: 0000000000000000
[  761.508809][T19287] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[  761.516788][T19287] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[  761.524766][T19287] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[  761.533878][T19287] Kernel Offset: disabled
[  761.538215][T19287] Rebooting in 86400 seconds..